or an event handler like onerror=...; the log entry instead contains SQL keywords (UNION, SELECT) and a double-dash comment token. XSS executes in a victim's browser and affects the user session, whereas the observed parameter value is designed to manipulate the database query itself. The presence of SQL syntax in the id parameter, not markup or JavaScript, rules out XSS."}},{"@type":"Answer","text":"Path traversal","comment":{"@type":"Comment","text":"Path traversal attacks manipulate file path references using traversal sequences such as ../../etc/passwd or encoded variants (%2e%2e%2f) to make the application read or include files outside its intended directory. The captured log shows no dot-dot-slash constructs and no file system path; instead, it contains SQL tokens like UNION and SELECT inside the id parameter. These tokens alter database query logic rather than directory resolution, so the artifact is inconsistent with path traversal."}},{"@type":"Answer","text":"Remote file inclusion (RFI)","comment":{"@type":"Comment","text":"Remote file inclusion occurs when an application dynamically includes a file from a URL, commonly seen as parameter values like http://attacker.com/shell.txt or data:// payloads in PHP applications. The log entry's id parameter contains a SQL query fragment, not a URL or file path, meaning the attacker is not trying to load an external resource into server-side code. RFI would leave artifacts of HTTP requests to external hosts or include statements in logs, neither of which appears here."}}]},{"@context":"https://schema.org","@type":"Quiz","name":"You are a forensic investigator responding to a suspected data breach at a financial institution. The incident response team has isolated a Windows 10 workstation used by a former employee. The system","url":"https://courseiva.com/questions/ec-council/ec-chfi/you-are-a-forensic-investigator-responding-to-a-suspected-da-tn9ka","acceptedAnswer":{"@type":"Answer","text":"Capture volatile data using a trusted tool on a USB drive, then shut down normally and remove the hard drive for imaging","comment":{"@type":"Comment","text":"This is the correct order because volatile data (RAM, running processes, network connections, open files) is lost the instant the system loses power. Using a trusted, write-protected USB tool to capture this data first ensures the most transient evidence is preserved. A graceful shutdown, unlike a hard power-off, allows the OS to flush and close file structures cleanly, reducing the risk of filesystem corruption, and then removing the drive for a forensic imaging workstation yields a defensible disk image without altering the original."}},"suggestedAnswer":[{"@type":"Answer","text":"Use the built-in Windows backup to create a system image to an external drive","comment":{"@type":"Comment","text":"The built-in Windows Backup (e.g., 'Backup and Restore' or 'File History') is a backup utility, not a forensic acquisition tool. It does not create a bit-for-bit copy of the disk; instead, it copies files and system images using Windows' own file system APIs, which can alter access timestamps and fail to capture deleted data, slack space, and unallocated clusters. Running it also writes to the system drive and changes the state of the evidence before any forensic preservation, making it inherently unsound for legal proceedings."}},{"@type":"Answer","text":"Boot the system from a forensic live CD and create a forensic image of the hard drive while the system is running","comment":{"@type":"Comment","text":"Booting from a forensic live CD is a common approach for dead acquisition, but doing it *while the system is running* or as a response to a live system is problematic. The boot process itself overwrites RAM (destroying volatile data) and writes temporary files to the disk, changing timestamps and potentially overwriting evidence in unallocated space. Furthermore, if the system is compromised, the live CD may not have a trusted kernel or may be subject to rootkit interference, and imaging a mounted or in-use filesystem can result in an inconsistent, non-forensic image."}},{"@type":"Answer","text":"Immediately pull the power cord to perform a cold acquisition of the hard drive","comment":{"@type":"Comment","text":"While a hard power-off (cold acquisition) is sometimes used to preserve disk state when the system is already off or when malware might destroy evidence, it is not the initial step in a live response. Pulling the power cord instantly terminates all running processes and destroys volatile memory, losing critical evidence such as encryption keys, network connections, and active malware in RAM. It also risks filesystem journaling inconsistencies and may trigger write-caching data loss, potentially leaving the disk in an unclean state that complicates analysis and damages the integrity of the acquired image."}}]},{"@context":"https://schema.org","@type":"Quiz","name":"During a forensic investigation of a Google Cloud Platform (GCP) environment, an analyst reviews Audit Logs and sees a log entry with the method 'storage.objects.list' and a principal email 'attacker@","url":"https://courseiva.com/questions/ec-council/ec-chfi/during-a-forensic-investigation-of-a-google-cloud-platform-go5i0","acceptedAnswer":{"@type":"Answer","text":"An external identity was granted IAM permissions on the bucket, possibly through a misconfigured resource.","comment":{"@type":"Comment","text":"The presence of an external email address in the principal field of the Cloud Audit Log entry indicates that an IAM policy binding grants permissions to an identity outside the organization. This often happens when a bucket has been made public or when a resource-level IAM policy accidentally includes an external user or allUsers/allAuthenticatedUsers. The analyst should examine the bucket's IAM policy using `gcloud iam policies get` or the Cloud Console to identify the exact binding."}},"suggestedAnswer":[{"@type":"Answer","text":"The analyst must immediately shut down the bucket.","comment":{"@type":"Comment","text":"Shutting down the bucket is an incident response action, not a forensic conclusion. The log indicates a potential IAM misconfiguration, but the analyst should first preserve evidence, assess the scope, and determine whether the bucket is actually publicly accessible or if the external identity is authorized. Premature shutdown could destroy ephemeral data and disrupt services without confirming the threat."}},{"@type":"Answer","text":"The attacker spoofed the principal email in the log.","comment":{"@type":"Comment","text":"Cloud Audit Logs in GCP are generated by the authentication layer; the principal email is derived from the authenticated identity token. GCP's Security Command Center and Cloud Audit Logs rely on cryptographically signed credentials, so an attacker cannot simply forge the principal field. A spoofed email would require compromising the identity provider or the service account key, which is a different attack vector than IAM misconfiguration."}},{"@type":"Answer","text":"The log entry is a false positive due to a logging error.","comment":{"@type":"Comment","text":"Cloud Audit Logs are designed to be highly reliable and tamper-evident, with logs streamed to Cloud Storage or BigQuery for retention. A false positive due to a logging error is unlikely because the log entry is generated upon an actual API call that was authenticated and authorized under the given identity. Logging errors typically manifest as missing entries, not fabricated ones with coherent principal and resource fields."}}]},{"@context":"https://schema.org","@type":"Quiz","name":"A security analyst notices repeated entries in an IIS log: 10.0.0.2, -, 05/Feb/2023:08:12:34 +0000, GET /../../windows/system32/config/sam, 404, 0, 532. Which TWO of the following attack types are ind","url":"https://courseiva.com/questions/ec-council/ec-chfi/a-security-analyst-notices-repeated-entries-in-an-iis-log-1-757io","acceptedAnswer":{"@type":"Answer","text":"Directory traversal","comment":{"@type":"Comment","text":"The repeated '../' sequences, often encoded as '%2e%2e%5c' or '%2e%2e/', are classic indicators of directory traversal in IIS logs. An attacker sends these sequences to escape the web root and access sensitive files outside it, such as Windows system files or configuration stores. The log entries show a deliberate attempt to navigate the server's directory hierarchy, which is the defining characteristic of a directory traversal attack."}},"suggestedAnswer":[{"@type":"Answer","text":"SQL injection","comment":{"@type":"Comment","text":"The log entries contain no SQL keywords, operators, or quoted strings that would indicate an injection into database queries. Directory traversal attempts use path manipulation such as '../' or encoded backslashes to navigate the filesystem, not to alter SQL logic. SQL injection typically appears in query string parameters like 'id=1 OR 1=1', while these requests target file paths directly."}},{"@type":"Answer","text":"Denial of service","comment":{"@type":"Comment","text":"A denial of service attack requires overwhelming the server with a high volume of requests to exhaust resources or cause a crash. The log shows only repeated traversal attempts, not a flood of traffic, and these requests are small, low-bandwidth HTTP GETs. DoS would manifest as thousands of requests per second or patterns like SYN floods, not a few path traversal probes."}},{"@type":"Answer","text":"Cross-site scripting","comment":{"@type":"Comment","text":"Cross-site scripting involves injecting executable client-side scripts into web pages that are then rendered to other users, typically via user input reflected or stored in HTML. The IIS log entries show direct file path manipulation with no '
You are a forensic investigator responding to a security incident at a medium-sized company. The incident involved an attacker gaining unauthorized access to a Windows Server 2019 system. The server was taken offline by the IT team immediately after detection. Your task is to acquire forensic evidence from the server's hard drive. The server has a single 500 GB NTFS partition. You have a forensic workstation with a write blocker, a SATA-to-USB adapter, and a forensic imaging tool that supports both dd and EWF (E01) formats. The server is still physically in the server room, and the IT team has powered it off. You need to create a forensic image that preserves the integrity of the evidence and allows for efficient analysis. Which of the following is the most appropriate course of action?
A.Boot the server using a forensic live CD, connect an external USB drive to the server, and use 'dd' to create a raw image on the external drive.
B.Use the server's built-in backup utility to create a system state backup and copy it to a network share.
C.Remove the hard drive, connect it via a write blocker to the forensic workstation, and then use 'dd' over a network connection to send the image to a remote server.
D.Remove the hard drive, connect it via a write blocker to the forensic workstation, and create an EWF (E01) image stored locally on the forensic workstation's internal drive.
AnswerD
This method uses a write blocker to preserve integrity, and EWF format provides compression and metadata for efficient analysis.
Why this answer
It follows best practices for forensic acquisition: removing the hard drive and connecting it via a write blocker ensures that no data is altered during imaging. Using EWF (E01) format provides compression, metadata, and integrity checks (e.g., CRC32, MD5, SHA-1), which are essential for efficient analysis and evidence preservation. Storing the image locally on the forensic workstation avoids network latency and potential data corruption.
Exam trap
EC-Council often tests the misconception that using a forensic live CD is sufficient for write protection, but without a hardware write blocker, the OS may still write to the drive (e.g., via journaling or mount operations), compromising evidence integrity.
How to eliminate wrong answers
Option A is wrong because booting the server with a forensic live CD and using dd to an external USB drive risks modifying the system's volatile data and does not guarantee write-blocking at the hardware level; the live CD's kernel may still write to the internal drive. Option B is wrong because a system state backup is not a forensic image; it captures only system files and registry, not the entire partition, and it modifies the original drive during the backup process. Option C is wrong because using dd over a network connection introduces potential data integrity issues due to network latency, packet loss, or interception, and it is less efficient than local storage; the image should be stored on a trusted forensic workstation drive.
A malware analyst is performing dynamic analysis of a trojan. Which THREE of the following tools are commonly used to monitor system changes during execution?
Select 3 answers
A.Process Monitor
B.Ghidra
C.PEiD
D.Regshot
E.Process Explorer
AnswersA, D, E
Captures registry, file system, and process activity in real time.
Why this answer
Process Monitor (A) is correct because it is a real-time system monitoring tool that captures file system, registry, and process/thread activity, allowing analysts to observe changes made by a trojan during execution. It uses kernel-mode drivers to log operations such as CreateFile, RegSetValue, and CreateProcess, which are essential for dynamic analysis.
Exam trap
EC-Council often tests the distinction between static and dynamic analysis tools, so the trap here is that candidates confuse tools like Ghidra or PEiD (static) with runtime monitoring tools like Process Monitor or Regshot (dynamic).
A security analyst arrives at a suspected computer crime scene. The computer is on and a user is logged in. The analyst needs to preserve volatile data. According to first responder duties, what should the analyst do FIRST?
A.Immediately unplug the power cord to prevent data alteration
B.Create a forensic image of the hard drive using a write blocker
C.Photograph the scene and document everything
D.Capture volatile data such as running processes and network connections
AnswerD
Volatile data must be captured before powering off because it is lost when the system loses power.
Why this answer
The first responder's priority is to preserve volatile data, which is lost when the system is powered off. Volatile data includes running processes, network connections, and memory contents, which must be captured before any other action. This aligns with the order of volatility (RFC 3227) and standard forensic procedures.
Exam trap
The CHFI exam often tests the misconception that preserving the hard drive (Option A or B) is the top priority, but the trap is that volatile data is more fragile and must be captured first to avoid losing critical evidence like active network connections or malware in memory.
How to eliminate wrong answers
Option A is wrong because immediately unplugging the power cord destroys volatile data in RAM and active network connections, violating the order of volatility. Option B is wrong because creating a forensic image of the hard drive is a non-volatile data acquisition step that should occur after volatile data capture, and using a write blocker is irrelevant for volatile data. Option C is wrong because while photographing and documenting the scene is important, it is not the first action; volatile data must be captured immediately before it is lost.
Which TWO of the following are tools that can be used for timeline analysis in digital forensics?
Select 2 answers
A.Wireshark
B.Nmap
C.log2timeline
D.FTK Imager
E.Plaso
AnswersC, E
log2timeline is a tool for extracting timeline data from various sources.
Why this answer
log2timeline (option C) is a tool specifically designed for timeline analysis in digital forensics. It parses various log files and artifacts to create a super timeline, which is a comprehensive chronological record of system activity. This allows investigators to correlate events across multiple sources, such as file system timestamps, registry keys, and application logs.
Exam trap
EC-Council often tests the distinction between tools used for network analysis (Wireshark, Nmap) versus tools used for host-based timeline analysis (log2timeline, Plaso), leading candidates to confuse packet capture utilities with forensic timeline generators.
During a forensic investigation of a compromised Linux server, an analyst checks /var/log/auth.log and finds multiple entries like "Failed password for root from 10.0.0.5 port 22 ssh2". Which tool is BEST suited to analyze the timeline of these events?
A.Nmap
B.Wireshark
C.log2timeline
D.Autopsy
AnswerC
log2timeline is the standard tool for creating super timelines from log files.
Why this answer
C is correct because log2timeline (part of the Plaso framework) is specifically designed to parse multiple log sources, including /var/log/auth.log, and create a super timeline that correlates events by timestamp. This allows the analyst to reconstruct the exact sequence of failed SSH login attempts from 10.0.0.5, which is essential for timeline analysis in forensic investigations.
Exam trap
The EC-Council CHFI exam often tests the distinction between network analysis tools (Nmap, Wireshark) and forensic timeline tools (log2timeline), trapping candidates who confuse packet-level analysis with log-based event correlation.
How to eliminate wrong answers
Option A is wrong because Nmap is a network scanning tool used to discover hosts and services, not to analyze log file timestamps or event timelines. Option B is wrong because Wireshark is a packet capture and analysis tool that inspects live or recorded network traffic, not static log files like /var/log/auth.log. Option D is wrong because Autopsy is a digital forensics platform for disk image analysis and file system forensics, but it lacks native capability to parse and correlate syslog/auth.log entries into a unified timeline without additional plugins or manual import.
A forensic analyst is examining a malware sample that uses packing to obfuscate its code. Which static analysis tool is BEST suited to identify the packer used and potentially unpack the executable?
A.PEiD
B.Cuckoo Sandbox
C.Ghidra
D.IDA Pro
AnswerA
PEiD uses signatures to detect packers, cryptors, and compilers. It can also assist in unpacking by identifying the entry point.
Why this answer
PEiD (Portable Executable Identifier) is specifically designed to detect packers, cryptors, and compilers used in PE files by scanning for known signatures in the executable's entry point. It is the best static analysis tool for identifying the packer and can often unpack the executable using its built-in generic unpacker or by invoking the packer's own unpacking stub. This makes it ideal for the initial triage of packed malware samples.
Exam trap
EC-Council often tests the distinction between static and dynamic analysis tools, and the trap here is that candidates may confuse a dynamic analysis sandbox (Cuckoo) or a general-purpose disassembler (Ghidra, IDA Pro) with a specialized static packer identifier like PEiD.
How to eliminate wrong answers
Option B is wrong because Cuckoo Sandbox is a dynamic analysis tool that executes the malware in a controlled environment to observe behavior, not a static analysis tool for identifying packers. Option C is wrong because Ghidra is a reverse engineering framework focused on disassembly and decompilation, but it lacks a dedicated packer signature database and automated unpacking capabilities like PEiD. Option D is wrong because IDA Pro is a powerful interactive disassembler and debugger, but it does not have a built-in packer identification database; while plugins can add this functionality, it is not the best-suited tool out of the box for this specific task.
