Computer Hacking Forensic Investigator CHFI (CHFI) — Questions 1–75

When a legal hold notice is issued, the first priority is to preserve all potentially relevant ESI by immediately suspending any automated data deletion policies (e.g., retention schedules, auto-archiving, or purge scripts). This prevents spoliation of evidence before any collection or analysis begins. Failure to do so could result in sanctions for destroying discoverable data.

The high volume of DNS queries to a malicious domain indicates possible C2 communication. Immediate actions: block the domain at the firewall/DNS, isolate affected hosts to prevent further spread, and conduct a forensic investigation to understand the infection. Checking antivirus is good but not immediate; logs for later analysis are secondary.

Run keys in the registry and scheduled tasks are standard persistence techniques. Prefetch and LNK files are forensic artifacts, not persistence mechanisms. USBSTOR tracks devices.

Option D is correct because it follows best practices for forensic acquisition: removing the hard drive and connecting it via a write blocker ensures that no data is altered during imaging. Using EWF (E01) format provides compression, metadata, and integrity checks (e.g., CRC32, MD5, SHA-1), which are essential for efficient analysis and evidence preservation. Storing the image locally on the forensic workstation avoids network latency and potential data corruption.

The binary added a service entry under HKLM\SYSTEM\CurrentControlSet\Services\MyService with 'ImagePath' pointing to malware.exe and 'Start' set to 2 (SERVICE_AUTO_START). This ensures the malware launches automatically at system boot, which is a classic persistence mechanism. The 'Start' value of 2 specifically configures the service to start automatically, making it persist across reboots.

In Volatility, pslist may show processes without a parent if the parent process has exited or the process list is corrupted. However, a more common forensic scenario is that the process is a kernel-mode rootkit hiding its parent.

NTFS and ext4 both use journaling. FAT32 does not; APFS uses a copy-on-write mechanism but is also journal-like; HFS+ has journaling but the question may expect ext4. However, NTFS and ext4 are clear examples.

Option A is correct because the RAID 5 array must be reconstructed using the same controller model (or an identical one) to correctly interpret the parity and striping metadata. Imaging the logical volume via a write-blocker preserves the integrity of the file system and ensures a forensically sound acquisition of the live data, which is the standard practice when the controller is available and the array is intact.

In iOS forensics, deleted SMS messages are stored in the SMS.db SQLite database located within the iTunes backup. This database contains the `message` table, which retains deleted messages until overwritten by new data, making it the primary target for recovering deleted iMessages and SMS texts.

Process Monitor (A) is correct because it is a real-time system monitoring tool that captures file system, registry, and process/thread activity, allowing analysts to observe changes made by a trojan during execution. It uses kernel-mode drivers to log operations such as CreateFile, RegSetValue, and CreateProcess, which are essential for dynamic analysis.

TRIM allows the SSD to erase data blocks that are no longer in use, making it difficult to recover deleted files because the data is physically erased by the SSD's garbage collection.

lsof -i shows network connections and listening sockets, including remote addresses. It can read /proc fd info.

The technique of modifying code at runtime to evade signature detection is known as packing or obfuscation. Packers compress or encrypt the original executable and wrap it with a small stub that decompresses or decrypts the code in memory during execution, thereby altering the static file signature. This runtime modification allows the malware to bypass signature-based antivirus and forensic tools that rely on static analysis of the binary on disk.

Analysis is a core phase in the forensic investigation process where collected data is examined to identify evidence, reconstruct events, and draw conclusions. This step involves techniques such as file carving, hash verification, and timeline analysis to uncover relevant artifacts from acquired images.

Option D is correct because the first responder's priority is to preserve volatile data, which is lost when the system is powered off. Volatile data includes running processes, network connections, and memory contents, which must be captured before any other action. This aligns with the order of volatility (RFC 3227) and standard forensic procedures.

log2timeline (option C) is a tool specifically designed for timeline analysis in digital forensics. It parses various log files and artifacts to create a super timeline, which is a comprehensive chronological record of system activity. This allows investigators to correlate events across multiple sources, such as file system timestamps, registry keys, and application logs.

