CHFI Timed Hard Questions — 25 Difficult Questions

Question 1

An investigator acquires an SSD from a laptop that has been turned off for 24 hours. The suspect recently deleted several incriminating files. Using a forensic imager, the investigator creates a bit-for-bit copy. However, when analyzing the image, the deleted files' data appears to be zeros. What is the MOST likely cause?

15 minute time limit — choose an answer to begin.

Accepted Answer

The TRIM command was issued, causing the SSD to erase the freed blocks. The TRIM command is an ATA command that allows an operating system to inform an SSD which data blocks are no longer in use and can be wiped internally. When the suspect deleted the files, the OS likely issued a TRIM command to the SSD, causing the controller to erase the freed physical blocks. Since the laptop was off for 24 hours, the SSD had ample time to complete the garbage collection process, resulting in the deleted files' data appearing as zeros in the forensic image.

Answer

The files were stored in the paging file, which is volatile

Answer

The SSD controller performed wear leveling, moving data to unallocated blocks

Answer

The imaging tool incorrectly interpreted the data due to encryption

Question 2

During a Docker forensics investigation, an analyst needs to identify the commands executed within a deleted container. Which of the following approaches is MOST effective to retrieve this information?

Accepted Answer

Search the host filesystem for the container's log files in /var/lib/docker/containers. Docker stores container logs in JSON files on the host. Even after a container is removed, its logs may remain on the host filesystem under /var/lib/docker/containers until cleaned. Inspecting image layers only shows filesystem changes, not runtime commands.

Answer

Check the Docker daemon logs for container start/stop events

Answer

Use `docker inspect` on the container ID

Answer

Examine the container's image layers using `docker history`

Question 3

A forensic analyst is examining a RAID 5 array consisting of three disks. One disk has failed and has been replaced. The array is rebuilt automatically. However, the analyst needs to recover deleted files that existed before the rebuild. What is the MOST significant challenge in this scenario?

Accepted Answer

The rebuild process may overwrite data in slack space and previously unallocated clusters. When a RAID 5 array with a failed disk is rebuilt, the controller reconstructs data using parity information and writes it to the replacement disk. This rebuild process writes to all previously unallocated clusters and slack space across the array, potentially overwriting the very data the analyst hopes to recover. Deleted files that existed before the rebuild are at high risk of being overwritten during this automatic reconstruction, making recovery extremely difficult or impossible.

Answer

File carving techniques do not work on RAID volumes

Answer

The file system becomes corrupted after rebuild

Answer

The RAID controller encrypts data, preventing direct disk access

Question 4

A company's legal department issues a legal hold notice for electronically stored information (ESI) related to a pending lawsuit. The IT department is tasked with preserving data. Which of the following actions is MOST likely to violate the legal hold requirements?

Accepted Answer

Continuing to run a script that deletes temporary files older than 24 hours.. Continuing to run a script that deletes temporary files older than 24 hours directly destroys ESI that may be relevant to the lawsuit, violating the legal hold requirement to preserve all potentially relevant data. Legal hold mandates the suspension of any automated or manual processes that could alter or delete ESI, including temporary files that might contain fragments of relevant documents or metadata. Unlike suspending routine email deletion (Option B), which is a preservation action, the script actively purges data and thus breaches the hold.

Answer

Notifying all employees to preserve documents related to the lawsuit.

Answer

Suspending routine deletion of emails older than 30 days.

Answer

Taking a forensic image of the relevant servers.

Question 5

A forensic analyst is examining an Android device that has been factory reset. Which type of data is LEAST likely to be recoverable using forensic tools?

Accepted Answer

Encrypted app data from /data/data/. After a factory reset, the /data partition is wiped and re-encrypted with a new key. Encrypted app data stored under /data/data/ is protected by file-based encryption (FBE) using a per-user encryption key that is discarded during the reset. Without the original encryption key, forensic tools cannot decrypt this data, making it the least likely to be recoverable.