During a mobile forensic investigation of an iPhone, an examiner needs to recover deleted SMS messages. Which acquisition method provides the highest likelihood of retrieving deleted data from the device's flash memory?
A.Manual acquisition by taking screenshots
B.File system acquisition via iOS file system extraction
C.Physical acquisition via JTAG or chip-off
D.Logical acquisition via iTunes backup
AnswerC
Physical acquisition via JTAG (Joint Test Action Group) or chip-off directly images the device's raw NAND flash memory, providing a complete bit-for-bit copy of all storage—including allocated, unallocated, and deleted areas. This level of extraction bypasses the operating system's file abstraction layers and allows forensic tools to reconstruct files, including deleted messages, from raw data remnants. JTAG requires hardware-level connections to the device's test ports, while chip-off involves desoldering the memory chip, both yielding the most comprehensive evidence.
Why this answer
Physical acquisition via JTAG or chip-off provides the highest likelihood of recovering deleted SMS messages because it accesses the raw NAND flash memory at the hardware level, bypassing the iOS file system and logical abstractions. Deleted data on flash storage remains in unallocated blocks until overwritten, and physical imaging captures these remnants, including deleted SQLite records from the SMS database. In contrast, logical and file system methods only retrieve active files, missing the unallocated space where deleted messages reside.
Exam trap
EC-Council often tests the misconception that file system acquisition (Option B) can recover deleted data because it extracts the entire file system, but in iOS, the file system extraction does not include unallocated space due to the HFSX/APFS design and sandboxing, making physical acquisition the only method that accesses raw NAND for deleted SMS recovery.
How to eliminate wrong answers
Option A is wrong because manual acquisition via screenshots only captures visible, on-screen content and cannot access deleted data stored in unallocated flash memory. Option B is wrong because file system acquisition via iOS file system extraction retrieves only active files and metadata, not the raw NAND blocks containing deleted SMS records that have been marked as free but not yet overwritten. Option D is wrong because logical acquisition via iTunes backup only extracts files that are part of the backup manifest, which excludes deleted data that has been removed from the SQLite WAL or journal files and is not present in the backup snapshot.
During dynamic analysis of a malware sample in a sandbox, an analyst observes the following behaviours: (1) A file is created at C:\Windows\System32\drivers\etc\hosts, (2) A registry key is set at HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UpdateSvc, (3) Outbound TCP connections to 198.51.100.10 on port 8080. Which THREE of the following IoCs are MOST relevant to share with the threat intelligence team?
The outbound TCP connection to 198.51.100.10 on port 8080 is a direct network-based indicator of compromise (IoC) that threat intelligence teams can use to block or monitor malicious C2 traffic. This IP and port combination represents a specific command-and-control endpoint, making it highly actionable for network defense and threat hunting.
Exam trap
EC-Council often tests the distinction between observed behaviors (file creation, registry modification, network connections) and derived IoCs (hashes, mutexes), tricking candidates into selecting all listed options rather than only those directly tied to the observed actions.
During a forensic investigation, you find a prefetch file created at 03:15:22 UTC on the system. The corresponding executable's last modified timestamp is 02:30:00 UTC, and the system date/time shows a discrepancy of +5 minutes. What is the MOST accurate interpretation regarding the file execution time?
A.The program was executed at 02:30:00 UTC.
B.The program was executed at 03:15:22 UTC.
C.Execution time cannot be determined from prefetch files alone.
D.The program was executed at 03:10:22 UTC after adjusting for clock skew.
AnswerD
The prefetch file was created at system time 03:15:22, but the system clock is +5 minutes fast, so the actual UTC time is 03:10:22. This option correctly adjusts for clock skew and is the most accurate interpretation.
Why this answer
The prefetch file creation timestamp records the system time at execution. The system clock is +5 minutes ahead, so actual UTC at execution is 03:10:22 (03:15:22 minus 5 minutes). Option D correctly adjusts for this clock skew.
Option B is wrong because it ignores the clock discrepancy, which is a known issue in forensic analysis.
Exam trap
The CHFI exam often tests the misconception that the executable's last modified timestamp or the prefetch file's internal 'last run time' is the primary indicator of execution time, when in fact the prefetch file's creation timestamp is the key for first execution.
How to eliminate wrong answers
Option A is wrong because the executable's last modified timestamp indicates when the file was last changed on disk, not when it was executed; execution time is derived from the prefetch file's creation timestamp, not the executable's metadata. Option C is wrong because prefetch files do provide a reliable indicator of first execution time via their creation timestamp, though subsequent executions update the 'last run time' within the file. Option D is wrong because adjusting for clock skew would require subtracting the +5-minute discrepancy from the prefetch timestamp (03:15:22 - 0:05 = 03:10:22) only if the prefetch timestamp were in true UTC, but the prefetch timestamp is recorded in system local time (which already includes the +5-minute offset), so no adjustment is needed; the system's reported UTC is already skewed.
Refer to the exhibit. A first responder runs the netstat command on a compromised Windows workstation. Which of the following conclusions is BEST supported by the output?
A.The connection to 192.168.1.1:80 is suspicious because it is in TIME_WAIT state.
B.The UDP listener on port 5353 indicates a malware infection.
C.A process with PID 1234 is likely communicating with a remote C2 server at 10.2.3.4.
D.The workstation is running multiple virtual machines based on the local addresses.
AnswerC
PID 1234 holding two established TCP connections to the same remote IP address 10.2.3.4 on different ephemeral source ports is a notable pattern. Established connections indicate active communication, and multiple simultaneous connections to a single remote host—especially if that host is not a known internal server—can represent command-and-control (C2) beaconing or data exfiltration, particularly when the process is unfamiliar or unauthorized. This observation warrants further investigation into the process, its binary, and the remote address's reputation.
Why this answer
An established TCP connection (ESTABLISHED state) from the workstation to a remote IP on a high ephemeral port (49152) with PID 1234 strongly indicates active communication. This is a classic indicator of a beaconing C2 channel, as legitimate outbound connections typically use well-known ports or are short-lived. The netstat output shows PID 1234 has a persistent connection to 10.2.3.4:4444, which is a common port for malware command and control.
Exam trap
EC-Council often tests the misconception that TIME_WAIT or UDP listeners are inherently malicious, when in fact they are normal TCP/IP behaviors; the trap here is to recognize that ESTABLISHED connections to unusual ports with a specific PID are the strongest indicator of active C2 communication.
How to eliminate wrong answers
Option A is wrong because TIME_WAIT state is normal for TCP connections that have been closed; it is not inherently suspicious and is expected after a client finishes an HTTP request to 192.168.1.1:80. Option B is wrong because UDP port 5353 is used by mDNS (RFC 6762) for local network service discovery, a legitimate Windows service, and is not a reliable indicator of malware. Option D is wrong because local addresses like 127.0.0.1 and 0.0.0.0 are loopback and wildcard addresses, not evidence of virtual machines; virtual machines typically have distinct IP addresses on separate virtual network adapters.
An analyst notices that a file on an NTFS volume occupies 4096 bytes on disk but its actual data is only 100 bytes. The extra space contains remnants of a previously deleted file. What is this extra space called?
A.Volume slack
B.Free space
C.RAM slack
D.File slack
AnswerD
File slack is the unused area within the last allocated cluster of a file, spanning from the bytes beyond the logical end of the file to the physical end of that cluster, and it is composed of both RAM slack and the remaining sector space. On NTFS, these bytes are not zeroed when a file is written, so they may contain residual data from previously deleted files or older versions of the current file, making them a valuable forensic source. This exactly matches the analyst's observation of a file occupying 40 clusters where some space is unused, because that space remains attributed to the file's allocated cluster rather than to free or volume slack.
Why this answer
File slack is the unused space between the end of the actual file data and the end of the last allocated cluster for that file. On an NTFS volume with a 4096-byte cluster size, a 100-byte file leaves 3996 bytes of slack space, which may contain remnants of previously deleted files. This is why option D is correct.
Exam trap
The trap here is that candidates confuse file slack with volume slack or free space, not realizing that file slack is specifically the unused portion within a file's allocated cluster(s) that can still hold residual data from prior file writes.
How to eliminate wrong answers
Option A is wrong because volume slack refers to the unused space at the end of a volume (partition) after the last cluster, not within a file's allocated clusters. Option B is wrong because free space is unallocated disk space not assigned to any file, whereas the extra space described is allocated to the file but unused. Option C is wrong because RAM slack is the space between the end of the file data and the end of the sector (typically 512 bytes), not the full cluster slack; RAM slack is a subset of file slack that exists only in the last sector of a file.
During a forensic examination of a Windows system, the investigator finds a file named 'notes.txt' that contains a list of passwords. The file's last modified timestamp is before the incident date, but its last accessed timestamp is during the incident. Which type of evidence is this file considered?
A.Circumstantial evidence
B.Best evidence
C.Hearsay evidence
D.Direct evidence
AnswerA
Circumstantial evidence: The access timestamp is circumstantial because it only supports an inference that the file was opened or read, without directly proving who performed the action or under what circumstances. Other processes—such as antivirus scans, Windows Search indexing, or backup software—can update the Last Access Time without any user actually opening the file. Thus, the timestamp alone requires additional corroboration to establish a fact, making it inherently indirect and therefore circumstantial evidence.
Why this answer
The file 'notes.txt' has a last modified timestamp before the incident but a last accessed timestamp during the incident. This indicates the file was opened or read during the incident, but not modified. Such indirect evidence suggests the attacker may have viewed the passwords, but does not directly prove the act of using them.
Therefore, it is circumstantial evidence because it requires inference to connect the file access to the incident.
Exam trap
EC-Council often tests the distinction between direct and circumstantial evidence by presenting timestamp data that shows access without modification, leading candidates to mistakenly classify it as direct evidence because they assume 'accessed during incident' equals 'used in the incident'.
How to eliminate wrong answers
Option B (Best evidence) is wrong because best evidence refers to the original or primary source of evidence (e.g., the original file on disk), not the type of inference drawn from timestamps. Option C (Hearsay evidence) is wrong because hearsay applies to out-of-court statements offered for their truth, not to file system metadata like timestamps. Option D (Direct evidence) is wrong because direct evidence would prove a fact without inference (e.g., a video of the attacker typing the passwords), whereas the timestamp only shows access, not the action of using the passwords.
You are responding to a suspected malware infection on a Windows 10 system. The system is still running. Which of the following should you collect FIRST?
A.Acquire a memory dump using a tool like WinPmem.
B.Collect the Windows Event Logs.
C.Export the contents of the Windows Registry.
D.Create a forensic image of the hard drive.
AnswerA
RAM is the most volatile component in a Windows system and must be captured before any other action, because it holds currently running processes, active network sockets, loaded kernel modules, injected code, and plaintext encryption keys. Using WinPmem (or similar tools) creates a raw memory image that can be analyzed for malware artifacts that exist only in volatile memory, such as reflective DLLs or rootkits. Any subsequent step in the incident response workflow will alter memory contents, so the order of volatility dictates that memory acquisition comes first.
Why this answer
When a system is still running and suspected of malware infection, the first priority is to capture volatile data, which includes the contents of RAM. WinPmem is a tool designed to acquire a memory dump from a live Windows system, preserving critical evidence such as running processes, network connections, and injected code that would be lost on shutdown. This follows the order of volatility (RFC 3227), which mandates collecting memory before any non-volatile data like logs, registry, or disk images.
Exam trap
EC-Council often tests the order of volatility (OOV) principle, and the trap here is that candidates mistakenly prioritize persistent data (logs, registry, disk image) over volatile memory, thinking they are more stable or easier to collect first.
How to eliminate wrong answers
Option B is wrong because Windows Event Logs are stored on disk and are non-volatile; collecting them first would risk losing volatile memory evidence if the system crashes or is shut down. Option C is wrong because the Windows Registry is also stored on disk (in hive files like SAM, SYSTEM, SOFTWARE) and is non-volatile; exporting it before memory acquisition violates the order of volatility. Option D is wrong because creating a forensic image of the hard drive is a time-intensive process that captures only non-volatile data, and performing it first would allow volatile evidence (e.g., running malware processes, network connections) to be lost.
An analyst discovers a hidden partition on a hard drive that does not appear in the standard MBR partition table. The drive uses GPT partitioning. Which area of the disk should be examined to find evidence of a hidden partition?
A.The Master Boot Record (MBR) in sector 0
B.The GPT header and partition entry array located after the protective MBR
C.The Volume Boot Record (VBR) of the C: drive
D.The Host Protected Area (HPA) at the end of the disk
AnswerB
The GPT header and partition entry array located after the protective MBR are exactly where partition definitions live on a GUID Partition Table disk. The primary GPT header is at Logical Block Address 1 (right after the protective MBR in sector 0), and the partition entry array follows it; the header contains the partition table checksum and pointers to the entries, while the entries themselves (with unique GUIDs, start/end LBAs, and attributes) define each partition. A hidden partition may be deliberately omitted from the active partition table, but a forensic analyst scanning the entire disk for GPT-like structures—such as the header signature 'EFI PART' and backup headers at the end—can locate an alternate or stale partition entry array that reveals the hidden partition's existence and location.
Why this answer
In GPT partitioning, the protective MBR in sector 0 only contains a single partition entry of type 0xEE to prevent legacy tools from misinterpreting the disk. The actual partition information, including any hidden partitions, is stored in the GPT header (typically in sector 1) and the partition entry array that follows. Therefore, examining the GPT header and partition entry array is necessary to detect partitions not visible in the MBR.
Exam trap
EC-CHFI often tests the misconception that the MBR is the primary source of partition information on GPT disks, leading candidates to incorrectly choose Option A, when in fact the protective MBR is only a compatibility placeholder and the real partition data resides in the GPT structures.
How to eliminate wrong answers
Option A is wrong because the MBR in sector 0 on a GPT disk is a protective MBR that does not list actual partitions; it only contains a single entry of type 0xEE covering the entire disk, so hidden partitions cannot be found there. Option C is wrong because the Volume Boot Record (VBR) of the C: drive is a boot sector specific to a volume's file system (e.g., NTFS) and does not contain the disk's partition table; it is irrelevant for discovering hidden partitions. Option D is wrong because the Host Protected Area (HPA) is a reserved area at the end of the disk used by manufacturers for diagnostic tools, not a location where hidden GPT partitions are stored; GPT hidden partitions are defined within the GPT partition entry array.
During an email forensics investigation, an analyst examines headers and sees `Received: from mail.evil.com (192.168.1.100) by mail.victim.com` followed by `DKIM-Signature: v=1; a=rsa-sha256; d=evil.com; s=selector; bh=...; h=...; b=...`. The email claims to be from support@paypal.com. Which finding is the strongest indicator of spoofing?
A.The email was received via SMTP
B.The email lacks a SPF record in the header
C.The email originated from IP 192.168.1.100
D.The DKIM signature domain is evil.com, not paypal.com
AnswerD
A valid DKIM signature verified under the domain 'evil.com' while the From header claims 'paypal.com' is a definitive spoofing indicator. The 'd=' tag in the DKIM signature identifies which domain's private key signed the message, and Paypal's private key is cryptographically inaccessible to an attacker. Under DMARC alignment, the signing domain must match the From domain (or be an organizational parent), so this mismatch proves the message was not authorized by Paypal and is a direct sign of forgery, much stronger than SMTP or SPF observations.
Why this answer
The DKIM signature domain (d=evil.com) does not match the claimed sender domain (paypal.com). DKIM uses a digital signature verified against the public key published in the DNS of the signing domain. Since the signature is from evil.com, the email cannot be authenticated as originating from paypal.com, making this the strongest indicator of spoofing.
Exam trap
EC-Council CHFI often tests the distinction between authentication mechanisms (SPF, DKIM, DMARC) and the specific meaning of DKIM's 'd=' tag, trapping candidates who think any missing authentication header or a private IP alone is the strongest spoofing indicator.
How to eliminate wrong answers
Option A is wrong because SMTP is the standard protocol for email transmission and does not itself indicate spoofing; almost all emails are received via SMTP. Option B is wrong because the absence of an SPF record in the header does not directly prove spoofing—SPF may not be published or checked, and the header shown does not include an SPF result. Option C is wrong because the IP 192.168.1.100 is a private RFC 1918 address, which is non-routable on the public internet; its presence in a Received header often indicates internal relay or header manipulation, but it is not as definitive as the DKIM domain mismatch.
