Computer Hacking Forensic Investigator CHFI (CHFI) — Questions 676–750

A POST request to an ASPX file in an uploads directory returning 200 with a small response size and user-agent is suspicious.

Option D is correct because the netstat output shows a listening connection on port 4444 associated with PID 1500, which the tasklist command identifies as rundll32.exe. Port 4444 is a common backdoor port (often used by Metasploit or other RATs), and rundll32.exe is a legitimate Windows binary frequently abused by malware to host malicious code (e.g., via DLL sideloading or reflective injection). The combination of an unusual listening port and a process that is not a typical network service (like svchost.exe) strongly indicates a backdoor.

In CloudTrail, when an EC2 instance assumes a role, the session name is often the instance ID. The 'i-' prefix and alphanumeric string indicate an EC2 instance ID.

Injecting code into explorer.exe (option A) is a persistence mechanism because the injected code runs within the context of a trusted system process that starts automatically at user logon. By hijacking explorer.exe, the malware ensures its malicious code executes every time the user logs into the system, surviving a reboot without needing a separate startup entry.

The Run key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run is a common persistence location; it runs the specified program when the user logs in.

The bash_history file in the user's home directory (e.g., /home/username/.bash_history) records commands entered by the user in bash. Note that history may not be complete if the user opened multiple sessions or the file was cleared.

The userIdentity field contains details about the identity that made the request, including ARN, user name, and type (IAM user, role, etc.).

The packages.xml file in /data/system/ records all installed packages, including third-party apps, their permissions, and installation metadata. The /data/data/ directory contains per-package subdirectories with application-specific data, confirming actual usage and stored data. Together, these two artefacts provide definitive evidence of which third-party apps were installed and used on the device.

The `conv=noerror,sync` option in the `dd` command instructs the tool to continue processing when a read error is encountered (`noerror`) and to pad the output block with zeros (`sync`) to maintain the same total size as the original drive. This ensures that the forensic image remains a bit-for-bit copy in terms of size, even if physical sectors are unreadable, preserving the integrity of the acquisition process for analysis.

A legal hold suspends normal document deletion and preservation policies to ensure that relevant electronically stored information (ESI) is retained for potential litigation or investigation.

Plaso includes many parsers (WinReg, Windows Event Log, etc.) but the SAM registry hive (user accounts) is not parsed by default for timeline entries; it requires a specific parser and is not included in the 'all' set.

FTK Imager is specifically designed for live memory acquisition on Windows systems, capturing RAM contents via a kernel-level driver (e.g., win32dd or FTK Imager's own memory capture module) that reads physical memory without modifying the system state. It creates a forensic image (e.g., .mem or .raw) while maintaining data integrity through hashing (MD5/SHA1). This makes it the correct choice for acquiring RAM from a live system without altering evidence.

Option C is correct because if a computer is actively running a data wiping program (e.g., a tool that overwrites storage sectors with zeros or random data), leaving it powered on will cause the irreversible destruction of potential evidence. A first responder must immediately cut power to halt the wiping process and preserve the remaining data, as volatile memory (RAM) is not the primary concern in this scenario—the non-volatile storage is being actively sanitized.

The Run key is a common persistence mechanism that executes programs at user logon. A PowerShell command here could execute malicious code each time the user logs in.

WinPmem and FTK Imager are both capable of acquiring RAM on Windows systems. LiME is for Linux.

The presence of a registry key reference to `SOFTWARE\Microsoft\Windows\CurrentVersion\Run` indicates the malware is configured to launch automatically at system startup, establishing persistence. The embedded URL `http://evil.com/beacon` suggests the malware will make outbound HTTP requests to a remote command-and-control (C2) server for beaconing or data exfiltration. Together, these artifacts confirm persistence and remote communication, making option C correct.

The /etc/shadow file stores password hashes (in modern Linux systems). It is readable only by root.

Locard's principle states that every contact leaves a trace. In digital forensics, this means that when a suspect interacts with a system, digital traces (e.g., logs, files) are left behind.