Authenticity (B) is a core rule of evidence because the court must be assured that the digital evidence is exactly what it purports to be and has not been tampered with. This is typically established through cryptographic hash verification (e.g., SHA-256) and a documented chain of custody. Without authenticity, the evidence could be challenged as fabricated or altered, rendering it inadmissible.

The Run key under both HKCU and HKLM is a standard autorun location. The RunOnce key also starts programs but runs them once at next logon.

The call history on an iOS device is stored in a SQLite database named `call_history.db` (or `call_history.db` within the root domain of the user's backup). When an iTunes backup is created, this database is included in the backup manifest and can be extracted and queried to retrieve call logs, including timestamps, durations, and phone numbers. Option B is correct because it is the specific database that contains call history records.

Double-clicking files changes file access times and may modify data, which should be avoided to preserve evidence integrity.

log2timeline (part of Plaso) is designed for timeline analysis of log files, including auth.log. It parses and correlates timestamps.

PEiD (Portable Executable Identifier) is specifically designed to detect packers, cryptors, and compilers used in PE files by scanning for known signatures in the executable's entry point. It is the best static analysis tool for identifying the packer and can often unpack the executable using its built-in generic unpacker or by invoking the packer's own unpacking stub. This makes it ideal for the initial triage of packed malware samples.

macOS forensics frequently examines unified logs (for system events), .plist files (for configuration and application data), and FSEvents (for file system change history). bash_history is not the default for macOS (zsh is default). Prefetch files are Windows-only.

This cron job uses netcat (nc) with the -e option to execute a shell (/bin/sh) and connect back to IP 10.0.0.5 on port 4444, creating a reverse shell. It runs every 5 minutes.

These are approximate maximum volume sizes for each file system.

For ext4, deleted file recovery can be achieved by scanning the journal for recent file metadata, or by carving the raw disk for file signatures. The inode pointers are cleared upon deletion, but journal may contain recent records.

DKIM uses a digital signature to verify the email's domain. Validation failure strongly suggests the email was not sent by the legitimate domain, indicating spoofing.

netscan enumerates network connections (TCP and UDP) and listening sockets from the memory dump, including state, local/remote addresses, and owning process.

Option C is correct because cryptographic hash functions like MD5 or SHA-1 produce a fixed-size digest that is uniquely tied to the data content. By comparing the hash of the original drive (or its bit-for-bit copy) with the hash of the forensic image, any single bit change in the image will result in a completely different hash value, providing mathematically strong integrity verification. This is the standard method recommended in forensic best practices (e.g., NIST SP 800-86) and is far more reliable than any metadata or size comparison.

WinPmem is a memory acquisition tool for Windows, part of the Rekall project, used to dump physical memory.

A file that accepts and executes commands remotely is a webshell, often placed via file upload vulnerabilities to maintain access.

The commands download a shell script, make it executable, and run it. This is typical of a web shell download and execution, providing remote access to the attacker.

The registry key `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\SecureUpdate` is a standard Windows Run key, which automatically executes the specified program at user logon. By creating this key, the malware ensures it runs every time the user logs in, establishing persistence. This is a classic persistence mechanism, not an action related to encryption, file deletion, or network changes.

The USBSTOR key records serial numbers and first/last connection times for USB storage devices.

The binary log records all data-changing statements (including DDL and DML) and is not truncated like the general log. Since the incident occurred 3 hours ago and the general log only covers the last hour, the binary log files (binlog.000001–000005) are the only persistent record. Using mysqlbinlog to parse these files can recover the SELECT INTO OUTFILE statement from the relevant time period, even if the output file was deleted.

Event ID 7045 is logged when a new service is installed on a Windows system, providing details such as service name, binary path, and account.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce is a registry run key that executes programs once at user logon and then deletes the entry. Malware often uses this key to run a payload a single time, such as during initial infection or after a reboot, to establish persistence without leaving a continuous trace in the Run key.

The $MFT mirror is a backup copy of the first four records of the Master File Table. Each MFT record is 1024 bytes, so four records total 4096 bytes. The FTK Imager output confirms the cluster size is 4096 bytes, and since the $MFT mirror occupies exactly one cluster (cluster 2), its logical size is 4096 bytes.