A forensic investigator is required to testify in court about the findings of a digital investigation. Which of the following roles does the investigator fulfill?
A.Expert witness
B.Lay witness
C.Character witness
D.Fact witness
AnswerA
An expert witness is permitted to offer opinion testimony under Federal Rule of Evidence 702 if their scientific, technical, or other specialized knowledge will help the trier of fact understand the evidence. A forensic investigator testifying about digital evidence analysis qualifies because they apply accepted forensic methodologies like write-blocking, hashing, and timeline analysis to form conclusions. The court recognizes the investigator's expertise and allows them to opine on the significance of the evidence, making this the correct classification.
Why this answer
A is correct because a forensic investigator who testifies about their analysis and conclusions—such as interpreting file system artifacts, registry data, or network logs—qualifies as an expert witness under Federal Rule of Evidence 702. The investigator’s testimony goes beyond mere fact recitation; it applies specialized knowledge, training, and experience to form opinions about the digital evidence, which is the hallmark of an expert witness.
Exam trap
The trap here is that candidates confuse 'fact witness' with 'expert witness,' assuming that any testimony about digital evidence is factual, but the key distinction is whether the testimony involves opinion or interpretation based on specialized knowledge—if it does, the investigator is an expert witness.
How to eliminate wrong answers
Option B is wrong because a lay witness can only testify to facts within their personal knowledge (e.g., 'I saw the suspect at the computer'), not to technical interpretations or conclusions derived from forensic analysis. Option C is wrong because a character witness testifies about a person’s reputation or moral traits, not about digital evidence or investigative findings. Option D is wrong because a fact witness (also called a percipient witness) merely recounts what they directly observed or experienced, without offering expert opinions or technical analysis of forensic data.
Which FOUR of the following are persistence mechanisms that can be used on Linux systems?
Select 4 answers
A.Prefetch files
B.SSH authorized keys
C.Startup scripts in /etc/init.d
D.Cron jobs
E.Modifications to /etc/passwd to add new users
AnswersB, C, D, E
SSH authorized keys are a persistence mechanism because they enable an attacker to retain remote access without needing to re-exploit the system each time; by placing a public key in a user's ~/.ssh/authorized_keys file, the attacker can authenticate over SSH indefinitely, even if the user's password is changed. While they do not autonomously execute commands like cron or init scripts, the ongoing availability of a credentialed login channel is a recognized persistence technique in intrusion activity and should be examined in a forensic investigation.
Why this answer
Persistence mechanisms on Linux include SSH authorized keys (B), which allow an attacker to maintain remote access by adding their public key to the target user's authorized_keys file; startup scripts in /etc/init.d (C), which execute at boot; cron jobs (D), which run scheduled tasks; and modifications to /etc/passwd (E) to create persistent user accounts. Prefetch files (A) are Windows-specific and not a Linux persistence mechanism.
Exam trap
The trap is selecting Prefetch files (A), which are often associated with persistence on Windows but do not apply to Linux. All other options are valid Linux persistence mechanisms.
A forensic examiner recovers a Windows 10 system and finds a prefetch file for powershell.exe with a last run time of 3 days ago, but the system's security logs show no interactive logons from that user. What does this discrepancy suggest?
A.PowerShell was executed as part of a scheduled task or service
B.The prefetch file is corrupted
C.The user deleted their profile
D.The system clock was changed
AnswerA
PowerShell launched via a scheduled task or service executes under logon type 4 (batch) or 5 (service), not interactive logon type 2. Consequently, the Security log will not contain a corresponding 4624 interactive logon event, even though prefetch records the powershell.exe execution with a valid last run time. This exactly matches the observed discrepancy, making non-interactive execution the correct forensic explanation.
Why this answer
A is correct because PowerShell.exe can be executed by non-interactive processes such as scheduled tasks or services, which do not generate interactive logon events (Event ID 4624) in the Security log. The prefetch file records the last run time regardless of the execution context, so a discrepancy between the prefetch timestamp and the absence of interactive logons indicates that PowerShell was launched by a system-level or automated mechanism, not by a user logging on interactively.
Exam trap
EC-Council often tests the misconception that prefetch files only record user-initiated executions, leading candidates to assume the timestamp must be wrong or that the user must have logged on, when in fact prefetch captures all executions including those from system services and scheduled tasks.
How to eliminate wrong answers
Option B is wrong because prefetch files are not typically corrupted in a way that would produce a plausible last run time without any corresponding logon activity; corruption would more likely result in unreadable timestamps or missing entries. Option C is wrong because deleting a user profile does not remove prefetch entries or alter the last run time recorded for an executable; the prefetch file would still reflect the last execution before deletion. Option D is wrong because changing the system clock would affect all timestamps uniformly, including both the prefetch file and security logs, so it would not create a discrepancy between the two; the discrepancy would only occur if the clock change was applied between the execution and the log generation, which is not a typical forensic scenario.
During a forensic investigation of a hard disk, the investigator finds that the partition table is missing. The disk was previously partitioned using GPT. Which area of the disk should be examined to recover the GPT partition table?
A.Last sector of the disk
B.Volume boot record
C.Master Boot Record (LBA 0)
D.LBA 1 (sector 1)
AnswerD
The primary GPT header is stored at LBA 1 (sector 1), immediately following the protective MBR at LBA 0. This header contains the disk GUID, the location of the partition entry array (typically LBA 2–33), entry counts, CRC32 integrity checks, and pointers to the backup GPT at the last sector. Because the GPT layout specifically starts here, LBA 1 is the correct answer.
Why this answer
In GPT (GUID Partition Table) disks, the primary partition table is stored in LBA 1 (sector 1), immediately following the protective MBR at LBA 0. When the partition table is missing, examining LBA 1 allows recovery of the GPT header, which contains pointers to the partition entry array. This is the correct location because GPT uses LBA 1 for its header, not the last sector or the MBR.
Exam trap
The CHFI exam often tests the misconception that the GPT partition table is stored in the MBR (LBA 0) or the last sector, but the primary GPT header is specifically at LBA 1, while the backup is at the last sector.
How to eliminate wrong answers
Option A is wrong because the last sector of the disk stores the secondary (backup) GPT header, not the primary partition table; while it can be used for recovery, the question asks for the area to examine to recover the primary GPT partition table, which is not the last sector. Option B is wrong because the Volume Boot Record (VBR) is located within a partition (e.g., at the start of a volume) and contains boot code and BPB for that volume, not the GPT partition table. Option C is wrong because LBA 0 (Master Boot Record) in a GPT disk contains only a protective MBR (to prevent legacy tools from misidentifying the disk as unpartitioned) and does not store the GPT partition table itself.
You are a forensic investigator responding to a data breach at a financial institution. The compromised server is a Windows Server 2019 running a custom trading application. The server is still powered on and connected to the production network. The incident response team has instructed you to acquire forensic evidence while minimizing downtime. The server has 2 TB of storage with 500 GB used. You have a forensic workstation with a write-blocker and an empty 2 TB external drive. The server's RAM is 64 GB. You need to acquire both volatile data (RAM) and a forensic image of the disk. However, the legal team requires a verified bit-for-bit copy with cryptographic hash verification. Additionally, the server's performance is critical; acquiring RAM via network is not feasible due to bandwidth constraints. Which of the following is the best course of action?
A.Shut down the server, remove the disk, connect it to a write-blocker, and acquire the disk image using FTK Imager; RAM is lost but disk acquisition is verified.
B.Use FTK Imager over the network to acquire RAM first, then use dd to image the disk to the external drive via write-blocker.
C.Run win32dd locally to capture RAM to the external drive, then use FTK Imager over the network to create a physical disk image with verification.
D.Use dd over netcat to acquire RAM and disk simultaneously, then compute hashes separately.
AnswerC
This is the correct order of volatility. Running win32dd locally captures RAM quickly to an external device, minimizing the time that volatile data is at risk, and it preserves a raw memory image for later analysis. After that, FTK Imager can acquire a physical disk image over the network and automatically generate hash values (e.g., MD5/SHA1) to verify the integrity of the image at acquisition time. This combines fast volatile capture with network-acquired disk imaging that includes built-in verification.
Why this answer
It prioritizes capturing volatile RAM first using win32dd (a memory acquisition tool) locally to the external drive, which preserves the most volatile evidence before any shutdown or network transfer. After RAM capture, FTK Imager over the network creates a verified physical disk image, satisfying the legal requirement for cryptographic hash verification while minimizing downtime. This approach avoids the risk of losing RAM data (as in shutdown) and avoids bandwidth constraints (as in network RAM acquisition).
Exam trap
EC-Council often tests the misconception that network-based RAM acquisition is always feasible or that shutting down the server is acceptable, but the trap here is that candidates overlook the bandwidth constraint and the critical need to preserve volatile data before disk imaging.
How to eliminate wrong answers
Option A is wrong because shutting down the server destroys volatile data (RAM), which is critical for investigating the breach, and the legal team requires a verified bit-for-bit copy, but RAM is lost entirely. Option B is wrong because acquiring RAM over the network is explicitly stated as not feasible due to bandwidth constraints, and using dd to image the disk to the external drive via write-blocker is not described correctly (dd is a Linux tool, not native to Windows Server 2019, and FTK Imager over the network for RAM would be slow and unreliable). Option D is wrong because using dd over netcat for RAM acquisition is not a standard Windows memory acquisition method, and simultaneous acquisition of RAM and disk is impractical without proper write-blocking and verification; netcat does not provide cryptographic hash verification natively.
An analyst finds the following string in an IIS log: %3Cscript%3Ealert('XSS')%3C/script%3E. What does this indicate?
A.A cross-site scripting (XSS) attempt
B.A SQL injection attempt
C.A buffer overflow attempt
D.A path traversal attempt
AnswerA
The string 3cscri is a signature of an XSS attempt because 3c is the hexadecimal encoding of the ASCII character '<', and 'scri' is the beginning of the word 'script'. When decoded, this represents the start of an HTML/JavaScript payload such as <script>, which would execute in a victim's browser. IIS logs often capture URL-encoded or hex-encoded characters, so this observed fragment strongly indicates cross-site scripting rather than any other web attack.
Why this answer
The string is URL-encoded HTML/JavaScript (<script>alert('XSS')</script>). It is a typical cross-site scripting payload attempting to execute in a browser.
During a forensic investigation of a compromised web server, an analyst examines the Apache access log and finds the following entry: '192.168.1.10 - - [12/Oct/2024:13:45:22 +0000] "GET /index.php?id=1 UNION SELECT username, password FROM users-- HTTP/1.1" 200 1234 "-" "Mozilla/5.0"'. What type of attack is MOST likely indicated?
A.Cross-site scripting (XSS)
B.SQL injection (SQLi)
C.Path traversal
D.Remote file inclusion (RFI)
AnswerB
The GET request to the id parameter with ' UNION SELECT username,password FROM users -- is a textbook UNION-based SQL injection payload. The single quote closes the original SQL string, UNION SELECT appends attacker-controlled columns to the result set, and the '--' comment sequence comments out the remainder of the original WHERE clause so the query executes exactly as the attacker intends. This causes the application's database to return records (e.g., credentials) that should never be exposed, making SQL injection the correct classification.
Why this answer
The log entry shows a UNION-based SQL injection attempt, where the attacker appends 'UNION SELECT username, password FROM users--' to the 'id' parameter in the GET request. This manipulates the original SQL query to return sensitive data from the 'users' table, which is the hallmark of SQL injection (SQLi). The HTTP 200 response indicates the query executed successfully, confirming the attack vector.
Exam trap
The trap here is that candidates may confuse the 'UNION SELECT' syntax with a path traversal or RFI attack because they see a URL parameter with special characters, but the key indicator is the SQL-specific command structure, not file paths or remote URLs.
How to eliminate wrong answers
Option A is wrong because cross-site scripting (XSS) involves injecting client-side scripts (e.g., JavaScript) into web pages viewed by other users, not manipulating SQL queries via URL parameters; the log shows no script tags or event handlers. Option C is wrong because path traversal attacks use '../' sequences to access files outside the web root (e.g., /etc/passwd), not SQL syntax like 'UNION SELECT'. Option D is wrong because remote file inclusion (RFI) involves including a remote file (e.g., via 'http://evil.com/shell.txt') in a server-side include or function, not injecting SQL commands into a database query.
You are a forensic investigator responding to a suspected data breach at a financial institution. The incident response team has isolated a Windows 10 workstation used by a former employee. The system is still powered on, and the login screen is displayed. Your task is to acquire forensic evidence in a defensible manner. The following actions are available:
A. Immediately pull the power cord to perform a cold acquisition of the hard drive.
B. Capture volatile data (RAM, network connections, running processes) using a trusted tool on a USB drive, then shut down normally and remove the hard drive for imaging.
C. Boot the system from a forensic live CD and create a forensic image of the hard drive while the system is running.
D. Use the built-in Windows backup to create a system image to an external drive.
Which action is the most appropriate first step in this scenario?
A.Use the built-in Windows backup to create a system image to an external drive
B.Capture volatile data using a trusted tool on a USB drive, then shut down normally and remove the hard drive for imaging
C.Boot the system from a forensic live CD and create a forensic image of the hard drive while the system is running
D.Immediately pull the power cord to perform a cold acquisition of the hard drive
AnswerB
This is the correct order because volatile data (RAM, running processes, network connections, open files) is lost the instant the system loses power. Using a trusted, write-protected USB tool to capture this data first ensures the most transient evidence is preserved. A graceful shutdown, unlike a hard power-off, allows the OS to flush and close file structures cleanly, reducing the risk of filesystem corruption, and then removing the drive for a forensic imaging workstation yields a defensible disk image without altering the original.
Why this answer
The system is still powered on with the login screen displayed, meaning volatile data (RAM, network connections, running processes) is present and will be lost if the system is powered off. Capturing this data first using a trusted forensic tool (e.g., FTK Imager or DumpIt) from a write-blocked USB drive preserves critical evidence such as encryption keys, active network connections, and malware in memory. Only after volatile data is secured should the system be shut down normally and the hard drive removed for forensic imaging, ensuring a defensible chain of custody.
Exam trap
EC-Council often tests the misconception that pulling the power cord is the safest method to preserve disk evidence, but the trap here is that it destroys volatile data and can cause filesystem corruption, making it inappropriate when the system is still powered on and volatile data is present.
How to eliminate wrong answers
Option A is wrong because using the built-in Windows backup to create a system image modifies the system (e.g., writes backup metadata, changes registry timestamps) and does not capture volatile data, violating forensic integrity principles. Option C is wrong because booting from a forensic live CD while the system is running can overwrite portions of RAM and disk (e.g., pagefile, unallocated space) and may trigger anti-forensic mechanisms, plus it does not capture the current volatile state before the system is altered. Option D is wrong because immediately pulling the power cord (cold acquisition) destroys all volatile data (RAM, network connections, running processes) that may contain critical evidence like encryption keys or active malware, and can cause filesystem corruption if the disk was in a write state.
During a forensic investigation of a Google Cloud Platform (GCP) environment, an analyst reviews Audit Logs and sees a log entry with the method 'storage.objects.list' and a principal email 'attacker@gmail.com'. However, the identity is not from the organization's domain. What should the analyst conclude?
A.The analyst must immediately shut down the bucket.
B.The attacker spoofed the principal email in the log.
C.An external identity was granted IAM permissions on the bucket, possibly through a misconfigured resource.
D.The log entry is a false positive due to a logging error.
AnswerC
The presence of an external email address in the principal field of the Cloud Audit Log entry indicates that an IAM policy binding grants permissions to an identity outside the organization. This often happens when a bucket has been made public or when a resource-level IAM policy accidentally includes an external user or allUsers/allAuthenticatedUsers. The analyst should examine the bucket's IAM policy using `gcloud iam policies get` or the Cloud Console to identify the exact binding.
Why this answer
In GCP, Audit Logs record the actual identity used to authenticate the API call. The presence of 'attacker@gmail.com' as the principal email indicates that an external Google account (not part of the organization's domain) was granted IAM permissions on the bucket, likely through a misconfigured resource policy (e.g., a bucket-level IAM policy that allows allUsers or a specific external user). This is a common cloud security misconfiguration where overly permissive IAM bindings are applied.
Exam trap
EC-Council often tests the misconception that Audit Logs can be spoofed or that external identities cannot appear in logs unless there is a logging error, but the correct understanding is that GCP Audit Logs faithfully record the authenticated identity, and an external email indicates a real IAM permission grant.