The MBR (Master Boot Record) uses a 512-byte sector at LBA 0, with the first 446 bytes for boot code, a 64-byte partition table (4 entries of 16 bytes each), and a 2-byte signature (0x55AA). This description matches MBR exactly.

Option A is correct because SHA-256 is a cryptographic hash function that produces a unique 256-bit digest. By computing the SHA-256 hash of the acquired image and comparing it to the hash computed from the original drive, the examiner can verify bit-for-bit integrity with extremely high collision resistance, ensuring the image is an exact duplicate.

The Google account artefacts, including the last sync timestamp and cached email addresses, are stored within the package 'com.google.android.gms' (Google Play Services). This package manages authentication tokens, sync settings, and account metadata in its databases (e.g., 'accounts.db' or 'gms_credentials.db') under /data/data/com.google.android.gms/databases/. The last sync timestamp is typically recorded in the 'sync_state' table, while cached email addresses appear in the 'accounts' table.

LNK (shortcut) files store metadata including creation/modification timestamps, target path, volume serial, and network share information, but they do not include the username of the user who accessed it.

.pst files contain emails, attachments, calendars, contacts, and other mailbox items for offline access. Aid4Mail can parse these files for forensic analysis.

Under the Fourth Amendment, a warrant is generally required for searches and seizures, but one well-established exception is voluntary consent. When a suspect freely and knowingly agrees to a search of their computer or digital device, law enforcement may proceed without a warrant, provided the consent is not coerced and the scope of the search is not exceeded. This principle applies regardless of whether the data is stored locally or remotely, as long as the consenting party has actual or apparent authority over the device or data.

SHA-256 is the correct answer because it is a widely adopted cryptographic hash function in forensic imaging tools (e.g., FTK Imager, EnCase) to verify evidence integrity. It produces a 256-bit (32-byte) hash value and is considered collision-resistant, making it significantly more secure than MD5, which has known collision vulnerabilities.

LNK files are created when a file is accessed through certain methods; if the LNK creation time is after execution, it may have been created manually or by malware to hide evidence.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and HKCU\Software\Microsoft\Windows\CurrentVersion\Run are standard auto-start locations for all users and current user respectively. RunOnce keys execute once and are also used. But the most common are Run keys.

'docker history' shows the build commands and layers, which helps identify suspicious steps. 'docker export' exports the container filesystem but not layers individually. 'docker save' saves the image as a tar, allowing layer extraction. 'docker inspect' shows metadata only. 'docker images' lists images.

Event ID 4625 indicates failed logon attempts, and a series of these followed by a success (4624) is characteristic of a brute-force or password spraying attack where the attacker eventually guesses the correct password.

The creation of a Run key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run is a classic persistence mechanism that causes the executable to launch automatically at user logon. Dropping a file named 'svchost.exe' in %AppData% is a common masquerading technique, as the legitimate svchost.exe (Service Host) resides in C:\Windows\System32, not in the user's AppData folder. Together, these actions indicate the executable is establishing persistence and disguising itself as a trusted system process.

Aid4Mail is a commercial forensic tool that can extract emails and metadata from PST, OST, MBOX, and other formats. EmailTracker is primarily for tracking email delivery, not forensic analysis of client files.

The URL-encoded payload contains SQL injection syntax (%27 is a single quote), attempting to inject an OR condition. This is indicative of a SQL injection attempt.

AWS CloudTrail records all API calls made to the AWS environment, including IAM user creation. It provides details like the source IP, user identity, and the specific API action.

Port 4444 is commonly used by reverse shells (e.g., Metasploit default) and indicates a potential command and control session.

Option A is correct because the ransom note (README.txt) is a primary source of ransomware identifiers such as Bitcoin wallet addresses, contact emails, or Tor payment site URLs. Extracting these IOCs from the note allows you to quickly cross-reference known ransomware families (e.g., Ryuk, Maze, LockBit) via threat intelligence feeds, which is the most efficient first step in malware forensics before deeper analysis.

Executable heap is a sign of code injection; malware may allocate memory with execute permissions and inject shellcode.