Option D is correct because Google account artifacts synced to the cloud (e.g., contacts, calendar, app data via Google Drive backup) persist independently of the device's local storage. Even after a factory reset, these cloud-stored artifacts can be accessed by logging into the same Google account, providing a forensic trail of pre-reset data. This leverages Google's cloud synchronization services, which are not erased by a device reset.

Option B is correct because deleting Volume Shadow Copies using vssadmin.exe is a classic example of log wiping (anti-forensic technique). The primary purpose is to remove forensic evidence of file changes and prevent data recovery, as shadow copies contain previous versions of files that could be used to restore encrypted data or track the ransomware's activity.

Option C is correct because the order of volatility (OOV) dictates that the most volatile data (memory/registers) must be captured first, followed by network connections, then disk images, and finally backups. This sequence minimizes data loss and ensures evidence integrity for legal proceedings, as volatile data is lost when power is removed.

When the RAID controller is unavailable, the only reliable method to acquire the data is to image each physical disk individually using a forensic write blocker, then reconstruct the logical RAID 5 volume in a forensic software tool (e.g., FTK Imager, X-Ways Forensics, or EnCase). This preserves the original evidence on each disk and allows the examiner to rebuild the array by specifying the stripe size, parity rotation, and disk order, which is essential because RAID 5 distributes data and parity across all disks and can tolerate a single disk failure.

EmailTrackerPro is a commercial tool that parses email headers, extracts routing information, and helps detect spoofing by analyzing Received headers and X-Originating-IP.

DNS tunneling involves encoding data in DNS queries and responses. The one-way flow observation might be due to NetFlow's view, but the large responses suggest data being returned via DNS responses.

Physical acquisition via JTAG or chip-off provides the highest likelihood of recovering deleted SMS messages because it accesses the raw NAND flash memory at the hardware level, bypassing the iOS file system and logical abstractions. Deleted data on flash storage remains in unallocated blocks until overwritten, and physical imaging captures these remnants, including deleted SQLite records from the SMS database. In contrast, logical and file system methods only retrieve active files, missing the unallocated space where deleted messages reside.

A hardware write blocker physically intercepts the write commands from the forensic workstation to the suspect drive, ensuring that no data can be altered on the source drive during acquisition. This preserves the evidentiary integrity of the original media, which is a foundational requirement in digital forensics to maintain a chain of custody and admissibility in court.

The debugfs tool can be used to examine and recover files by inode on ext2/3/4 filesystems. The command `debugfs -R 'cat <12345>' /dev/sda1` would output the file contents.

The first responder should capture volatile data (RAM, network connections, running processes) before powering off. Using a write-blocker to image the hard drive is done after capturing volatile data.

Option B is correct because the outbound TCP connection to 198.51.100.10 on port 8080 is a direct network-based indicator of compromise (IoC) that threat intelligence teams can use to block or monitor malicious C2 traffic. This IP and port combination represents a specific command-and-control endpoint, making it highly actionable for network defense and threat hunting.

The query `SELECT COUNT(*) FROM v$transaction;` returns a count of 1, which indicates that exactly one transaction is currently active in the Oracle database. The `v$transaction` view shows only uncommitted or unrolled-back transactions; a committed transaction is removed from this view. Therefore, the output confirms that one transaction is active and has not yet been committed or rolled back.

Option C is correct because malware often creates registry keys (e.g., under `HKLM\Software\Microsoft\Windows\CurrentVersion\Run`) to achieve persistence, ensuring it executes automatically on system startup. Detecting such unauthorized registry modifications is a common indicator of compromise (IoC) in forensic investigations.

Email header analysis involves parsing headers, tracing IPs, and checking authentication.

Wireshark is the industry-standard tool for packet capture and analysis, providing deep inspection of hundreds of protocols.