How to eliminate wrong answers
Option A is wrong because immediately shutting down the bucket is a reactive, non-forensic action that could destroy evidence; the analyst should first verify the scope of the misconfiguration and preserve logs. Option B is wrong because GCP Audit Logs are generated by the Cloud Audit Logs service and the principal email is extracted from the authenticated identity token (OAuth 2.0 or JWT) — spoofing the principal email would require compromising the authentication mechanism, which is not feasible for an external attacker. Option D is wrong because Audit Logs are tamper-proof and generated by the GCP infrastructure; a logging error that introduces a specific external email is extremely unlikely and would be a systemic issue, not a one-off false positive.
A security analyst notices repeated entries in an IIS log: 10.0.0.2, -, 05/Feb/2023:08:12:34 +0000, GET /../../windows/system32/config/sam, 404, 0, 532. Which TWO of the following attack types are indicated by this log entry?
Select 2 answers
A.SQL injection
B.Directory traversal
C.Privilege escalation attempt
D.Denial of service
E.Cross-site scripting
AnswersB, C
The repeated '../' sequences, often encoded as '%2e%2e%5c' or '%2e%2e/', are classic indicators of directory traversal in IIS logs. An attacker sends these sequences to escape the web root and access sensitive files outside it, such as Windows system files or configuration stores. The log entries show a deliberate attempt to navigate the server's directory hierarchy, which is the defining characteristic of a directory traversal attack.
Why this answer
The use of '../' indicates path traversal, and the target file (SAM) is a common target for privilege escalation.
During a forensic investigation, an analyst uses a hardware write blocker to connect a suspect hard drive to a forensic workstation. Which of the following is the PRIMARY reason for using a write blocker?
A.To allow the suspect drive to be mounted as read-write for analysis
B.To decrypt the drive automatically without the key
C.To prevent any modification to the suspect drive during acquisition
D.To speed up the imaging process by caching writes
AnswerC
The primary purpose is to ensure the drive is not altered during forensic acquisition.
Why this answer
The primary reason for using a hardware write blocker is to ensure that the suspect drive is connected in a read-only manner, preventing any write operations from the forensic workstation from reaching the drive. This preserves the integrity of the evidence by guaranteeing that no data is altered, added, or deleted during the acquisition process, which is a fundamental requirement for admissibility in legal proceedings.
Exam trap
EC-Council often tests the misconception that write blockers are used to speed up imaging or that they provide some form of decryption, when in fact their sole purpose is write prevention for evidence integrity.
How to eliminate wrong answers
Option A is wrong because a write blocker forces the drive to be read-only, not read-write; mounting as read-write would risk modifying evidence. Option B is wrong because write blockers do not perform decryption; they only block write commands at the hardware level and have no capability to decrypt drives without the key. Option D is wrong because write blockers do not cache writes or speed up imaging; in fact, they add a slight overhead by intercepting and blocking write commands, and caching writes would contradict the goal of preventing modification.
During a forensic investigation, an examiner finds a log entry: 'User JohnDoe accessed file contract.pdf at 10:32:45 AM'. This log is considered which type of evidence?
A.Circumstantial evidence
B.Hearsay
C.Direct evidence
D.Best evidence
AnswerC
Direct evidence directly proves a fact; the log entry directly shows the user accessed the file.
Why this answer
The log entry directly states that User JohnDoe accessed contract.pdf at a specific time, which is a firsthand account of the event without requiring inference. In digital forensics, direct evidence is evidence that, if believed, proves a fact without any additional reasoning or presumption. This log is a direct record of the user's action, making it direct evidence.
Exam trap
EC-Council often tests the distinction between direct and circumstantial evidence by presenting a log entry that seems to imply an action (e.g., 'User logged in at 10:30, file accessed at 10:32'), which would be circumstantial, but here the log explicitly states the user accessed the file, making it direct—candidates often confuse 'log' with 'circumstantial' because logs are sometimes used to build a circumstantial case.
How to eliminate wrong answers
Option A is wrong because circumstantial evidence requires an inference to connect it to a conclusion (e.g., a fingerprint on a keyboard suggests access, but doesn't prove it), whereas this log explicitly states the access event. Option B is wrong because hearsay is an out-of-court statement offered to prove the truth of the matter asserted, but logs are considered business records or computer-generated records that are generally admissible as an exception to hearsay under FRE 803(6) or similar rules, not hearsay themselves. Option D is wrong because the best evidence rule applies to the original writing, recording, or photograph to prove its content, but this question is about the classification of the log as a type of evidence (direct vs. circumstantial), not about the admissibility of a copy versus an original.
An investigator recovers a suspicious file from a compromised system. Using PEiD, the file is detected as 'UPX 0.89.6 - 1.02 / 1.05 - 1.24'. What is the MOST appropriate next step in the analysis?
A.Delete the file as it is likely a false positive from a legitimate UPX-packed application.
B.Unpack the file using the UPX tool or manual unpacking to obtain the original executable.
C.Submit the packed file to VirusTotal to obtain a hash-based detection report.
D.Run the file in a sandbox without unpacking to observe dynamic behavior.
AnswerB
Unpacking is the correct next step because UPX is a reversible packer: the `upx -d` command can usually reconstruct the original executable, exposing the real code, import table, and resources for static analysis. Even if the UPX header is intentionally malformed or modified to resist automatic unpacking, a manual unpacking approach—using memory dumps, Scylla or ImpRec for import reconstruction—can recover the original logic. Analyzing the unpacked binary allows the investigator to identify malicious behavior without executing it, which is critical for understanding the threat and preserving integrity. This approach directly addresses the core investigative need to analyze the true payload, not just the packing stub.
Why this answer
The PEiD detection of 'UPX 0.89.6 - 1.02 / 1.05 - 1.24' confirms the file is packed with UPX (Ultimate Packer for eXecutables). Packing obfuscates the original code and often evades static analysis. The most appropriate next step is to unpack the file using the UPX tool (with the -d switch) or manual unpacking to recover the original executable for deeper static and dynamic analysis.
Exam trap
EC-Council often tests the misconception that a packer detection alone indicates a false positive or that dynamic analysis without unpacking is sufficient, when in fact unpacking is the foundational step to reveal the true executable for both static and dynamic analysis.
How to eliminate wrong answers
Option A is wrong because deleting the file based solely on a UPX packer detection is premature; UPX is commonly used by malware to compress and obfuscate code, and a legitimate application does not preclude malicious intent. Option C is wrong because submitting the packed file to VirusTotal may yield a hash that differs from the unpacked malware, potentially missing detection signatures that rely on the unpacked code. Option D is wrong because running the packed file in a sandbox without unpacking may cause the unpacking stub to execute and then the malware to run, but the packed state prevents proper static analysis and may not trigger all dynamic behaviors if the unpacking fails or is environment-aware.
You are a forensic investigator responding to a data breach at a mid-sized company. The company uses a hybrid cloud environment with AWS for production workloads and on-premises servers for legacy applications. The breach was detected when an internal monitoring system flagged unusual outbound traffic from an AWS EC2 instance (i-0a1b2c3d4e5f) to an external IP address (198.51.100.20) on TCP port 4444 during off-hours. The EC2 instance runs a Linux-based web server. The security team has already isolated the instance by removing its security group rules and stopping the instance. You have been provided with the following: (1) AWS CloudTrail logs for the past 72 hours, (2) VPC Flow Logs for the same period, (3) a snapshot of the instance’s root volume (EBS), and (4) the instance metadata log from the AWS console. The company’s incident response policy requires preservation of all volatile data before powering off the instance. Which of the following steps should you take FIRST to ensure a forensically sound investigation?
A.Acquire a memory dump from the stopped instance by re-attaching the root volume to a forensic workstation.
B.Review the instance metadata log to identify the user who launched the instance.
C.Create a forensic copy of the EBS snapshot and attach it to a separate analysis EC2 instance in a different AWS account to avoid altering evidence.
D.Analyze the VPC Flow Logs to determine if other instances communicated with the same external IP.
AnswerC
Creating a forensic copy of the EBS snapshot and attaching that copy to a separate EC2 instance in a different AWS account is the correct first preservation step because the snapshot is the only durable disk evidence of the compromised instance. Attaching the original snapshot to an analysis instance—even read-only—risks unwitting writes from filesystem journal replay, and operating in the same account risks accidental modification or deletion. A copied snapshot in an isolated account grants a clean, authority-controlled workspace where forensic tools cannot alter the original evidence.
Why this answer
The first step in a forensically sound investigation is to create a forensic copy (bit-for-bit) of the EBS snapshot before any analysis. This preserves the original evidence integrity, as required by the order of volatility and chain of custody. Attaching the copy to a separate analysis EC2 instance in a different AWS account prevents accidental modification of the original snapshot and isolates the forensic environment from the compromised production account.
Exam trap
The trap here is that candidates confuse volatile data preservation with the need to acquire memory from a stopped instance (Option A), not realizing that stopping the instance already destroys RAM, and the snapshot only captures disk data.
How to eliminate wrong answers
Option A is wrong because the instance is already stopped, so volatile data (memory) is lost; re-attaching the root volume to a forensic workstation would not recover memory, and the snapshot is of the root volume, not RAM. Option B is wrong because reviewing the instance metadata log to identify the user who launched the instance is a non-forensic administrative step that does not preserve or acquire evidence; it should be done after securing the evidence. Option D is wrong because analyzing VPC Flow Logs is a valid investigative step, but it is not the first priority; the immediate need is to preserve the EBS snapshot evidence before any analysis that might alter or overlook the original data.
A forensic investigator is documenting evidence for a case. What is the PRIMARY purpose of maintaining an unbroken chain of custody for digital evidence?
A.To track the storage location of the evidence.
B.To prove that the evidence has not been altered or tampered with.
C.To speed up the investigation process.
D.To assign responsibility for the evidence to a single individual.
AnswerB
Chain of custody establishes that evidence is authentic and unchanged.
Why this answer
The primary purpose of maintaining an unbroken chain of custody is to establish the integrity and authenticity of digital evidence by documenting every person who handled it, every transfer, and every access event. This documentation allows the court to verify that the evidence has not been altered, tampered with, or corrupted from the moment of seizure through analysis and presentation. Without a provable chain of custody, the evidence may be deemed inadmissible under rules like Federal Rule of Evidence 901 or similar standards in other jurisdictions.
Exam trap
EC-Council often tests the distinction between the operational benefit (tracking location) and the legal purpose (proving integrity), so candidates mistakenly choose Option A because they focus on the logistical aspect rather than the evidentiary admissibility requirement.
How to eliminate wrong answers
Option A is wrong because tracking the storage location is only a secondary benefit of chain-of-custody documentation, not its primary legal purpose; the core goal is to prove integrity, not merely to log physical or logical locations. Option C is wrong because maintaining a rigorous chain of custody often slows down the investigation process due to required documentation, logging, and verification steps; it is designed for legal admissibility, not speed. Option D is wrong because chain of custody does not assign responsibility to a single individual; it documents every individual who handled the evidence, ensuring multiple points of accountability and preventing a single point of failure or bias.
An investigator is analyzing email headers and notices the following: The 'Received' headers show a path through multiple servers, the 'DKIM-Signature' domain matches the sender domain, and 'X-Originating-IP' is present. Which TWO pieces of information are MOST useful to trace the original sender's IP address? (Choose two.)
Select 2 answers
A.The 'Message-ID' header
B.The 'From' header email address
C.The DKIM-Signature's 'd=' domain
D.The X-Originating-IP header value
E.The last (bottommost) Received header's IP
AnswersD, E
Some mail servers add this header with the original client IP.
Why this answer
The X-Originating-IP header is explicitly added by some mail servers (e.g., Microsoft Exchange) to record the originating IP of the client that submitted the message, making it a direct source for the sender's IP. The last (bottommost) Received header represents the first hop from the sender's mail client or server, as each receiving server prepends its own Received header, so the bottommost one contains the IP of the initial connecting host.
Exam trap
EC-Council CHFI often tests the distinction between headers that contain routing information (Received, X-Originating-IP) and those that contain metadata or authentication data (Message-ID, From, DKIM), leading candidates to mistakenly choose headers that are easily forged or unrelated to IP tracing.
A Docker container is suspected of malicious activity. Which THREE data sources should the investigator collect for forensic analysis?
Select 3 answers
A.Network packet captures from the container's virtual interface
B.Host system audit logs
C.Docker image layer files
D.Container logs (stdout/stderr)
E.The Dockerfile used to build the image
AnswersB, C, D
Host system audit logs, such as those from auditd, systemd journal, or syslog, are the strongest artifact because the host kernel records container process activity in a way that survives container removal. These logs commonly capture container-ID-tagged process executions, file access, syscalls, and seccomp/AppArmor denials, allowing an investigator to reconstruct the container's interactions with the host. Unlike in-container logs, an attacker who deletes or overwrites files inside the container cannot easily erase the host-side audit trail.
Why this answer
Container logs, image layers, and host system logs are key sources in Docker forensics.
During an investigation of a web application breach, an analyst reviews IIS logs and finds numerous entries with status code '200' and URIs containing '?cmd=' followed by encoded strings. The analyst also notices that some requests have a 'User-Agent' string resembling 'Microsoft-CryptoAPI/10.0'. What is the MOST likely conclusion?
A.The logs indicate a successful SQL injection attack
B.The logs show a cross-site scripting (XSS) attack targeting administrators
C.The server is infected with ransomware, encrypting files
D.A webshell is being used to execute commands on the server
AnswerD
The logs indicate a webshell is in use because the HTTP requests contain a cmd parameter whose values are operating-system commands, a classic hallmark of server-side web shells such as China Chopper or b374k. The non-standard User-Agent further suggests a customized or automated attacker tool, and the consistent use of this parameter across requests shows persistent remote access. This behavior is the result of a command injection vulnerability, where the web application fails to sanitize user input before passing it to the system shell, allowing the attacker to execute arbitrary commands directly against the server.
Why this answer
The presence of numerous HTTP 200 (success) responses with URIs containing '?cmd=' followed by encoded strings indicates that an attacker is sending command execution requests to a webshell on the server. The unusual User-Agent string 'Microsoft-CryptoAPI/10.0' is a known evasion technique used by webshell tools (e.g., China Chopper variants) to blend in with legitimate Windows update traffic. Successful command execution returns a 200 status, confirming the webshell is active and under attacker control.
Exam trap
The trap here is that candidates see '200 OK' and assume success of an attack like SQL injection, but the '?cmd=' parameter is the definitive indicator of a command execution webshell. EC-CHFI emphasizes recognizing webshell indicators such as encoded command parameters and unusual User-Agent strings.
How to eliminate wrong answers
Option A is wrong because SQL injection typically results in error codes (e.g., 500) or modified database responses, not consistent 200s with '?cmd=' parameters; the '?cmd=' pattern is characteristic of command execution, not SQL queries. Option B is wrong because XSS attacks inject client-side scripts into web pages and do not produce server-side command execution logs with '?cmd=' URIs; XSS would appear as reflected or stored script payloads in parameters like '?q=' or '?search='. Option C is wrong because ransomware encrypts files locally and communicates with C2 servers, but it does not generate repeated HTTP 200 responses with '?cmd=' in IIS logs; ransomware activity would show unusual file access patterns or encryption API calls, not webshell command execution.
Which TWO of the following are valid methods to hide data on an NTFS file system without using external tools?
Select 2 answers
A.Embedding data in file slack space
B.Storing data in the NTFS file system journal ($LogFile)
C.Using the $Volume attribute in the MFT
D.Encrypting data with EFS
E.Using Alternate Data Streams (ADS)
AnswersA, E
File slack is unused space at the end of a cluster that can be filled with data.
Why this answer
A is correct because file slack space is the unused bytes between the end of a file's logical data and the end of its allocated cluster. On NTFS, when a file does not fill its last cluster, the remaining bytes (RAM slack and drive slack) can be written to without affecting the file's visible content. This is a native hiding method that requires no external tools, as the data is simply written to the slack region using standard file I/O operations.
Exam trap
EC-CHFI often tests the misconception that NTFS journals or MFT attributes can be used for data hiding without external tools, but only slack space and Alternate Data Streams (ADS) are native, supported mechanisms that do not require third-party utilities.
What is the primary goal of the chain of custody in a digital forensic investigation?