Answer

Google account tokens stored in AccountManager

Answer

System logs in /data/log/

Answer

Deleted text messages from SQLite files

Question 6

A forensic analyst is examining a hard drive that was imaged using a software write blocker. Which of the following is a potential disadvantage of using a software write blocker compared to a hardware write blocker?

Accepted Answer

It may be susceptible to operating system or driver vulnerabilities. A software write blocker operates at the operating system level, intercepting write commands before they reach the storage device. Because it relies on the OS and its drivers, any vulnerability in the OS kernel, storage driver stack, or the blocker's own filter driver could be exploited, potentially allowing unintended writes to the evidence. In contrast, a hardware write blocker physically prevents write signals from reaching the drive at the bus level, offering a more robust isolation that is independent of the host OS's security state.

Answer

It cannot be used with USB drives

Answer

It does not support hashing algorithms for integrity

Answer

It is more expensive than hardware write blockers

Question 7

A forensic analyst recovers a USB device from a suspect's computer. Which Windows registry key should be examined to determine the first time the USB device was connected?

Accepted Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR. The USBSTOR key under Enum in the SYSTEM hive stores detailed history of USB mass storage devices, including the first connection timestamp via the 'Properties' subkey (e.g., {83da6326-97a6-4088-9453-a1923f573b29} for first install date). This is the definitive location for determining the initial insertion time of a USB device in Windows forensics.

Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB

Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Question 8

Which THREE of the following are valid rules of evidence that digital evidence must satisfy to be admissible in court? (Select three.)

Accepted Answer

Admissibility. (Admissibility) is correct because digital evidence must be legally permissible in court, meaning it must be obtained lawfully and not violate constitutional rights. Admissibility is a foundational rule that ensures evidence meets legal standards for consideration by the court, often tied to the Federal Rules of Evidence (FRE) or similar jurisdictional rules. Without admissibility, even the most compelling digital evidence cannot be presented to the jury.

Answer

Best evidence rule

Answer

Chain of custody

Question 9

A malware analyst is examining a PE file that has a section named '.tls' and imports from 'kernel32.dll' and 'ntdll.dll'. The entry point points to a small stub that decrypts the main code at runtime. Which of the following best describes this technique?

Accepted Answer

TLS callback-based decryption. The presence of a '.tls' section in a PE file, combined with imports from kernel32.dll and ntdll.dll, indicates the use of Thread Local Storage (TLS) callbacks. These callbacks execute before the entry point, allowing the malware to decrypt the main code at runtime before the main executable logic runs. This is a classic TLS callback-based decryption technique, not a form of code injection or packing.

Answer

Code injection via Reflective DLL

Answer

Packing with UPX

Answer

Anti-debugging via NtGlobalFlag

Question 10

During a malware investigation, an analyst identifies a suspicious file that appears to be a Windows executable. Using PEiD, the analyst detects the file is packed with UPX. After unpacking, the analyst runs the file in a sandbox and observes it modifies the following registry key: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MalService. What behavioural indicator is primarily demonstrated?

Accepted Answer

Persistence mechanism. The modification of the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MalService is a classic persistence mechanism. By adding an entry to the Run key, the malware ensures that it executes automatically every time the user logs into the system, maintaining its presence across reboots.

Answer

Command and control communication

Answer

Anti-forensic technique (timestomping)

Answer

Privilege escalation attempt

Question 11

A forensic analyst is examining an Android device that has been factory reset. Which of the following artefacts is MOST likely to persist after a factory reset and provide valuable evidence?

Accepted Answer

The contents of the SD card's Android/data directory. A factory reset on Android wipes the internal user data partition (/data), which includes accounts.db containing Google authentication tokens and sync settings, as well as gatekeeper.password.key and mmssms.db. However, it does not format the external SD card, so files under Android/data on the SD card remain intact and can provide valuable evidence.