Option C is correct because an established TCP connection (ESTABLISHED state) from the workstation to a remote IP on a high ephemeral port (49152) with PID 1234 strongly indicates active communication. This is a classic indicator of a beaconing C2 channel, as legitimate outbound connections typically use well-known ports or are short-lived. The netstat output shows PID 1234 has a persistent connection to 10.2.3.4:4444, which is a common port for malware command and control.

WinPmem and LiME are memory acquisition tools for Windows and Linux respectively.

B is correct because ddrescue is specifically designed to handle media with bad sectors by using a sophisticated read-retry algorithm that logs errors and attempts recovery from multiple angles, including reverse reads and splitting the drive into good and bad regions. Unlike dd, which will abort or produce corrupted output on encountering a bad sector, ddrescue maximizes data recovery while preserving a map of unrecoverable areas.

Option C is correct because the IAM policy's `Principal` is set to `"*"` (wildcard), which means any unauthenticated user or anonymous entity on the internet can perform the `s3:GetObject` action. This makes the S3 bucket publicly readable, exposing all objects stored in the bucket to anyone who knows the bucket name and object key. The `Effect` is `Allow` and there is no condition restricting access, so the policy grants open read access to the entire bucket.

Direct evidence directly proves a fact without requiring inference. A server log showing the suspect's IP address accessing a restricted file at the time of the incident is direct evidence because it directly links the suspect's system to the specific action (accessing the file) at the relevant time, without needing additional reasoning or assumptions. This is based on the principle that logs capture actual system events, making them direct proof of the occurrence of that event.

GrayKey is correct because it is a mobile forensic tool specifically designed to exploit the checkm8 bootrom vulnerability (a permanent, unpatchable exploit affecting A5 to A11 chips) to perform a physical extraction of iOS devices. This allows bypassing the device's passcode and extracting the full file system, including encrypted data, without needing to jailbreak the device.

The $MFT is a core NTFS system file that contains metadata for all files and directories on an NTFS volume.

In iOS forensics, the call history (incoming, outgoing, and missed calls) is stored in the SQLite database file named `call_history.db`. This database is located within the root domain of the iOS file system (typically under `/private/var/mobile/Library/CallHistoryDB/`) and contains tables such as `call` and `call_history` that record each call's direction, duration, timestamp, and associated contact identifier. The CHFI exam specifically tests this file as the authoritative source for call log evidence.

File slack is the unused space between the end of the file data and the end of the last cluster allocated to the file.

FSEvents is a macOS feature that logs file system events in a binary format, useful for tracking file creation, modification, and deletion.

netscan, connscan, and sockets are Volatility plugins used to enumerate network connections. pslist and pstree list processes.

RAID 5 distributes parity across disks. During rebuild, write operations occur that can overwrite deleted data or alter metadata, complicating acquisition.

A is correct because volatile data (e.g., RAM contents, running processes, network connections) is lost when power is removed. A first responder must capture this data using tools like `dd` or `memdump` before shutting down the system, as it may contain encryption keys, active malware, or evidence of ongoing network activity.

Factory reset wipes the /data partition, which includes /data/data/ (app data), AccountManager tokens, and system configuration files like wpa_supplicant.conf. However, external SD cards are typically not formatted during a factory reset because they are user-removable storage. Therefore, data stored on the external SD card (e.g., photos, videos, app backups) often survives intact and can provide valuable forensic evidence.

In cloud environments with shared storage, data from multiple tenants resides on the same physical or logical volume. When acquiring a forensic image, the investigator cannot isolate a single tenant's data without also capturing other tenants' data, leading to data commingling. This violates chain-of-custody and privacy principles, making it the primary challenge.

The UNION SELECT statement in the URI indicates a SQL injection attack. The attacker is trying to extract data from the database.

The pstree plugin displays processes in a tree format showing parent-child relationships. pslist lists processes but not parent PIDs.

When a system is still running and suspected of malware infection, the first priority is to capture volatile data, which includes the contents of RAM. WinPmem is a tool designed to acquire a memory dump from a live Windows system, preserving critical evidence such as running processes, network connections, and injected code that would be lost on shutdown. This follows the order of volatility (RFC 3227), which mandates collecting memory before any non-volatile data like logs, registry, or disk images.