A.To maintain the integrity and admissibility of evidence
B.To encrypt the evidence during transport
C.To speed up the forensic analysis process
D.To ensure that the forensic tools used are properly licensed
AnswerA
This is the main purpose: to show that evidence has not been tampered with.
Why this answer
The chain of custody is a documented chronological record that tracks the seizure, custody, control, transfer, analysis, and disposition of digital evidence. Its primary goal is to maintain the integrity and admissibility of evidence by proving that the evidence has not been tampered with or altered from the moment it was collected until it is presented in court. This is critical because any break in the chain can lead to evidence being deemed inadmissible under rules like the Federal Rules of Evidence (FRE) or the Daubert standard.
Exam trap
EC-Council often tests the misconception that chain of custody is about physical security or tool licensing, when in fact it is solely about maintaining a verifiable, unbroken record of evidence handling to ensure legal admissibility.
How to eliminate wrong answers
Option B is wrong because encrypting evidence during transport is a security measure to protect confidentiality, not a goal of the chain of custody, which focuses on integrity and accountability through documentation. Option C is wrong because the chain of custody does not speed up analysis; in fact, it adds procedural steps that can slow the process but are necessary for legal admissibility. Option D is wrong because ensuring forensic tools are properly licensed is a matter of tool validation and legal compliance, unrelated to the chain of custody's purpose of tracking evidence handling.
An analyst discovers that a Windows system has hidden data in the Host Protected Area (HPA) of the hard drive. Which tool or method can be used to detect and access the HPA?
A.Using the Windows Disk Management utility
B.Using the hdparm command in Linux with the -N flag
C.Using the Volatility framework
D.Using the chkdsk command
AnswerB
hdparm -N /dev/sda shows the user-accessible capacity vs. native capacity, revealing HPA.
Why this answer
The Host Protected Area (HPA) is a reserved region on ATA/ATAPI hard drives that is not visible to the operating system's standard disk utilities. The `hdparm` command in Linux with the `-N` flag is specifically designed to detect and modify the HPA by querying the drive's native max address, revealing hidden sectors. Windows Disk Management and other OS-level tools cannot access the HPA because it is hidden at the firmware level via the ATA SET MAX ADDRESS command.
Exam trap
The trap here is that candidates assume standard Windows utilities like Disk Management can see all drive areas, but the HPA is hidden at the firmware level and requires ATA command-level tools like hdparm to access.
How to eliminate wrong answers
Option A is wrong because Windows Disk Management only shows partitions visible to the OS and cannot detect the HPA, which is hidden at the ATA command level. Option C is wrong because the Volatility framework is a memory forensics tool for analyzing RAM dumps, not for low-level hard drive regions like the HPA. Option D is wrong because chkdsk checks file system integrity on visible partitions and has no capability to interact with ATA commands that control the HPA.
During an iOS forensics investigation, an examiner extracts an iTunes backup and finds the SQLite database files. Which TWO of the following databases are LEAST likely to contain forensically relevant artefacts for a communication analysis?
Select 2 answers
A.SMS.db
B.data_ark.db
C.AddressBook.db
D.tmp.db
E.call_history.db
AnswersB, D
Not a standard iOS backup database; likely not present or relevant.
Why this answer
B is correct because data_ark.db is not a standard iOS SQLite database; it does not exist in typical iOS backups or file systems. The name suggests a fabricated or non-standard artefact, making it least likely to contain forensically relevant communication data. In contrast, databases like SMS.db and call_history.db are well-documented repositories for SMS messages and call logs, respectively.
Exam trap
EC-Council often tests candidates' familiarity with standard iOS database filenames, and the trap here is that 'data_ark.db' sounds plausible (like an 'ark' for data) but is not a real iOS database, leading examinees to overlook it as a distractor.
A forensic investigator recovers a hard drive from a suspect's computer. The drive is detected as 120 GB in BIOS, but forensic tools report only 100 GB of addressable space. Which data hiding technique is MOST likely being used?
A.Device Configuration Overlay (DCO)
B.Volume slack
C.Host Protected Area (HPA)
D.Alternate Data Streams (ADS)
AnswerC
Host Protected Area (HPA) is an ATA feature that uses the SET MAX ADDRESS command to lower the drive's reported maximum address, causing all sectors beyond that boundary to become inaccessible to the operating system and BIOS. This effectively hides data in the protected area at the end of the physical disk, which is exactly the kind of capacity mismatch that forensic acquisition tools detect by comparing the native maximum address against the current maximum. HPA is the correct answer because it directly addresses the hardware-level capacity reduction described.
Why this answer
The Host Protected Area (HPA) is a region on a hard drive that is hidden from the operating system by using the ATA SET MAX ADDRESS command to reduce the reported addressable space. Since the BIOS detects the full 120 GB but forensic tools see only 100 GB, the HPA is the most likely technique, as it creates a hidden area beyond the reported maximum LBA that is not visible to standard forensic acquisition tools unless specifically addressed.
Exam trap
The trap here is that candidates confuse HPA with DCO, but the key differentiator is that DCO hides space from the BIOS as well, while HPA allows the BIOS to see the full drive but hides space from the OS and forensic tools.
How to eliminate wrong answers
Option A is wrong because Device Configuration Overlay (DCO) is a feature that allows the drive manufacturer to hide the entire drive or a portion of it from the BIOS and OS, but here the BIOS correctly detects 120 GB, ruling out DCO. Option B is wrong because volume slack refers to unused space at the end of a volume that is not part of any partition, but it does not reduce the total addressable space reported by forensic tools; it is a byproduct of partition alignment, not a deliberate hiding technique. Option D is wrong because Alternate Data Streams (ADS) are a feature of NTFS that allow data to be hidden within a file's metadata, but they do not affect the total addressable space of a hard drive; they operate at the file system level, not the disk geometry level.
An analyst receives an alert indicating a suspicious process (PID 3342) is making outbound connections on port 443 to an unknown IP. The system is a Windows 10 workstation. Which first responder action is MOST appropriate?
A.Capture a full memory dump using a tool like FTK Imager (Memory Capture) or DumpIt.
B.Immediately disconnect the system from the network to contain the threat.
C.Check the Windows Event Logs for related entries.
D.Reboot the system to clear any malicious processes from memory.
AnswerA
Capturing a full memory dump with FTK Imager (Memory Capture) or DumpIt preserves the entire contents of RAM, including running processes, loaded drivers, active network sockets, decrypted data, and injected code that exist only in volatile memory at that instant. This adheres to the order of volatility and allows analysis of the live system state without altering or destroying it. Memory imaging is the highest-priority step because many advanced threats operate solely in memory and leave minimal traces on disk.
Why this answer
Capturing a full memory dump (option A) is the most appropriate first responder action because it preserves the volatile state of the suspicious process (PID 3342) and its associated artifacts (e.g., network connections, loaded DLLs, encryption keys) before any further system changes occur. This allows forensic analysis to identify the malware's behavior, such as command-and-control (C2) communication over port 443 (HTTPS), without altering evidence. Tools like FTK Imager (Memory Capture) or DumpIt acquire a raw .mem file that can be analyzed with Volatility or Rekall to extract process details, network sockets, and injected code.
Exam trap
EC-Council often tests the principle that volatile data (memory) must be captured before any containment or analysis steps, and the trap here is that candidates mistakenly prioritize network containment (option B) over evidence preservation, forgetting that disconnecting the network can destroy critical volatile artifacts like active connections and encryption keys.
How to eliminate wrong answers
Option B is wrong because immediately disconnecting the system from the network may destroy volatile evidence (e.g., active TCP connections, ARP cache, and network session data) and could alert the attacker, potentially triggering anti-forensic measures like process termination or data encryption. Option C is wrong because checking Windows Event Logs is a secondary step that should occur after memory capture; event logs may not contain real-time process details (e.g., memory-resident code) and can be tampered with or cleared by the malware. Option D is wrong because rebooting the system destroys all volatile memory (RAM), including the suspicious process (PID 3342), network connections, and any decrypted payloads, making forensic recovery of the attack impossible.
Which THREE of the following are indicators of a webshell compromise on a web server?
Select 3 answers
A.High CPU usage from web server processes
B.Regular successful logins to the server with correct credentials
C.Presence of files with extensions like .php, .asp, or .jsp in web directories that are not part of the original application
D.Unexpected outbound connections from the web server to unknown IP addresses
E.Decrease in network traffic
AnswersA, C, D
Execution of arbitrary commands or scripts can spike CPU usage.
Why this answer
A webshell often executes malicious commands via the web server's process (e.g., Apache's httpd or IIS's w3wp.exe). This causes sustained high CPU usage because the webshell may be running resource-intensive tasks like password cracking, data exfiltration, or cryptomining within the web server's process context, which is a strong indicator of compromise.
Exam trap
Candidates often mistake normal administrative behavior (Option B) for suspicious activity, but webshells bypass authentication entirely, making regular successful logins irrelevant as indicators.
Which tool is commonly used for timeline analysis in digital forensics, allowing examiners to parse and correlate timestamps from various artifacts?
A.log2timeline
B.Sleuth Kit
C.Nmap
D.Wireshark
AnswerA
log2timeline/Plaso is the forensic tool for creating timelines from multiple artifacts.
Why this answer
log2timeline (now part of the Plaso framework) is the de facto tool for timeline analysis in digital forensics. It parses a wide range of artifacts (e.g., $MFT, $UsnJrnl, Prefetch, Registry hives, event logs) and correlates their timestamps into a unified, super-timeline, enabling examiners to reconstruct system activity chronologically.
Exam trap
EC-Council CHFI often tests the distinction between file system analysis tools (Sleuth Kit) and timeline correlation tools (log2timeline), so candidates may mistakenly choose Sleuth Kit because it includes mactime, forgetting that log2timeline is the primary tool for building a super-timeline from multiple artifacts.
How to eliminate wrong answers
Option B (Sleuth Kit) is wrong because it is a collection of command-line tools for file system analysis (e.g., fls, icat, mmls) but does not perform timeline correlation or multi-artifact timestamp parsing. Option C (Nmap) is wrong because it is a network scanning tool used for port discovery and service enumeration, not for forensic timeline analysis. Option D (Wireshark) is wrong because it is a network protocol analyzer for capturing and inspecting packets, not a tool for parsing file system or registry timestamps.
A first responder arrives at a scene where a computer is powered on and a user is logged in. An incident is suspected. What should the responder do FIRST?
A.Begin capturing a memory dump using a forensic tool.
B.Power off the computer immediately to preserve the disk.
C.Photograph the screen to document the current state.
D.Ask the user to log off so the system can be imaged.
AnswerC
Documentation of the live state is critical before any collection.
Why this answer
The first priority at a live incident scene is to preserve volatile evidence. Photographing the screen captures the current state of the system, including open applications, network connections, and user activity, which can be lost if the system is altered or powered down. This documentation provides a baseline for the investigation and ensures that critical volatile data is recorded before any forensic acquisition begins.
Exam trap
EC-Council often tests the misconception that immediate memory capture or power-off is the correct first step, but the trap here is that the first responder must first document the volatile state of the screen to preserve evidence that can be lost the instant any action is taken.
How to eliminate wrong answers
Option A is wrong because while capturing a memory dump is important, it should not be the first action; the responder must first document the current state of the screen to preserve volatile evidence that may be lost during the memory capture process. Option B is wrong because powering off the computer immediately can destroy volatile data (e.g., RAM contents, network connections, running processes) and may trigger anti-forensic mechanisms or cause data corruption; the proper procedure is to follow a live response approach. Option D is wrong because asking the user to log off can alter the system state, potentially destroying evidence such as open files, registry keys, or network sessions, and may also trigger cleanup scripts that delete volatile data.
You are imaging a suspect's hard drive using a write blocker and dd command. After imaging, you verify the hash of the original drive and the image file. The original drive hash is SHA1: A1B2C3D4E5..., and the image hash is SHA1: F6G7H8I9J0... What is the most likely cause of the mismatch?
A.The dd command used a different block size
B.The write blocker malfunctioned and allowed writes to the original drive
C.The dd command compressed the output
D.The image file was corrupted during transfer
AnswerB
A write blocker is a dedicated hardware or software mechanism that intercepts and blocks all write commands from the host system to the suspect drive during acquisition. If it malfunctions, the operating system or the acquisition tool may write temporary files, filesystem metadata, or other data onto the original evidence drive. Any such unintended write changes the drive's contents, so when the examiner later computes a hash of the original drive, it will no longer match the hash of the forensic image taken earlier. This is the only option that directly explains how the source itself could be altered, making it the correct cause of the hash discrepancy.
Why this answer
The hash mismatch indicates that the data on the original drive and the image file are not identical. A write blocker malfunction that allowed writes to the original drive during the imaging process would alter the source data after the initial hash was computed, causing the final hash of the original drive to differ from the hash of the image file taken at a different point in time. This is the most direct cause of a hash mismatch because the write blocker's primary purpose is to prevent any modification to the evidence.
Exam trap
EC-Council often tests the misconception that dd's block size or compression affects the hash, but the trap here is that candidates overlook the write blocker's role in preserving evidence integrity and instead focus on technical details of the dd command that do not alter the data content.
How to eliminate wrong answers
Option A is wrong because the dd command's block size affects read/write performance and the number of blocks, but it does not change the underlying data; the hash of the output will match the input regardless of block size as long as the entire drive is read. Option C is wrong because dd does not compress output by default; it performs a bit-for-bit copy, and even if compression were applied (e.g., via piping to gzip), the hash would be computed on the compressed file, not the raw image, but the question states the image file hash is compared, so compression would not cause a mismatch between the original drive hash and the image hash if the image is decompressed correctly. Option D is wrong because corruption during transfer would affect the image file's integrity, but the hash of the original drive would remain unchanged; the mismatch described is between the original drive hash and the image hash, and transfer corruption would only alter the image hash, not the original drive hash.
In mobile forensics, which acquisition method preserves the highest level of data integrity and captures the most data from an iOS device?
A.File system acquisition
B.Physical acquisition
C.Logical acquisition
D.Manual acquisition
AnswerB
Physical acquisition creates a bit-for-bit, forensically sound image of the entire flash memory chip, including unallocated sectors, deleted file fragments, file system slack, and even data remnants from previous partitions. This method is the only approach that preserves the full forensic data set without relying on the device's operating system to filter or sanitize the output. By capturing the complete NAND image, it maximizes data integrity and completeness, making it unequivocally the correct choice for a preservation-focused acquisition.
Why this answer
Physical acquisition is correct because it creates a bit-for-bit copy of the entire flash storage, including unallocated space, deleted files, and system partitions. This method bypasses the iOS file system abstraction, preserving the highest data integrity and capturing all recoverable data, unlike higher-level acquisitions that only retrieve accessible files.
Exam trap
EC-Council often tests the misconception that 'file system acquisition' is the most thorough because it includes system files, but the trap is that physical acquisition alone captures unallocated space and deleted data, which file system acquisition cannot access due to iOS sandboxing and file system abstraction.
How to eliminate wrong answers
Option A is wrong because file system acquisition only copies allocated files and metadata visible through the iOS file system (e.g., via AFC or iTunes backup), missing deleted data and unallocated space, thus providing lower integrity and less data. Option C is wrong because logical acquisition extracts only user-accessible data (e.g., contacts, messages) via APIs like iTunes backup or libimobiledevice, ignoring system files and deleted artifacts, resulting in the least data capture. Option D is wrong because manual acquisition involves physically interacting with the device screen to capture data (e.g., screenshots or notes), which is highly operator-dependent, alters the device state, and cannot recover hidden or deleted data, offering the lowest integrity and data completeness.
In network forensics, an analyst captures traffic and sees a large number of ICMP echo requests from 10.0.0.1 to 10.0.0.2 with varying payload sizes. What is the most likely scenario?
A.Network reconnaissance (ping sweep)
B.A man-in-the-middle attack
C.A DoS attack using ICMP floods
D.A DNS amplification attack
AnswerC
A large volume of ICMP echo requests (ping) from a single source to a single destination, especially with varying payload sizes, is a classic signature of an ICMP flood DoS attack. The sheer volume of packets consumes the target's bandwidth and processing resources, and the varied payload sizes are often used to defeat filters that block only fixed-size pings. This pattern is distinct from reconnaissance or protocol-specific abuse because it intentionally overwhelms the victim with raw ICMP traffic.