Code injection is the correct answer because the scenario describes a process injecting arbitrary code into a legitimate system process like explorer.exe. This is the generic term for techniques where malicious code is written into the address space of another process and executed, often via Windows API calls such as WriteProcessMemory and CreateRemoteThread. The question explicitly states 'injecting code,' which directly maps to the broad category of code injection, not a specific subtype.

Option C is correct because the sandbox lacked network connectivity, which prevented the malware from reaching its command-and-control (C2) server. Many malware samples, especially those using HTTP or raw TCP for C2, will remain dormant or exhibit no malicious behavior when they cannot connect to the external IP. By providing simulated or controlled network connectivity, you can trigger the malicious payload and observe the actual C2 communication, confirming the file's intent.

Autopsy's 'File Recovery by Type' module (also known as 'PhotoRec Carver' or 'File Carving') can recover files based on their headers/footers, such as JPEG magic bytes.

EnCase Forensic can image the entire disk including HPA and DCO, and is commonly used to detect hidden areas.

To confirm execution, the investigator should examine the server's process history or audit logs (e.g., auditd, bash history) to see if the cmd parameter was processed by the PHP interpreter.

Option D is correct because the chain of custody is fundamentally a legal and procedural requirement to demonstrate the integrity and admissibility of digital evidence. CHFI guidelines emphasize that every transfer of evidence must be meticulously documented with signatures, timestamps, and purpose to create an unbroken audit trail, which is the only practice that directly satisfies the legal standard for evidence handling.

Native Windows commands can list ADS: 'dir /r' shows alternate streams. Streams.exe from Sysinternals also lists streams. FTK and EnCase have built-in ADS detection.

Locard's exchange principle states that when a person interacts with a scene, they leave something behind and take something with them. In digital forensics, this means that an attacker will leave traces of their activity on the system (e.g., logs, malware) and may also remove evidence.

The root user credentials were likely compromised because the CloudTrail log for the bucket policy change at 01:55 UTC shows no MFA usage, despite MFA being enforced for all users including root. This indicates the attacker used stolen root access keys or password without the MFA token, which is a common attack vector when credentials are phished or leaked. The subsequent GetObject requests from a foreign IP and outbound VPC Flow Logs confirm the exfiltration path.

Entries to /cgi-bin/test.cgi with both GET and POST suggest probing and command execution via CGI. The others are normal traffic.

Option C is correct because hardware write blockers operate at the physical layer of the OSI model, intercepting SATA/IDE/PATA commands before they reach the operating system. This makes them completely OS-independent, so they work identically on Windows, Linux, or macOS without requiring any kernel-mode drivers or OS-specific configurations. In contrast, software write blockers rely on the OS storage stack and can be affected by OS-level bugs or driver conflicts.

Repeated failed SSH login attempts for the root user from a single IP address is a classic sign of a brute force attack against SSH.

Option C is correct because if a system is actively running a data wiping program (e.g., a tool that overwrites sectors with zeros or random data per the Gutmann method or DoD 5220.22-M standard), immediate power-off is the only way to halt the destruction of evidence before it becomes unrecoverable. Pulling the power cord (hard shutdown) stops the wiping process in its tracks, preserving any data that has not yet been overwritten.

The error message from e2fsck indicates that the filesystem has inconsistencies, which typically occur when a volume is imaged while it is still mounted and actively being written to. The analyst likely did not dismount the source volume before acquiring the forensic image, resulting in a snapshot that reflects an inconsistent state (e.g., dirty journal, unflushed writes). This is a common chain-of-custody and acquisition procedure error in forensic imaging.

Web server access logs record every HTTP request made to the server, including the URI, method, user-agent, and response status. When a webshell is accessed, commands are typically passed via GET or POST parameters in the request URL or body, so the access log will contain the exact command strings executed. This makes it the most direct artifact for reconstructing attacker actions.