Answer

Google account authentication tokens and sync settings

Answer

Deleted SMS messages from the mmssms.db WAL file

Answer

The user's pattern lock hash stored in gatekeeper.password.key

Question 12

You are a CHFI analyst responding to a security incident at a medium-sized financial firm. The IT team reports that an employee's workstation (Windows 10, single SSD) was used to access sensitive customer data without authorization. The workstation is still running, and the employee is currently logged in. The IT team has isolated the machine from the network but has not powered it off. You have been called to perform forensic acquisition. The company policy requires preservation of volatile data and a full disk image. The machine has 16 GB RAM and a 512 GB SSD. You have a forensic toolkit including FTK Imager, win32dd (for memory acquisition), and a write-blocker. Which of the following is the best course of action?

Accepted Answer

Use win32dd to capture the contents of RAM to an external drive, then use FTK Imager to create a physical image of the SSD over the network to a secure share.. A is not valid: FTK Imager cannot send an image over the network if the machine is disconnected, and a live disk image risks inconsistent data. The correct forensic process is to (1) acquire volatile memory with win32dd, (2) hard-power off the system to preserve the disk state, (3) remove the SSD, and (4) image it using a hardware write-blocker to an external forensic drive. None of the provided options reflects this sequence.

Answer

Perform a graceful shutdown via the operating system, then remove the SSD and image it using a hardware write-blocker.

Answer

Boot the workstation from a forensic live CD, then use 'dd' to image the SSD to an external USB drive.

Answer

Immediately shut down the workstation by unplugging the power cord, remove the SSD, and create a forensic image using a write-blocker on a forensic workstation.

Question 13

A forensic analyst is preparing to testify as an expert witness in court. Which of the following characteristics is MOST essential for the court to accept the analyst's testimony?

Accepted Answer

The analyst's methods are generally accepted in the forensic community. The court's acceptance of expert testimony hinges on the reliability and validity of the methods used, not the analyst's personal involvement or credentials. Under the Daubert standard (or Frye standard in some jurisdictions), the key factor is whether the forensic methods have been subjected to peer review, are generally accepted within the relevant scientific community, and have a known error rate. This ensures the testimony is based on sound scientific principles, not just the analyst's qualifications or role in the case.

Answer

The analyst has direct knowledge of the case

Answer

The analyst has a certification in computer forensics

Answer

The analyst is employed by the prosecution

Question 14

You are investigating a Windows 10 workstation that exhibits slow performance and frequent pop-ups. The user reports that the system started acting strangely after installing a 'PDF Converter' from an email attachment. You suspect malware. You have captured a memory dump using FTK Imager and a network capture during the infection. In the memory dump, you find a suspicious process 'conhost.exe' running from a non-standard location (C:\Users\Public\Temp). The process has an open handle to a file named 'config.ini' in the same directory. The network capture shows periodic HTTPS connections to 'malicious.com' on port 443 from the workstation's IP. Using Volatility, you extract the process's command line: 'conhost.exe -hidden -log C:\Users\Public\Temp\output.log'. Which of the following is the BEST immediate course of action to contain the threat and preserve evidence?

Accepted Answer

Isolate the workstation from the network, then create a forensic image of the hard disk for analysis.. The primary goal in a malware incident is to contain the threat and preserve evidence for forensic analysis. Isolating the workstation from the network prevents further data exfiltration (e.g., the HTTPS connections to malicious.com) and stops the malware from communicating with its C2 server. Creating a forensic image of the hard disk preserves the full state of the system, including the malicious conhost.exe, config.ini, and output.log files, which are critical for reverse engineering and attribution. Terminating the process or deleting files before imaging would destroy volatile evidence and potentially trigger anti-forensic mechanisms.

Answer

Delete the config.ini file and the conhost.exe executable immediately.

Answer

Restore the system to a previous restore point.

Answer

Terminate the suspicious conhost.exe process and run a full antivirus scan.

Question 15

During a cloud forensic investigation, you review AWS CloudTrail logs and find the following event: {"eventSource":"ec2.amazonaws.com","eventName":"RunInstances","userIdentity":{"arn":"arn:aws:iam::123456789012:user/attacker"},"requestParameters":{"instanceType":"t2.micro","imageId":"ami-0abcdef1234567890"},"responseElements":{"instancesSet":{"items":[{"instanceId":"i-0a1b2c3d4e5f67890"}]}}}. What is the immediate forensic action?