Why this answer
The scenario describes a single source sending a large number of ICMP echo requests to a single destination with varying payload sizes. This is characteristic of an ICMP flood attack, a type of DoS attack where the attacker overwhelms the target with echo requests, consuming bandwidth and processing resources. The varying payload sizes may be an attempt to evade simple packet filters or to maximize resource consumption.
In contrast, a ping sweep would involve sending requests to multiple destinations to discover live hosts, not a sustained high-volume stream to one host. Therefore, this is most likely a DoS attack, not reconnaissance.
Exam trap
EC-Council often tests the ability to differentiate between reconnaissance and attack by presenting ICMP traffic with varying payloads. Candidates may mistakenly classify a high-volume single-target ICMP flood as a ping sweep (Option A) due to the payload variation, but the key indicator is the single destination and overwhelming volume, which points to a DoS attack.
How to eliminate wrong answers
Option B is wrong because a man-in-the-middle attack typically involves ARP spoofing, DNS spoofing, or session hijacking, not a series of ICMP echo requests with varying payloads. Option C is wrong because a DoS attack using ICMP floods would involve a high volume of packets from potentially multiple sources to overwhelm the target, not a single source sending packets with varying sizes to a single destination, which is too low-volume for denial of service. Option D is wrong because a DNS amplification attack uses spoofed DNS queries with a small request size to generate large responses from open resolvers, targeting a victim with UDP traffic, not ICMP echo requests.
In an iOS forensic examination, an analyst extracts an encrypted iTunes backup. The backup contains a file named 'manifest.plist' which lists the backup version and encryption state. Which tool is specifically designed to brute-force the backup password using GPU acceleration?
A.Hashcat
B.Oxygen Forensic Detective
C.Cellebrite UFED
D.GrayKey
AnswerA
Hashcat is the only listed tool designed for GPU-accelerated offline password recovery, and mode 14700 specifically targets iTunes backup password hashes extracted from Manifest.plist. An examiner converts the encrypted backup metadata into a hash format that Hashcat can attack, then uses dictionary, rule-based, or brute-force attacks on GPUs. This makes it uniquely suited for recovering the backup encryption password when the device passcode is unknown or when legal authority permits an offline attack.
Why this answer
Hashcat is the correct tool because it is a password recovery utility that leverages GPU acceleration to perform high-speed brute-force attacks on encrypted iTunes backup passwords. It can directly process the password hash extracted from the 'manifest.plist' file, which contains the backup version and encryption state, allowing efficient cracking of the backup password.
Exam trap
The CHFI exam often tests the distinction between tools used for physical device extraction (like Cellebrite UFED or GrayKey) versus those used for password cracking (like Hashcat), and the trap here is that candidates may confuse GrayKey's passcode bypass capability with backup password cracking, even though GrayKey does not use GPU acceleration for brute-forcing encrypted backups.
How to eliminate wrong answers
Option B (Oxygen Forensic Detective) is wrong because it is a forensic analysis suite for extracting and analyzing mobile device data, not a dedicated password cracking tool with GPU acceleration. Option C (Cellebrite UFED) is wrong because it is a physical extraction and forensic imaging tool for mobile devices, not designed for brute-forcing encrypted backup passwords using GPU acceleration. Option D (GrayKey) is wrong because it is a specialized device for bypassing iOS passcodes via hardware exploits or software vulnerabilities, not for cracking encrypted iTunes backup passwords with GPU-accelerated brute-force attacks.
An incident responder receives an alert that a workstation is beaconing to a known malicious IP address. The responder captures network traffic and analyzes it with Wireshark. Which of the following would be an immediate indicator of compromise (IoC) visible in the traffic capture?
A.Large file transfers during off-hours
B.ARP requests from unknown MAC addresses
C.Encrypted payloads using TLS 1.3
D.Repeated connections to a known malicious IP address on a non-standard port
AnswerD
Repeated connections to a known malicious IP address on a non-standard port is a high-fidelity indicator of compromise because it combines an established threat reputation with observable behavior that matches command-and-control (C2) beaconing. Non-standard ports are often used by malware to evade simple port-based filters, and the recurrence suggests a persistent callback rather than an accidental or one-time connection. This pattern directly aligns with the MITRE ATT&CK technique T1071 for application-layer C2 traffic.
Why this answer
Repeated connections to a known malicious IP address on a non-standard port directly match the definition of a beaconing indicator of compromise (IoC). In network traffic analysis, beaconing is characterized by periodic, outbound connections to a command-and-control (C2) server, often using a non-standard port to evade detection. This pattern is a primary IoC in malware forensics and is immediately visible in Wireshark as a series of TCP SYN packets to the same IP and port at regular intervals.
Exam trap
The CHFI exam often tests the distinction between a direct IoC (like beaconing to a known malicious IP) and secondary indicators (like large file transfers or ARP anomalies) that require additional context to confirm compromise.
How to eliminate wrong answers
Option A is wrong because large file transfers during off-hours may indicate data exfiltration but are not an immediate indicator of beaconing; they are a secondary behavioral anomaly that requires correlation with other evidence. Option B is wrong because ARP requests from unknown MAC addresses indicate local network scanning or spoofing, not beaconing to a remote malicious IP; ARP operates at Layer 2 and does not reveal C2 communication patterns. Option C is wrong because encrypted payloads using TLS 1.3 are not inherently malicious; TLS 1.3 is a standard security protocol used by legitimate services, and its presence alone does not indicate compromise—beaconing is defined by connection patterns, not encryption.
An incident responder analyzes a compromised system and finds evidence of timestomping: the Modified timestamp of a malicious DLL is earlier than the Creation timestamp. Additionally, the DLL is encrypted with an XOR key. Which anti-forensic techniques are being employed?
A.Timestomping and obfuscation
B.Packer and anti-debugging
C.Rootkit installation and process hiding
D.Log wiping and data hiding
AnswerA
Timestomping is the deliberate modification of file system timestamps (MAC times) to disrupt forensic timeline reconstruction and hide when malware was deployed or accessed. The presence of XOR-encoded strings constitutes obfuscation, a common evasion method used to complicate static signature detection and reverse engineering. Together, these artifacts indicate a deliberate anti-forensic effort to hinder incident response analysis.
Why this answer
Timestomping is confirmed because the Modified timestamp (which tracks file content changes) is earlier than the Creation timestamp, which is logically impossible under normal file system operations—this indicates an attacker deliberately set the Modified timestamp backward to evade timeline analysis. The XOR encryption of the DLL is a form of obfuscation, a technique used to hide the true content of the file from static analysis tools and signature-based detection. Together, these two actions represent the anti-forensic techniques of timestomping and obfuscation.
Exam trap
EC-Council often tests the distinction between obfuscation (e.g., XOR encryption) and packing (e.g., UPX compression), where candidates mistakenly equate any encryption with a packer, but a packer specifically alters the PE structure and includes a decompression stub, while XOR obfuscation is a simpler, non-structural transformation.
How to eliminate wrong answers
Option B is wrong because a packer compresses or encrypts an executable to reduce size or evade signature detection, but it does not alter timestamps, and anti-debugging techniques (e.g., IsDebuggerPresent API calls) are runtime defenses, not file-level obfuscation or timestamp manipulation. Option C is wrong because rootkit installation involves modifying the OS kernel or system calls to hide processes or files, and process hiding is a runtime concealment method—neither directly relates to timestamp manipulation or XOR encryption of a single DLL. Option D is wrong because log wiping targets system or application logs (e.g., clearing Event Logs or /var/log files), and data hiding typically refers to steganography or alternate data streams, not XOR encryption of a DLL.
A forensic analyst is investigating a Windows system for evidence of malware persistence. Which TWO registry locations are commonly used by malware to automatically execute on system startup?
Services subkeys can be configured to start automatically, used by malware for persistence.
Why this answer
D is correct because the HKLM\SYSTEM\CurrentControlSet\Services registry key stores configuration for Windows services, including the ImagePath value that specifies the executable to run. Malware often installs as a service to achieve automatic execution at system startup, as services are started by the Service Control Manager (SCM) during boot, independent of user logon.
Exam trap
The trap here is that candidates confuse registry locations used for user-specific startup (like HKCU\...\Run) with system-wide persistence mechanisms, or they mistakenly think non-startup keys like SAM or ShellBags are relevant to auto-execution.
During a mobile forensic investigation, an analyst uses Cellebrite UFED to extract data from a locked iOS device. The extraction successfully retrieves the device's passcode, call logs, SMS messages, and application data. Which extraction method did the analyst MOST likely use?
A.File system extraction
B.Physical extraction
C.Advanced logical extraction
D.Logical extraction
AnswerC
Advanced logical extraction, as performed by tools such as Cellebrite UFED, leverages bootload-level exploits like Checkm8 to temporarily bypass the lock screen and prompt the device to trust the forensic workstation. This grants access to keychain items, including passcode hashes, and permits extraction of app data by reading the encrypted filesystem with the user's decryption keys while the device is powered. It is the correct answer because it is specifically designed to recover passcode-related and application data from locked iOS devices in a non-invasive manner, preserving data integrity without needing a full chip image.
Why this answer
C is correct because Advanced Logical Extraction (ALE) on Cellebrite UFED leverages a combination of file system parsing, agent-based extraction, and exploit techniques to retrieve the device passcode, call logs, SMS messages, and application data from a locked iOS device without requiring a full physical dump. This method bypasses the logical extraction limitations by using a custom agent or AFC (Apple File Conduit) to access protected data, making it the most likely method for the described successful extraction.
Exam trap
The CHFI exam often tests the misconception that 'physical extraction' is the most powerful method for locked iOS devices, but the trap here is that physical extraction is rarely achievable on modern iOS due to hardware encryption, whereas Advanced Logical Extraction is the practical method used by tools like Cellebrite UFED to retrieve passcodes and application data from locked devices.
How to eliminate wrong answers
Option A is wrong because file system extraction typically requires the device to be jailbroken or have an unlocked state to mount the file system and retrieve raw files; it does not inherently retrieve the passcode from a locked device. Option B is wrong because physical extraction on iOS devices is extremely limited due to hardware encryption and secure enclave protections, and it rarely succeeds on locked devices without advanced bootrom exploits (e.g., checkm8), which are not standard in Cellebrite UFED for passcode retrieval. Option D is wrong because logical extraction only retrieves data that the device's operating system exposes via standard APIs (e.g., iTunes backup), which does not include the passcode or deep application data from a locked device.
During a mobile forensic investigation, an examiner wants to recover deleted WhatsApp messages from an Android device. Which of the following artefacts should the examiner examine? (Select TWO.)
This path is the app-specific external storage directory for WhatsApp on shared storage, exposed via FUSE and sometimes accessible to forensic tools even without root. It holds user-visible artifacts such as transmitted images, videos, voice notes, and document files, and may also contain encrypted database backups (e.g., msgstore.db.crypt14) that, when credentialed or decrypted, can reveal message history. In a logical acquisition, this location is a priority because it often survives app data clearing and can corroborate messages recovered from the internal database. It is correct because it is a designated app-owned location on external media where WhatsApp materializes attachments with metadata like file names and timestamps.
Why this answer
WhatsApp stores media files (images, videos, voice notes) in the external app-specific directory `/data/media/0/Android/data/com.whatsapp/`. Even after a message is deleted from the chat, the media file may remain in this directory if it was not explicitly removed, allowing recovery. Option C is correct because the primary SQLite database `msgstore.db` in `/data/data/com.whatsapp/databases/` contains the chat messages, including deleted entries that are often only marked as deleted but not physically removed until a vacuum operation.
Exam trap
The CHFI exam often tests the distinction between the app-specific data directory (`/data/data/`) and the external media directory (`/data/media/0/`), tricking candidates into thinking only the internal database holds deleted messages, while media files in the external directory are also recoverable artefacts.
During a forensic examination, an analyst uses the command 'dd if=/dev/sda of=/mnt/evidence/image.dd bs=4096 conv=noerror,sync'. What is the primary purpose of the 'conv=noerror,sync' option in this context?
A.To split the image into multiple smaller files
B.To skip bad sectors and continue imaging, padding the output with zeros
C.To compress the output image file
D.To verify the image integrity using a hash
AnswerB
noerror allows dd to continue on read errors, and sync pads the output so that the resulting image is the same size as the original device.
Why this answer
The 'conv=noerror,sync' option tells dd to continue reading even when it encounters read errors (noerror) and to pad the output with zeros (sync) to maintain the correct offset alignment, ensuring the image remains a bit-for-bit copy of the source drive despite bad sectors. This is critical in forensic imaging to preserve the integrity of the data stream and avoid truncation or corruption of the output file.
Exam trap
The trap here is that candidates often confuse 'conv=noerror,sync' with error correction or data recovery, when in fact it simply allows the imaging to proceed past bad sectors by padding with zeros, not by recovering the lost data.
How to eliminate wrong answers
Option A is wrong because splitting an image into multiple files is achieved with options like 'split' or 'bs' combined with 'count', not with 'conv=noerror,sync'. Option C is wrong because compression is not a function of dd's conv parameter; compression requires piping through gzip or using a separate tool. Option D is wrong because hash verification is done with separate commands like 'md5sum' or 'sha256sum', not with the conv parameter of dd.
Which THREE of the following are common challenges specific to cloud forensics? (Select THREE)
Select 3 answers
A.Data jurisdiction and legal compliance across regions
B.Volatility of evidence due to auto-scaling and ephemeral instances
C.Inability to acquire physical hard drives
D.Lack of standardized log formats
E.High cost of forensic tools
AnswersA, B, C
Data may be stored in multiple countries with different laws.
Why this answer
Cloud forensic investigations must navigate data jurisdiction and legal compliance issues when data is stored across multiple geographic regions, each with its own data protection laws (e.g., GDPR, CLOUD Act). This creates challenges in obtaining lawful access to data that may be physically located in a jurisdiction where the investigator has no legal authority.
Exam trap
EC-Council often tests the distinction between general forensic challenges and those that are unique to cloud environments, so candidates mistakenly select 'Lack of standardized log formats' or 'High cost of forensic tools' because they are real issues, but they are not specific to cloud forensics.
A network forensics analyst captures traffic and sees a series of TCP SYN packets sent to multiple ports on a target, with no corresponding SYN-ACK replies. What type of activity is MOST likely indicated?
A.A denial-of-service (DoS) flood
B.A port scan reconnaissance
C.A man-in-the-middle attack
D.Normal web browsing traffic
AnswerB
This pattern is the classic signature of a TCP SYN scan, a common port scanning technique. The attacker sends a SYN packet to each port on a target; if the port is open, the target responds with a SYN-ACK, while closed ports trigger an RST or no reply. Observing multiple SYN packets to different ports without complete handshakes indicates systematic probing to enumerate which services are listening, exactly what a port scan reconnaissance does.
Why this answer
The observation of TCP SYN packets sent to multiple ports without any SYN-ACK replies indicates a port scan, specifically a SYN scan (half-open scan). In a SYN scan, the attacker sends a SYN packet to each port; if the port is open, the target responds with a SYN-ACK, but the attacker never completes the handshake. The absence of any SYN-ACK replies suggests that either all scanned ports are closed (RST responses would be expected) or the target is filtering traffic, but the pattern of multiple SYN packets to different ports is the hallmark of reconnaissance, not a denial-of-service attack.
Exam trap
A common trap is confusing a SYN scan (reconnaissance) with a SYN flood (DoS attack); the key differentiator is the lack of SYN-ACK replies combined with scanning multiple ports, indicating reconnaissance rather than an attempt to overwhelm the target.
How to eliminate wrong answers
Option A is wrong because a denial-of-service (DoS) flood typically involves a high volume of traffic (e.g., SYN flood) to overwhelm a target, often with spoofed source IPs, and would generate SYN-ACK replies from the target if ports are open; the absence of SYN-ACK replies here suggests a scan, not an attack. Option C is wrong because a man-in-the-middle attack requires intercepting and potentially modifying communications between two parties, which is not indicated by a series of SYN packets to multiple ports with no replies. Option D is wrong because normal web browsing traffic involves completing the TCP three-way handshake (SYN, SYN-ACK, ACK) and then exchanging HTTP data, not sending SYN packets to multiple ports without receiving SYN-ACK replies.
A malware analyst is performing static analysis on a packed executable. Which THREE techniques are effective for unpacking or analyzing packed malware? (Select THREE.)