Option D is correct because the first priority at a live crime scene is to preserve the state of the evidence through proper documentation and photography. This ensures an accurate record of the computer's condition, including screen contents, peripheral connections, and environmental context, before any volatile data is lost or altered. The CHFI methodology emphasizes that documentation precedes any seizure or data acquisition steps to maintain chain of custody and evidentiary integrity.

The `stat` command in Linux displays detailed inode metadata including permissions, timestamps, and block locations.

Recomputing the hashes on the image and comparing them to the original hashes ensures that the image matches the source exactly, proving integrity.

Option B is correct because /data/data/ is the primary directory on Android devices where installed applications store their private data, including databases, shared preferences, and cache files. This directory is accessible through logical acquisition (e.g., ADB backup) and contains app-specific evidence such as user credentials, chat logs, and configuration files.

Deleted items in PST files are often recoverable until overwritten; carving can recover remnants.

The xp_readerrorlog extended stored procedure reads the SQL Server error log, which records all login attempts, including failures. By filtering for 'Login failed', the investigator can retrieve the exact entries where authentication failed due to incorrect passwords. This is the standard method for auditing failed logins in SQL Server.

HPA is a reserved area on the drive that is not normally accessible by the OS, often used by manufacturers for diagnostics or by investigators to hide data.

Event ID 4625 indicates a failed logon attempt. Multiple such events for the same user in a short period strongly suggest a brute-force password guessing attack.

NTUSER.DAT.LOG1 is a transaction log file used to ensure registry consistency in case of a crash. It records changes before they are committed.

D is correct because DNS exfiltration involves encoding stolen data into DNS query fields (e.g., subdomains or TXT records) and sending them to a malicious server. Wireshark captures and analyzes raw network packets, allowing the analyst to inspect DNS query payloads for anomalous patterns such as unusually long hostnames, high query volume, or queries to suspicious domains, which are hallmarks of DNS tunneling.

GrayKey is a specialized hardware tool designed by Grayshift that performs physical extraction of iOS devices, including bypassing the lock screen on certain models (e.g., iPhone 5 through iPhone X) by exploiting bootrom vulnerabilities or using brute-force techniques. It is widely used in law enforcement for forensic acquisition of iOS devices where logical extraction is insufficient.

Web shells often allow attackers to execute commands, resulting in atypical HTTP requests with system commands, processes like cmd.exe or /bin/bash, and file modifications. Normal web activity does not include these.

Unified logging in macOS contains a chronological log of system events including application launches, file accesses, and network connections. It can be queried with `log show`.

Web server access logs (e.g., Apache access.log) record HTTP requests, including file uploads to the server, which can show the source IP and the method used to upload the webshell.

MySQL binary logs record all changes to the database, including DELETE statements. The mysqlbinlog utility can parse these logs to reconstruct the exact DELETE operations, allowing the analyst to reverse-engineer the deleted rows by extracting the row data from the log events. This is the standard forensic method for recovering deleted data when binary logging is enabled.

Prefetch files and UserAssist registry keys are both used to track program execution. Prefetch stores execution count and timestamps; UserAssist logs programs launched from the Start Menu or desktop.

TRIM causes data erasure, and wear leveling makes data location unpredictable. The other options apply to both HDD and SSD.

The SQL statement reveals what data was retrieved, and the timestamp helps establish the timeline.

GrayKey is specifically designed for advanced iOS extractions, leveraging a combination of hardware and software exploits to bypass the lock screen on many iPhone models, including recent ones. Unlike general-purpose forensic tools, GrayKey focuses exclusively on iOS and uses techniques like checkm8 bootrom exploit or brute-force attacks via USB to gain access to encrypted device data.

Option C is correct because the connection from a high ephemeral port (49153) to an external IP (203.0.113.50) over HTTPS (port 443) with a short-lived TIME_WAIT state is a classic indicator of potential C2 beaconing. C2 communications often use HTTPS to blend with legitimate traffic, and the TIME_WAIT state suggests brief, periodic connections typical of beaconing, rather than sustained data transfer. The external IP is also in a documentation/test range (203.0.113.0/24), which is commonly used for examples but in a real scenario would be suspicious as an unknown external destination.