CHFI Practice Questions

Question 1

An investigator acquires an SSD from a laptop that has been turned off for 24 hours. The suspect recently deleted several incriminating files. Using a forensic imager, the investigator creates a bit-for-bit copy. However, when analyzing the image, the deleted files' data appears to be zeros. What is the MOST likely cause?

Accepted Answer

The TRIM command was issued, causing the SSD to erase the freed blocks. The TRIM command is an ATA command that allows an operating system to inform an SSD which data blocks are no longer in use and can be wiped internally. When the suspect deleted the files, the OS likely issued a TRIM command to the SSD, causing the controller to erase the freed physical blocks. Since the laptop was off for 24 hours, the SSD had ample time to complete the garbage collection process, resulting in the deleted files' data appearing as zeros in the forensic image.

Answer

The files were stored in the paging file, which is volatile

Answer

The SSD controller performed wear leveling, moving data to unallocated blocks

Answer

The imaging tool incorrectly interpreted the data due to encryption

Question 2

An investigator needs to testify in court as an expert witness. Which of the following qualifications is MOST important for the court to accept their testimony?

Accepted Answer

They can demonstrate knowledge, skill, experience, training, or education that will assist the trier of fact.. Under the Federal Rules of Evidence (FRE) Rule 702, a witness qualified as an expert by knowledge, skill, experience, training, or education may testify if their specialized knowledge will assist the trier of fact. Option C directly mirrors this legal standard, making it the most critical qualification for admissibility. Certifications, publications, or years of service are supporting factors but not independently sufficient under the Daubert or Frye standards.

Answer

They have a certification in computer forensics.

Answer

They have published articles in peer-reviewed journals on digital forensics.

Answer

They have been employed as a forensic analyst for over 10 years.

Question 3

A forensic analyst is examining a RAID 5 array consisting of three disks. One disk has failed and has been replaced. The array is rebuilt automatically. However, the analyst needs to recover deleted files that existed before the rebuild. What is the MOST significant challenge in this scenario?

Accepted Answer

The rebuild process may overwrite data in slack space and previously unallocated clusters. When a RAID 5 array with a failed disk is rebuilt, the controller reconstructs data using parity information and writes it to the replacement disk. This rebuild process writes to all previously unallocated clusters and slack space across the array, potentially overwriting the very data the analyst hopes to recover. Deleted files that existed before the rebuild are at high risk of being overwritten during this automatic reconstruction, making recovery extremely difficult or impossible.

Answer

File carving techniques do not work on RAID volumes

Answer

The file system becomes corrupted after rebuild

Answer

The RAID controller encrypts data, preventing direct disk access

Question 4

A forensic investigator examines a hard drive and needs to recover deleted files. Which tool is specifically designed for file carving by scanning raw data for file headers and footers without relying on the file system?

Accepted Answer

Foremost. Foremost is a file carving tool that scans raw disk data for known file headers and footers (e.g., JPEG, PDF, ZIP) to recover files independently of the file system metadata. This makes it ideal when the file system is damaged or deleted, as it relies solely on content signatures rather than directory structures.

Answer

Volatility

Answer

Autopsy

Answer

FTK Imager

Question 5

A forensic analyst is examining an Android device that has been factory reset. Which type of data is LEAST likely to be recoverable using forensic tools?

Accepted Answer

Encrypted app data from /data/data/. After a factory reset, the /data partition is wiped and re-encrypted with a new key. Encrypted app data stored under /data/data/ is protected by file-based encryption (FBE) using a per-user encryption key that is discarded during the reset. Without the original encryption key, forensic tools cannot decrypt this data, making it the least likely to be recoverable.

Answer

Google account tokens stored in AccountManager

Answer

System logs in /data/log/

Answer

Deleted text messages from SQLite files

Question 6

Which type of evidence is a witness's statement that they saw someone log into a computer?

Accepted Answer

Direct evidence. Direct evidence is testimony or other proof that directly proves a fact without requiring any inference. A witness's statement that they saw someone log into a computer is direct evidence because it is based on the witness's firsthand observation of the act itself, not on any deduction or assumption. In digital forensics, direct evidence can include eyewitness accounts of specific actions on a system, such as entering credentials or accessing files.