Select 3 answers
A.Renaming the file to .txt
B.Performing strings analysis on the packed binary
C.Running PEiD to identify the packer
D.Executing the sample in Cuckoo Sandbox
E.Using OllyDbg to step through the unpacking routine
AnswersB, C, E
Strings may reveal embedded data or unpacked code regions.
Why this answer
Performing strings analysis on a packed binary can reveal embedded strings, such as import hints, configuration data, or the original entry point (OEP), which may survive packing. While packing obfuscates many strings, some packers leave remnants that static analysis tools like `strings` can extract, providing initial clues about the malware's functionality without execution.
Exam trap
The trap is that candidates may assume the question only allows static analysis techniques, but dynamic methods like using a debugger (OllyDbg) are also effective for unpacking. Do not exclude valid dynamic options just because they involve execution.
During an iOS forensic examination, an analyst extracts an iTunes backup and finds the file '3d0d7e5fb2ce288813306e4d4636395e047a3d28'. Which type of data does this file typically contain?
A.Call history
B.SMS and iMessage conversations
C.Keychain data
D.Notes app data
AnswerD
The hash corresponds to the Notes app's SQLite database (NotesStore.sqlite).
Why this answer
The file '3d0d7e5fb2ce288813306e4d4636395e047a3d28' is the SQLite database (NotesStore.sqlite) that stores Apple's Notes app data in an iOS backup. Its SHA-1 hash name corresponds to the domain 'AppDomain-com.apple.mobilenotes' and contains the notes, attachments, and metadata. This is a well-known artifact in iOS forensics for recovering user-created notes.
Exam trap
The CHFI exam often tests the misconception that all hash-named files in iOS backups are SMS or iMessage databases, but the specific hash '3d0d7e5fb2ce288813306e4d4636395e047a3d28' is uniquely tied to the Notes app, not SMS.
How to eliminate wrong answers
Option A is wrong because call history is stored in the file 'call_history.db' (or 'CallHistory.storedata') under the domain 'com.apple.callhistory', not in a hash-named file associated with the Notes app. Option B is wrong because SMS and iMessage conversations are stored in the 'sms.db' file (or '3d0d7e5fb2ce288813306e4d4636395e047a3d28' is not the correct hash for SMS; the actual SMS database hash is different, e.g., '3d0d7e5fb2ce288813306e4d4636395e047a3d28' is specifically for Notes). Option C is wrong because Keychain data is stored in the 'keychain-backup.plist' or 'keychain-2.db' files, not in a SQLite database with this hash; Keychain uses encrypted plist or SQLite files with different identifiers.
A forensic analyst is examining a Windows 10 system and needs to determine the last boot time of the system. Which registry hive and key should the analyst query to find this information?
A.NTUSER.DAT hive, key 'Control Panel\Desktop\'
B.SYSTEM hive, key 'CurrentControlSet\Control\Windows\', value 'ShutdownTime'
The 'ShutdownTime' value in this key records the last system shutdown time, which can be used to infer the last boot time (as the system boots after shutdown).
Why this answer
The SYSTEM hive stores system-wide configuration data, and the key 'CurrentControlSet\Control\Windows\' contains the 'ShutdownTime' value, which records the last system shutdown time. Since the last boot time is effectively the time after the last shutdown, querying this value provides the necessary information. This is a standard forensic artifact for determining system uptime and boot events on Windows 10.
Exam trap
EC-Council often tests the misconception that the SOFTWARE hive or NTUSER.DAT hive stores boot-related timestamps, but only the SYSTEM hive's 'CurrentControlSet\Control\Windows\' key contains the official 'ShutdownTime' value for determining last boot time.
How to eliminate wrong answers
Option A is wrong because NTUSER.DAT is the per-user registry hive, and 'Control Panel\Desktop\' contains user-specific desktop settings (like wallpaper or screen saver), not system boot or shutdown times. Option C is wrong because the SOFTWARE hive's 'Microsoft\Windows NT\CurrentVersion\' key stores OS version and installation details (e.g., product name, build number), not boot or shutdown timestamps. Option D is wrong because the SAM hive's 'SAM\Domains\Account\Users\' key contains user account security identifiers and password hashes, with no relation to system boot or shutdown events.
An email forensic analyst receives a suspicious email and wants to trace its origin. Which email header field provides the most reliable information about the IP address of the sending SMTP server?
A.Return-Path
B.Received
C.DKIM-Signature
D.X-Originating-IP
AnswerB
The Received header is the standard, reliable source for tracing the sending server's IP address in email forensics. Each SMTP server that handles the message adds a Received header that records the IP address (and often the hostname) of the server from which it received the message, along with a timestamp. The first Received header (reading from the bottom of the message) identifies the original sender's server, while each subsequent header documents each hop in the delivery chain. These headers are added automatically by mail servers and are much more difficult to spoof than user-controlled headers, making them the primary evidence for IP identification.
Why this answer
The 'Received' header is the most reliable source for tracing the origin of an email because each SMTP server that handles the message adds a new 'Received' header at the top, recording the IP address of the sending server (from the HELO/EHLO handshake) and the receiving server. The bottommost 'Received' header typically contains the IP address of the original sending SMTP server, as it is added by the first receiving MTA. This field is standardized in RFC 5321 and is the primary forensic artifact for email source identification.
Exam trap
The EC-Council CHFI exam often tests the misconception that X-Originating-IP is the most reliable source because it appears to directly show the sender's IP, but candidates must remember it is a non-standard header that can be easily forged or omitted, whereas the 'Received' header chain is a mandatory, traceable part of the SMTP protocol.
How to eliminate wrong answers
Option A is wrong because the Return-Path header (RFC 5321) contains the envelope sender (bounce address), not the IP address of the sending server; it is set by the Mail User Agent or the final MTA and can be forged. Option C is wrong because the DKIM-Signature header (RFC 6376) contains a cryptographic signature and the selector domain (d=), but it does not directly reveal the sending SMTP server's IP address; it only indicates the domain claiming responsibility for the message. Option D is wrong because X-Originating-IP is a non-standard, proprietary header often added by webmail services (e.g., Hotmail, Yahoo) to log the client's IP, but it is not universally present, not part of the SMTP protocol, and can be omitted or spoofed by the originating server.
Which TWO of the following are valid artifacts for determining program execution on a Windows system? (Select TWO.)
Select 2 answers
A.Pagefile.sys
B.System Restore points
C.Jump Lists
D.Prefetch files
E.Windows Error Reporting logs
AnswersC, D
Jump Lists record recently accessed files per application, showing usage.
Why this answer
Jump Lists (C) are correct because they store recently accessed files and applications per user, providing a timeline of program execution. Prefetch files (D) are correct because they contain execution counts, timestamps, and file paths for applications launched on Windows, directly indicating program execution.
Exam trap
EC-Council often tests the distinction between artifacts that record normal execution (Prefetch, Jump Lists) versus those that capture system state or errors (Pagefile, Restore Points, WER logs), leading candidates to overestimate the forensic value of Pagefile.sys or System Restore points.
An examiner is analyzing an Android device using Cellebrite UFED. The device is locked with a PIN, and the examiner has no PIN. Which acquisition type should the examiner attempt FIRST to maximize data recovery without destroying evidence?
A.Logical extraction via ADB backup
B.Manual extraction by photographing the screen
C.File system extraction via ADB root shell
D.Physical extraction using a bootloader exploit
AnswerA
ADB backup is a logical extraction that communicates with the Android system over USB to create a tar archive of app data and shared storage. Because it works through the running OS rather than requiring physical access to the flash chip, it can succeed on a locked device if USB debugging has already been enabled and the computer's RSA key is authorized. It does not require root, preserves the device's original state, and is a non-invasive first step before attempting more intrusive acquisition.
Why this answer
When an Android device is locked with a PIN and no PIN is known, a logical extraction via ADB backup is the safest first step. ADB backup (adb backup) can capture app data and system settings without requiring root or unlocking the bootloader, and it does not modify the device state, preserving evidence integrity. This method works if USB debugging was previously enabled, which is common in forensic acquisitions, and it avoids the risk of triggering lockout or data wiping that physical methods might cause.
Exam trap
EC-Council often tests the misconception that physical extraction is always the best first step for locked devices, but the trap here is that bootloader exploits or physical methods can trigger data wiping or require unlocking, whereas ADB backup is a non-invasive logical method that preserves evidence integrity when USB debugging is enabled.
How to eliminate wrong answers
Option B is wrong because manual extraction by photographing the screen is a non-acquisition technique that only captures visible content, not underlying data like deleted files or app databases, and it is not a standard forensic acquisition method for maximizing data recovery. Option C is wrong because file system extraction via ADB root shell requires root access, which is not available on a locked device without a PIN; attempting to root the device could modify system partitions and destroy evidence. Option D is wrong because physical extraction using a bootloader exploit often requires unlocking the bootloader, which wipes the device (factory reset) as a security measure, destroying all user data and making it unsuitable as a first attempt.
Which TWO tools are commonly used for static analysis of malware binaries?
Select 2 answers
A.Cuckoo Sandbox
B.Wireshark
C.IDA Pro
D.Ghidra
E.Process Monitor
AnswersC, D
IDA Pro is a disassembler and debugger for static analysis.
Why this answer
IDA Pro is a leading interactive disassembler and debugger used for static analysis of malware binaries. It allows analysts to examine executable code without executing it, by disassembling machine code into assembly language and providing cross-references, function graphs, and decompilation capabilities. This makes it essential for reverse engineering malicious software to understand its logic, embedded strings, and control flow.
Exam trap
EC-Council often tests the distinction between static and dynamic analysis tools, and the trap here is that candidates confuse tools that monitor live behavior (like Cuckoo Sandbox or Process Monitor) with those that analyze code without execution, leading them to select dynamic analysis tools for a static analysis question.
A forensic examiner is analyzing a RAID 5 array consisting of three disks. One disk has failed and is not available. The remaining two disks contain data and parity. Which technique can be used to reconstruct the missing disk's data and recover the original data?
A.Replace the failed disk and rebuild the array using the controller's rebuild function
B.Use dd to image the two disks, then perform a XOR operation on the data stripes to reconstruct the third disk's data
C.Use FTK Imager to create a logical image of each disk and merge them
D.Simply image the two disks and use file carving tools to extract files
AnswerB
XOR of data from two disks yields the missing data if parity is involved.
Why this answer
In a RAID 5 array with three disks, data and parity are striped across all disks. When one disk fails, the missing data can be reconstructed by performing an XOR operation on the corresponding stripes from the remaining two disks. This is because RAID 5 uses distributed parity where the parity block is the XOR of the data blocks in the same stripe, so XORing the surviving data and parity stripes recovers the lost data.
Exam trap
The CHFI exam often tests the misconception that RAID 5 can tolerate two disk failures or that simple imaging of surviving disks yields complete data without reconstruction, leading candidates to choose file carving or logical imaging options.
How to eliminate wrong answers
Option A is wrong because replacing the failed disk and using the controller's rebuild function is a hardware/administrative recovery method, not a forensic technique for reconstructing data from the remaining two disks when the failed disk is unavailable. Option C is wrong because FTK Imager's logical imaging merges file system metadata, not raw stripe-level data, and cannot reconstruct missing RAID 5 data without understanding the stripe layout and parity. Option D is wrong because simply imaging two disks and using file carving tools will only recover files that are contiguous and not split across stripes, and cannot reconstruct data that was solely on the failed disk.
An investigator needs to testify in court as an expert witness. Which of the following qualifications is MOST important for the court to accept their testimony?
A.They have a certification in computer forensics.
B.They have published articles in peer-reviewed journals on digital forensics.
C.They can demonstrate knowledge, skill, experience, training, or education that will assist the trier of fact.
D.They have been employed as a forensic analyst for over 10 years.
AnswerC
This option reflects the exact language of Federal Rule of Evidence 702, which establishes that a witness may qualify as an expert by virtue of knowledge, skill, experience, training, or education, provided the testimony will assist the trier of fact. The court serves as a gatekeeper and must determine that the proposed expert's qualifications are directly relevant to the technical or scientific issues in dispute and that their testimony is both reliable and helpful to the jury. This standard is deliberately broad and flexible, allowing the court to consider practical experience, formal education, certifications, and publications collectively rather than relying on any single credential.
Why this answer
Under the Federal Rules of Evidence (FRE) Rule 702, a witness qualified as an expert by knowledge, skill, experience, training, or education may testify if their specialized knowledge will assist the trier of fact. Option C directly mirrors this legal standard, making it the most critical qualification for admissibility. Certifications, publications, or years of service are supporting factors but not independently sufficient under the Daubert or Frye standards.
Exam trap
EC-Council often tests the misconception that a certification or years of experience alone qualifies someone as an expert witness, but the legal standard under FRE 702 requires the witness to demonstrate that their knowledge, skill, experience, training, or education will actually assist the trier of fact.
How to eliminate wrong answers
Option A is wrong because a certification alone does not guarantee that the court will accept the testimony; the court must assess whether the witness's actual knowledge and experience will assist the trier of fact, and certifications are not a substitute for demonstrated competence. Option B is wrong because published articles in peer-reviewed journals are a factor under the Daubert standard but are not the most important qualification; the witness must still show that their expertise directly aids the court in understanding the evidence. Option D is wrong because 10 years of employment as a forensic analyst does not automatically qualify someone as an expert; the court evaluates the substance of their experience and whether it logically applies to the specific digital evidence in question.
Which tool is specifically designed to analyze email headers, track the path of an email, and extract metadata such as originating IP and authentication results?
A.Volatility
B.Wireshark
C.EmailTracker
D.FTK Imager
AnswerC
EmailTracker parses email headers and provides detailed path and authentication info.
Why this answer
EmailTracker is specifically designed to parse email headers, trace the email's path through mail servers, and extract metadata such as the originating IP address, authentication results (SPF, DKIM, DMARC), and timestamps. Unlike general-purpose tools, it focuses solely on email header analysis and visualization, making it the correct choice for this task.
Exam trap
EC-Council often tests the distinction between network packet analysis tools (Wireshark) and email-specific header analysis tools (EmailTracker), trapping candidates who confuse live SMTP traffic capture with post-delivery email header forensics.
How to eliminate wrong answers
Option A is wrong because Volatility is a memory forensics framework used for analyzing RAM dumps, not for parsing email headers or tracking email paths. Option B is wrong because Wireshark is a network protocol analyzer that captures and inspects live network traffic (e.g., SMTP packets), but it does not parse stored email headers or extract metadata like originating IP from an email's header fields. Option D is wrong because FTK Imager is a disk imaging and data acquisition tool used for creating forensic images of storage media, not for analyzing email headers or extracting email metadata.
An Android forensic analyst connects a suspect device to their workstation and issues the command "adb backup -apk -shared -all -f backup.ab". Which type of acquisition is being performed?
A.Manual acquisition through device UI
B.Physical acquisition via JTAG
C.Logical acquisition via ADB backup
D.File system acquisition via dd
AnswerC
`adb backup` is a logical acquisition method because it leverages Android's Backup Service to request that each app's internal data, settings, and databases be serialized into a single .ab archive, excluding hidden regions and unallocated clusters. This high-level extraction is governed by the app's `backupAgent` and the device's backup policy, meaning some apps may opt out entirely or omit sensitive files. Unlike a physical or file system image, it yields no deleted remnants or raw partitions—so while it is a valid ADB-based forensic export, it does not produce a bit-for-bit copy of the storage medium.
Why this answer
The command `adb backup -apk -shared -all -f backup.ab` creates a full Android backup via the Android Debug Bridge (ADB) protocol. This is a logical acquisition because it requests user data and installed APKs through the high-level backup service, not a bit-for-bit copy of the storage. The resulting `.ab` file is an Android Backup archive, which contains files and directories that the device’s backup manager chooses to export, making it a logical extraction.
Exam trap
The CHFI exam often tests the distinction between logical and physical acquisition by presenting a command that looks like it might be low-level (e.g., containing 'backup' or 'all') but is actually a logical method, leading candidates to mistakenly choose physical or file system acquisition.
How to eliminate wrong answers
Option A is wrong because manual acquisition through the device UI involves navigating menus and copying data manually, not using ADB commands. Option B is wrong because physical acquisition via JTAG requires hardware-level access to the device’s JTAG interface to dump raw flash memory, not a software command over USB. Option D is wrong because file system acquisition via `dd` creates a bit-for-bit image of a partition or block device, whereas `adb backup` only extracts logical files and does not capture deleted data or unallocated space.