Accepted Answer

Isolate the instance and create a forensic snapshot. The log shows an unauthorized user launched an EC2 instance. The immediate action is to isolate the instance by stopping it or applying a security group to block traffic, preventing further malicious activity while preserving the instance for forensic analysis.

Answer

Delete the instance immediately

Answer

Check the VPC flow logs for network traffic

Answer

Notify the user who launched the instance

Question 16

A forensic analyst is examining a PST file extracted from a suspect's computer. The analyst wants to recover deleted emails that are no longer visible in the Outlook folder hierarchy. Which approach is most effective?

Accepted Answer

Open the PST in Outlook and check the 'Recoverable Items' folder. Deleted items in PST files may still reside in the 'Deleted Items' folder or be recoverable from the Recoverable Items folder (dumpster) before permanent deletion.

Answer

Perform file carving on the PST file using a forensic tool

Answer

Use a hex editor to manually reconstruct deleted emails

Answer

Use a PST viewer to read the file directly

Question 17

During a forensic investigation of a compromised web server, an analyst finds the following entry in the IIS access log: 192.168.1.5, -, 04/May/2024:14:23:11, GET /scripts/..%5c../windows/system32/cmd.exe, 200. What is the probable attack vector?

Accepted Answer

Path traversal. The log shows a path traversal attempt using URL-encoded backslashes (%5c) to navigate to cmd.exe. The 200 status indicates the request succeeded. This is a classic path traversal attack.

Answer

Brute force attack

Answer

Cross-site scripting

Answer

SQL injection

Question 18

During a cloud forensic investigation, an analyst discovers that an AWS EC2 instance was used to launch an attack. The instance has been terminated. Which source is MOST likely to contain evidence of the commands executed on the instance?

Accepted Answer

AWS Systems Manager Agent logs. AWS CloudTrail records API calls for EC2 instance management but not OS-level commands. VPC Flow Logs capture network traffic. EC2 instance metadata is about the instance configuration. AWS Systems Manager Agent (SSM Agent) can log commands executed via AWS Systems Manager, including Run Command, which can capture command history even after instance termination if logs were sent to CloudWatch.

Answer

VPC Flow Logs

Answer

EC2 instance metadata

Answer

AWS CloudTrail logs

Question 19

During dynamic analysis of a suspicious executable in Cuckoo Sandbox, the report shows that the process created a registry key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run named 'WindowsUpdate' and dropped a file 'svchost.exe' in %AppData%. Which conclusion is MOST consistent with these indicators?

Accepted Answer

The executable is attempting to establish persistence via a Run key and masquerading as a system process. The creation of a Run key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run is a classic persistence mechanism that causes the executable to launch automatically at user logon. Dropping a file named 'svchost.exe' in %AppData% is a common masquerading technique, as the legitimate svchost.exe (Service Host) resides in C:\Windows\System32, not in the user's AppData folder. Together, these actions indicate the executable is establishing persistence and disguising itself as a trusted system process.

Answer

The executable is cleaning up after itself by deleting temporary files

Answer

The executable is a dropper that installs a rootkit

Answer

The executable is a legitimate Windows update component

Question 20

A forensic investigator analyzing a RAID 5 array of three disks notices that one disk has failed. Can the investigator still reconstruct the data?

Accepted Answer

Yes, using the parity information from the remaining disks. RAID 5 uses distributed parity across all disks in the array. When one disk fails, the data can be reconstructed by XORing the data and parity from the remaining disks. Since the parity is spread across all disks (not a dedicated parity disk), the investigator can rebuild the missing data as long as the remaining disks are functional.

Answer

No, RAID 5 requires all disks to be present

Answer

Yes, but only if the failed disk is the parity disk

Answer

No, because RAID 5 does not support hot swapping