Answer

Hearsay evidence

Answer

Best evidence

Answer

Circumstantial evidence

Question 7

Which TWO of the following are tools that can be used for timeline analysis in digital forensics?

Accepted Answer

log2timeline. log2timeline (option C) is a tool specifically designed for timeline analysis in digital forensics. It parses various log files and artifacts to create a super timeline, which is a comprehensive chronological record of system activity. This allows investigators to correlate events across multiple sources, such as file system timestamps, registry keys, and application logs.

Answer

Wireshark

Answer

Nmap

Answer

FTK Imager

Question 8

What is the primary goal of the chain of custody in a digital forensic investigation?

Accepted Answer

To maintain the integrity and admissibility of evidence. The chain of custody is a documented chronological record that tracks the seizure, custody, control, transfer, analysis, and disposition of digital evidence. Its primary goal is to maintain the integrity and admissibility of evidence by proving that the evidence has not been tampered with or altered from the moment it was collected until it is presented in court. This is critical because any break in the chain can lead to evidence being deemed inadmissible under rules like the Federal Rules of Evidence (FRE) or the Daubert standard.

Answer

To encrypt the evidence during transport

Answer

To speed up the forensic analysis process

Answer

To ensure that the forensic tools used are properly licensed

Question 9

A forensic analyst is preparing to testify as an expert witness in court. Which of the following characteristics is MOST essential for the court to accept the analyst's testimony?

Accepted Answer

The analyst's methods are generally accepted in the forensic community. The court's acceptance of expert testimony hinges on the reliability and validity of the methods used, not the analyst's personal involvement or credentials. Under the Daubert standard (or Frye standard in some jurisdictions), the key factor is whether the forensic methods have been subjected to peer review, are generally accepted within the relevant scientific community, and have a known error rate. This ensures the testimony is based on sound scientific principles, not just the analyst's qualifications or role in the case.

Answer

The analyst has direct knowledge of the case

Answer

The analyst has a certification in computer forensics

Answer

The analyst is employed by the prosecution

Question 10

You are investigating a Windows 10 workstation that exhibits slow performance and frequent pop-ups. The user reports that the system started acting strangely after installing a 'PDF Converter' from an email attachment. You suspect malware. You have captured a memory dump using FTK Imager and a network capture during the infection. In the memory dump, you find a suspicious process 'conhost.exe' running from a non-standard location (C:\Users\Public\Temp). The process has an open handle to a file named 'config.ini' in the same directory. The network capture shows periodic HTTPS connections to 'malicious.com' on port 443 from the workstation's IP. Using Volatility, you extract the process's command line: 'conhost.exe -hidden -log C:\Users\Public\Temp\output.log'. Which of the following is the BEST immediate course of action to contain the threat and preserve evidence?

Accepted Answer

Isolate the workstation from the network, then create a forensic image of the hard disk for analysis.. The primary goal in a malware incident is to contain the threat and preserve evidence for forensic analysis. Isolating the workstation from the network prevents further data exfiltration (e.g., the HTTPS connections to malicious.com) and stops the malware from communicating with its C2 server. Creating a forensic image of the hard disk preserves the full state of the system, including the malicious conhost.exe, config.ini, and output.log files, which are critical for reverse engineering and attribution. Terminating the process or deleting files before imaging would destroy volatile evidence and potentially trigger anti-forensic mechanisms.

Answer

Delete the config.ini file and the conhost.exe executable immediately.

Answer

Restore the system to a previous restore point.

Answer

Terminate the suspicious conhost.exe process and run a full antivirus scan.

Question 11

An analyst examines the following Apache access log entry: 192.168.1.10 - - [10/Jan/2023:13:45:22 +0000] "GET /search.php?q=1%27%20UNION%20SELECT%201,2,3-- HTTP/1.1" 200 1234 "-" "Mozilla/5.0". Which attack is MOST likely indicated?