A forensic investigator examines a hard drive and needs to recover deleted files. Which tool is specifically designed for file carving by scanning raw data for file headers and footers without relying on the file system?
A.Foremost
B.Volatility
C.Autopsy
D.FTK Imager
AnswerA
Foremost is a classic file-carving utility that scans raw byte streams (such as a dd or E01 image) for known file signatures—e.g., JPEG headers 0xFFD8FF, PNG, ZIP—and extracts the intervening data as a reconstructed file. Because it operates directly on unallocated space and does not depend on filesystem metadata (MFT, inodes, directory entries), it can recover deleted files no longer listed in any index. It is driven by a configuration file defining the signatures and can use internal structural hints, such as embedded length fields, to improve recovery accuracy.
Why this answer
Foremost is a file carving tool that scans raw disk data for known file headers and footers (e.g., JPEG, PDF, ZIP) to recover files independently of the file system metadata. This makes it ideal when the file system is damaged or deleted, as it relies solely on content signatures rather than directory structures.
Exam trap
The CHFI exam often tests the distinction between file carving tools (Foremost) and forensic suites (Autopsy, FTK Imager) or memory analysis tools (Volatility), trapping candidates who confuse a tool's primary function with its ancillary features.
How to eliminate wrong answers
Option B (Volatility) is wrong because it is a memory forensics framework for analyzing RAM dumps, not a file carving tool for hard drives. Option C (Autopsy) is wrong because it is a digital forensics platform that relies on file system analysis and does not perform raw file carving by default; it uses tools like Foremost as plugins. Option D (FTK Imager) is wrong because it is primarily a disk imaging and preview tool that preserves file system metadata, not a dedicated file carver that scans raw data for headers and footers.
During a malware analysis, an analyst runs a suspicious executable in a Cuckoo Sandbox and observes that the process creates a mutex named 'Global\XPSS-1.0.0' and writes a registry key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run. What do these actions MOST likely indicate?
A.The malware is performing privilege escalation by exploiting a known vulnerability.
B.The malware is communicating with a command-and-control server to receive further instructions.
C.The malware is attempting to hide its presence by using a system mutex name and a legitimate registry location.
D.The malware is establishing persistence and ensuring only one instance of itself runs.
AnswerD
The Run registry key is a standard persistence mechanism that causes the malware to execute automatically every time the user logs on, ensuring it survives reboots. The named mutex provides a global lock that prevents multiple instances of the malware from running concurrently, which is crucial for avoiding detection through duplicate processes and for maintaining stable infection. Together, these artifacts conclusively indicate the malware's goal of persistent residency and single-instance control.
Why this answer
The mutex 'Global\XPSS-1.0.0' is used to prevent multiple instances of the malware from running simultaneously, which is a common anti-analysis and stability technique. Writing a registry key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run is a standard method for achieving persistence, ensuring the malware executes automatically at user logon. Together, these actions directly indicate persistence and single-instance control, not privilege escalation, C2 communication, or hiding.
Exam trap
EC-Council often tests the distinction between persistence mechanisms and hiding techniques, trapping candidates who confuse a standard persistence location (Run key) with a stealth or concealment method, when hiding typically involves alternate data streams, registry run keys under Policies, or rootkit-level hooks.
How to eliminate wrong answers
Option A is wrong because creating a mutex and writing a Run key are not techniques for privilege escalation; privilege escalation typically involves exploiting vulnerabilities (e.g., via token manipulation or kernel exploits) to gain higher access rights, not mutex or registry operations. Option B is wrong because mutex creation and Run key persistence are local system actions; communication with a command-and-control server would involve network connections (e.g., HTTP, DNS, or IRC traffic) and is not directly indicated by these artifacts. Option C is wrong because the mutex name 'Global\XPSS-1.0.0' is not a standard system mutex (system mutexes often use 'Global\' prefix with well-known names like 'Global\MSCTF.CtfMonitor') and the Run key is a well-known persistence location, not a hiding technique; hiding would involve rootkits, fileless techniques, or stealthy registry locations like HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run.
An investigator needs to capture network traffic from a live network segment without altering the traffic flow. Which technique should they use?
A.Enable NetFlow on the router and capture flows
B.Configure a SPAN port on the switch
C.Deploy an ARP spoofing tool to redirect traffic
D.Set the NIC to promiscuous mode on the forensic workstation
AnswerB
Configuring a SPAN (Switched Port Analyzer) port on the switch copies ingress and egress frames from specified source ports or VLANs to a designated monitor port, where a forensic workstation can record full packets without altering the original traffic path. This non-intrusive mirroring preserves switch performance and avoids introducing latency or dropping frames, making it the standard method for lawful network capture at Layer 2.
Why this answer
A SPAN (Switched Port Analyzer) port, also known as a mirror port, copies all traffic from a specified source port or VLAN to a destination port where the forensic workstation is connected. This allows the investigator to capture traffic without injecting any frames or altering the forwarding behavior of the switch, thus preserving the integrity of the live network segment.
Exam trap
EC-Council often tests the misconception that promiscuous mode alone is sufficient for capturing all traffic on a switched network, but candidates forget that switches isolate traffic per port unless a SPAN port is configured.
How to eliminate wrong answers
Option A is wrong because NetFlow is a flow-based accounting and monitoring technology that exports aggregated flow records (e.g., source/destination IP, ports, protocol) rather than capturing full packet payloads; it cannot provide the raw packet-level data needed for deep forensic analysis. Option C is wrong because ARP spoofing actively sends forged ARP replies to redirect traffic through the attacker's machine, which alters the traffic flow and can cause network disruptions or detection, violating the requirement to not alter the traffic flow. Option D is wrong because setting a NIC to promiscuous mode only allows the workstation to receive all frames on the collision domain of its connected switch port, but on a modern switched network, the switch will not forward traffic destined for other ports to the forensic workstation, so promiscuous mode alone cannot capture traffic from other hosts without additional techniques like ARP spoofing or a SPAN port.
A forensic analyst is examining an Android device that has been factory reset. Which type of data is LEAST likely to be recoverable using forensic tools?
A.Google account tokens stored in AccountManager
B.Encrypted app data from /data/data/
C.System logs in /data/log/
D.Deleted text messages from SQLite files
AnswerB
File-based encryption keys are wiped; data is inaccessible.
Why this answer
After a factory reset, the /data partition is wiped and re-encrypted with a new key. Encrypted app data stored under /data/data/ is protected by file-based encryption (FBE) using a per-user encryption key that is discarded during the reset. Without the original encryption key, forensic tools cannot decrypt this data, making it the least likely to be recoverable.
Exam trap
The CHFI exam often tests the misconception that a factory reset makes all data permanently unrecoverable, but the trap here is that encrypted data is truly irrecoverable due to key destruction, whereas unencrypted or synced data may still be retrieved from residual storage or cloud sources.
How to eliminate wrong answers
Option A is wrong because Google account tokens stored in AccountManager are often synced to Google's servers and may be recoverable from cloud backups or Google's authentication logs, even after a factory reset. Option C is wrong because system logs in /data/log/ are plaintext files that, although overwritten by the reset, may still be partially recoverable using file carving techniques if the blocks have not been overwritten. Option D is wrong because deleted text messages from SQLite files reside in the /data partition, and while the database is wiped, unallocated space may still contain remnants of the deleted records that can be recovered with forensic tools like Cellebrite or Oxygen Forensic Detective.
Which email header field is specifically used to verify that an email was not tampered with during transit and is signed by the sender's domain?
A.X-Originating-IP
B.Message-ID
C.Received
D.DKIM-Signature
AnswerD
DKIM-Signature contains a digital signature computed over selected canonicalized header fields and the message body using a private key held by the sending domain. The verifier retrieves the sender's public key from DNS (e.g., dkim._domainkey.example.com) to decrypt the hash and compare it to the hashed current content, thereby detecting any modification since signing. Because the signature is cryptographically bound to the message content and the signing domain, it specifically provides the required verification of both origin and integrity.
Why this answer
The DKIM-Signature header field is the correct answer because it provides a cryptographic signature that allows the receiver to verify that the email was not altered in transit and that it originated from the claimed domain. DKIM (DomainKeys Identified Mail) uses public-key cryptography, where the sender's domain publishes a public key in DNS, and the sending server signs the email with the corresponding private key. This ensures both integrity and domain-level authentication, directly matching the question's requirement.
Exam trap
A common misconception is that the Received header can verify integrity because it shows the mail path, but it lacks cryptographic signing and can be manipulated by any intermediate server. EC-Council expects you to know that only DKIM provides cryptographic integrity verification tied to the sender's domain.
How to eliminate wrong answers
Option A is wrong because X-Originating-IP is a non-standard header that records the IP address of the original sender's client, but it provides no cryptographic integrity verification or domain-level signing. Option B is wrong because Message-ID is a unique identifier for the email message, used for tracking and threading, but it has no security properties to verify tampering or sender domain authenticity. Option C is wrong because the Received header is added by each mail transfer agent (MTA) along the delivery path to trace the route, but it does not include a cryptographic signature and can be easily forged or modified by intermediate servers.
Which of the following BEST defines the chain of custody in digital forensics?
A.The legal authority required to seize evidence
B.The order in which forensic tools are applied to evidence
C.The physical security measures used to store evidence
D.The chronological documentation of evidence handling, transfer, and analysis
AnswerD
This accurately describes the chain of custody.
Why this answer
The chain of custody is a formal, chronological record that documents every instance of evidence handling, transfer, and analysis from the moment of seizure through its entire lifecycle. This documentation is critical to prove that evidence has not been tampered with, altered, or corrupted, thereby maintaining its admissibility in legal proceedings under rules such as Federal Rule of Evidence 901.
Exam trap
The CHFI exam often tests the distinction between the physical security of evidence (Option C) and the procedural documentation of its handling (Option D), leading candidates to confuse storage controls with the chain of custody itself.
How to eliminate wrong answers
Option A is wrong because legal authority to seize evidence (e.g., a search warrant or subpoena) is a prerequisite for lawful collection, not the ongoing tracking of evidence after seizure. Option B is wrong because the order of forensic tool application (e.g., using FTK Imager before Autopsy) is a procedural workflow choice, not a documentation requirement for evidentiary integrity. Option C is wrong because physical security measures (e.g., locked safes, access logs) are part of evidence storage controls, but they do not constitute the chronological documentation of handling and transfer that defines chain of custody.
A forensic analyst is investigating a Windows system for evidence of USB device usage. Which registry key is MOST useful for determining the first time a USB device was connected and its serial number?
This is the authoritative artifact for USB mass storage device forensics. Each time a USB drive or external storage device is attached, Windows enumerates it under HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR, creating a subkey whose name contains the device instance ID, vendor, product, revision, and often the unique serial number. The LastWrite time of these subkeys reflects when the device was installed/configured, enabling an examiner to reconstruct a timeline of device connections and identify the specific physical drive by its serial number.
Why this answer
The USBSTOR key under HKLM\SYSTEM\CurrentControlSet\Enum stores a subkey for each USB mass storage device that has ever been connected to the system. Each subkey is named with the device's serial number, and its creation timestamp reflects the first time the device was enumerated (i.e., first connected). This makes it the definitive source for both the serial number and the initial connection time of a USB device.
Exam trap
EC-Council often tests whether candidates confuse the generic USB hub enumeration key (USB) with the mass storage device-specific key (USBSTOR), leading them to pick Option D instead of A.
How to eliminate wrong answers
Option B is wrong because MountPoints2 stores user-specific drive letter mappings and volume GUIDs, not serial numbers or first-connection timestamps for USB devices. Option C is wrong because ShellBags tracks folder view settings and window positions for Explorer, not USB device enumeration or serial numbers. Option D is wrong because the USB key under Enum contains generic USB hub and controller descriptors, not the USB mass storage device instances with serial numbers that USBSTOR provides.
Which of the following is a unique challenge in cloud forensics compared to traditional digital forensics?
A.Encryption of data at rest
B.Lack of network connectivity
C.Inability to acquire disk images
D.Multi-tenancy and data isolation
AnswerD
Multi-tenancy is a defining architectural property of cloud computing, where multiple customers share the same physical hardware and storage. This creates a unique forensic challenge: isolating a target tenant's evidence without exposing or processing co-tenant data, which may be subject to privacy and legal protections. Investigators must use careful acquisition methods, such as provider-supported volume snapshots, and may need court orders tailored to prevent data leakage. The co-mingling of data across tenants is a challenge with no direct analog in traditional single-owner digital forensics.
Why this answer
In cloud forensics, multi-tenancy and data isolation present a unique challenge because multiple customers share the same physical infrastructure, and forensic investigators must ensure that data acquisition from one tenant does not inadvertently expose or contaminate another tenant's data. This requires careful coordination with the cloud provider to isolate logical boundaries, often using techniques like snapshot-based acquisition or API-driven evidence collection, which are not typical in traditional single-owner digital forensics.
Exam trap
The EC-Council CHFI exam often tests the misconception that encryption is the primary cloud forensic challenge, but the real unique issue is multi-tenancy and data isolation due to shared infrastructure and legal/privacy boundaries.
How to eliminate wrong answers
Option A is wrong because encryption of data at rest is a challenge in both cloud and traditional forensics; it is not unique to the cloud. Option B is wrong because lack of network connectivity is a general forensic challenge that can occur in any environment, not specific to cloud forensics. Option C is wrong because inability to acquire disk images is not a defining challenge; cloud forensics can acquire disk images via provider APIs or snapshots, though the process differs from physical acquisition.
An investigator needs to recover deleted files from a USB drive formatted with FAT32. Which of the following techniques would be most effective, assuming the files have not been overwritten?
A.Check the journal for recent changes
B.Examine the FAT for unallocated clusters and reconstruct files
C.Analyze the $MFT for orphaned entries
D.Use the 'foremost' tool to carve based on file signatures
AnswerB
Correct. FAT32's File Allocation Table stores cluster chains. Deleted files have their FAT entries zeroed but data clusters remain. Examining the FAT for unallocated clusters and reconstructing from the directory entry's starting cluster and size allows recovery if not overwritten.
Why this answer
FAT32 does not have a journal (eliminating A). The Master File Table ($MFT) is used by NTFS, not FAT32 (eliminating C). While file carving with tools like 'foremost' (D) can recover files based on signatures, it is less effective for deleted files on FAT32 because it may fail to recover fragmented files and does not leverage the file system's own structure.
The most effective technique is to examine the File Allocation Table (FAT) for unallocated clusters and reconstruct the files from the directory entry's starting cluster and size (B), assuming the clusters have not been overwritten. This uses the file system metadata to directly locate the file's data.
Exam trap
A common trap is to assume that file carving (D) is always the best method. However, when the file system is intact and the metadata is available, analyzing the FAT provides a more reliable and efficient recovery. Also, note that FAT32 lacks a journal (A) and does not use $MFT (C).
How to eliminate wrong answers
Option A is wrong because FAT32 does not have a journal; journaling is a feature of NTFS (via $LogFile) and ext3/4, not FAT32. Option C is wrong because the $MFT (Master File Table) is a component of NTFS, not FAT32; FAT32 uses directory entries and the FAT, not an MFT. Option D is wrong because while 'foremost' is a valid file carving tool that works on any file system by searching for file signatures (headers/footers), it is a generic data carving technique that does not leverage the file system's metadata (like the FAT) to reconstruct files; it is less reliable for fragmented files and does not use the FAT's cluster chain information, making it less effective than option B for FAT32 recovery.
Which THREE of the following are types of slack space that can contain hidden data on a hard disk?
Select 3 answers
A.Device Configuration Overlay
B.Host Protected Area
C.File slack
D.Volume slack
E.RAM slack
AnswersC, D, E
File slack is the unused space between the end of a file and the end of the last cluster.
Why this answer
File slack (C) is correct because it refers to the unused space between the end of a file's data and the end of the allocated cluster. This area can contain remnants of previous file data or intentionally hidden data, and is a standard forensic artifact in file system analysis (e.g., NTFS or FAT).
Exam trap
The EC-Council CHFI exam often tests the distinction between hidden disk areas (like HPA and DCO) and true slack space types (file, volume, RAM slack), causing candidates to mistakenly classify HPA or DCO as slack space.