Accepted Answer

SQL Injection. The log shows a UNION SELECT statement in the query parameter, indicating a SQL injection attempt. The URL-encoded single quote (') and comment (--) are classic SQLi payloads.

Answer

Path Traversal

Answer

Cross-Site Scripting (XSS)

Answer

Remote File Inclusion

Question 12

A forensic analyst reviews a Windows system for signs of malware persistence. Which TWO registry locations are commonly used to achieve persistence via auto-start programs?

Accepted Answer

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and HKCU\Software\Microsoft\Windows\CurrentVersion\Run are standard auto-start locations for all users and current user respectively. RunOnce keys execute once and are also used. But the most common are Run keys.

Answer

HKLM\SAM\SAM\Domains\Account\Users

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist

Answer

HKLM\SYSTEM\CurrentControlSet\Services

Question 13

During dynamic analysis of a suspicious executable in Cuckoo Sandbox, the report shows that the process created a registry key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run named 'WindowsUpdate' and dropped a file 'svchost.exe' in %AppData%. Which conclusion is MOST consistent with these indicators?

Accepted Answer

The executable is attempting to establish persistence via a Run key and masquerading as a system process. The creation of a Run key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run is a classic persistence mechanism that causes the executable to launch automatically at user logon. Dropping a file named 'svchost.exe' in %AppData% is a common masquerading technique, as the legitimate svchost.exe (Service Host) resides in C:\Windows\System32, not in the user's AppData folder. Together, these actions indicate the executable is establishing persistence and disguising itself as a trusted system process.

Answer

The executable is cleaning up after itself by deleting temporary files

Answer

The executable is a dropper that installs a rootkit

Answer

The executable is a legitimate Windows update component

Question 14

A forensic analyst is preparing to acquire an image from a suspect's hard drive. The analyst connects the drive to a write blocker, then uses FTK Imager to create a forensic image. Which hashing algorithm is commonly used by FTK Imager to verify image integrity?

Accepted Answer

MD5. FTK Imager uses MD5 (Message Digest 5) as its default hashing algorithm to verify the integrity of forensic images. MD5 produces a 128-bit hash value that uniquely represents the data, allowing the analyst to confirm that the acquired image is an exact bit-for-bit copy of the original drive. While SHA-1 is also supported, MD5 is the algorithm most commonly associated with FTK Imager's verification process.

Answer

AES

Answer

RSA

Answer

Blowfish

Question 15

During a mobile forensic investigation, an examiner wants to recover deleted WhatsApp messages from an Android device. Which of the following artefacts should the examiner examine? (Select TWO.)

Accepted Answer

/data/media/0/Android/data/com.whatsapp/. WhatsApp stores media files (images, videos, voice notes) in the external app-specific directory `/data/media/0/Android/data/com.whatsapp/`. Even after a message is deleted from the chat, the media file may remain in this directory if it was not explicitly removed, allowing recovery. Option C is correct because the primary SQLite database `msgstore.db` in `/data/data/com.whatsapp/databases/` contains the chat messages, including deleted entries that are often only marked as deleted but not physically removed until a vacuum operation.

Answer

/data/data/com.android.providers.telephony/databases/mmssms.db

Answer

/data/data/com.whatsapp/files/Avatars/

Answer

/data/data/com.google.android.gms/databases/

Computer Hacking Forensic Investigator CHFI practice test

Three ways to study

Study CHFI by domain

Study CHFI by topic

Computer Forensics Investigation Process practice questions

Computer Forensics Fundamentals and Process practice questions

Storage Forensics and File System Analysis practice questions

Incident Response and First Responder Skills practice questions

Computer Forensics Lab practice questions

Evidence Acquisition and Duplication practice questions

OS and Network Forensics practice questions

OS and File System Forensics practice questions

Application, Email and Cloud Forensics practice questions

Mobile and Malware Forensics practice questions

Network and Cloud Forensics practice questions

Database and Application Forensics practice questions

Top CHFI questions

Computer Hacking Forensic Investigator CHFI practice questions

How to use these CHFI questions

Quick answer