Computer Hacking Forensic Investigator CHFI (CHFI) — Questions 751–825

The ARP table exhibit shows a single IP address (192.168.1.1) mapped to two different MAC addresses (00:11:22:33:44:55 and AA:BB:CC:DD:EE:FF). This is a classic indicator of an ARP poisoning attack, where an attacker sends forged ARP replies to associate their MAC address with the gateway's IP, enabling man-in-the-middle interception of traffic.

dcfldd is a modified version of dd that includes built-in hashing (e.g., MD5, SHA-1, SHA-256) during the imaging process, allowing the analyst to verify data integrity in real time without a separate hashing step. This makes it the most appropriate tool for creating a forensic image that also hashes the data during acquisition.

Direct and circumstantial evidence are two main categories. Hearsay and best evidence are rules, not types.

DCO is a region beyond the HPA that can hide data; its presence suggests possible data hiding.

A TCP SYN packet has SYN=1 and ACK=0. The Wireshark display filter 'tcp.flags.syn == 1 and tcp.flags.ack == 0' precisely matches this condition.

The UserAssist key tracks applications launched via the Windows shell (Start Menu, Run, etc.). The data is Rot‑13 encoded to obscure the count and last execution time.

Plaso (log2timeline) is a tool that parses various log files and artifacts to create a super timeline for forensic analysis.

Option A (Examination) is correct because it is a core phase in the digital forensics process where investigators identify and extract potential evidence from collected data without altering it. This step involves techniques such as hashing (e.g., SHA-256) to verify integrity and using tools like FTK Imager or EnCase to preview files, ensuring the evidence is preserved in a forensically sound manner. Without examination, the raw collected data cannot be systematically reviewed for relevant artifacts.

When a file is moved to the Recycle Bin on Windows 10, the original file data is not stored in the Recycle Bin itself; instead, a hidden file (with a random name) is created in the `$Recycle.Bin` folder on the volume, and a shortcut (the visible entry) is placed in the Recycle Bin. The shortcut points to the hidden file, which retains the original data. Since the visible entry is only 1 KB, the actual file content must be located in the `$Recycle.Bin` folder under a different name, making option A the correct next step.

Volatility's netscan and netstat plugins list network connections from memory.

Physical acquisition is the correct choice because it creates a bit-for-bit copy of the entire flash storage, including the operating system, user data, and deleted file remnants, without relying on the iOS operating system to be unlocked or cooperative. This method bypasses the lock screen by exploiting hardware or software vulnerabilities (e.g., checkm8 bootrom exploit) or using advanced forensic tools (e.g., Cellebrite, GrayKey) to read the raw NAND memory, ensuring maximum data extraction while maintaining forensic integrity.

The log entry shows a UNION SELECT statement appended to the id parameter, which is a classic SQL injection attempt.

LNK files are shortcuts that contain metadata including target path, creation time, and sometimes volume information, indicating user activity.

FTK Imager natively supports the EnCase image format (.E01), which is the most appropriate choice because it maintains evidence integrity through embedded CRC32 and MD5/SHA-1 hash verification while also supporting optional compression. Unlike raw/DD images, .E01 files can be segmented and compressed without losing forensic integrity, making them ideal for both storage efficiency and court-admissible evidence.

Option D is correct because the laptop was shut down properly and handed over within an hour, meaning the TPM (Trusted Platform Module) still holds the BitLocker key in its secure storage. When the system boots normally, BitLocker will automatically unlock the drive using the TPM without requiring a recovery key or user PIN, as long as the boot configuration has not changed. This is the standard behavior for a TPM-only protector configuration, which is common in corporate Windows 10 deployments.

These artifacts store email data in different formats.

Memory acquisition requires booting from trusted media, running tool as admin, and verifying hash.

Sparse files in NTFS have a logical size larger than the allocated disk space. The file may appear as zero bytes but occupy slack space due to allocation.

These paths are standard for Windows 10/11.

HPA, ADS, and slack space are well-known data hiding techniques.

Chrome history is in SQLite database files; Edge uses WebCacheV01.dat; Firefox uses places.sqlite.

Circumstantial evidence is a recognized form of evidence under the rules of evidence because it allows a fact-finder to infer a fact from other established facts, even without direct witness testimony. In digital forensics, this is critical when reconstructing user activity from log files, file metadata, or network traffic patterns that indirectly prove an action occurred.

Physical acquisition (A) creates a bit-for-bit copy of the entire flash storage, including unallocated space where deleted text messages (stored in SQLite WAL/SHM/journal files) often reside. Since the iPhone has no passcode, the forensic tool can bypass the lock screen and access the raw NAND, allowing recovery of deleted records that logical or file-system methods cannot reach because they only copy allocated files.

FTK Imager can capture a memory dump (RAM) from a live system, preserving volatile data for analysis.

This PHP code executes system commands passed via the 'cmd' GET parameter. This is a classic webshell, allowing remote command execution.

Foremost is a file carving tool that uses headers and footers to recover files. It is widely used for data recovery from FAT, NTFS, and other file systems.

The `hashwindow=1G` option in `dcfldd` computes a SHA-256 hash for every 1 GB segment of the input data, rather than a single hash for the entire image. This allows the analyst to verify the integrity of each segment independently, so if a hash mismatch occurs during later verification, the exact 1 GB block containing the error can be identified and reacquired without reimaging the entire drive.

The registry key 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' is a standard Windows autorun location. Malware writing to this key ensures that its executable is launched automatically every time the system boots, which is a classic persistence mechanism. Process Monitor capturing repeated writes confirms the malware is actively establishing this startup persistence.

DNS tunneling encodes data in DNS queries to exfiltrate information, often using base64 in subdomains.

This pattern indicates a successful brute-force attack where the attacker guessed the password and then logged in successfully. Event ID 4625 indicates failed logon attempts, and Event ID 4624 indicates a successful logon.

In iOS, call history data is stored in the 'call_history.db' SQLite database, and the primary table containing call duration and timestamps is named 'call'. The 'call' table includes columns such as 'duration' (in seconds) and 'date' (as a Cocoa Core Data timestamp). This is the standard schema used by Apple's Phone app since iOS 4.

PEiD is a static analysis tool that identifies packers, cryptors, and compilers embedded in Portable Executable (PE) files by scanning for known signatures in the file's entry point and section headers. This helps an analyst understand whether the malware is packed (obfuscated) and what tool was used to create or compress it, which is critical before attempting dynamic analysis or unpacking.

The shared responsibility model means the cloud provider controls the infrastructure, limiting the investigator's ability to acquire volatile data without provider support.

Locard's exchange principle states that every contact leaves a trace. In digital forensics, this means the suspect's interaction with the computer—such as typing, accessing files, or connecting peripherals—will leave unique digital artifacts (e.g., registry keys, prefetch files, USB device serial numbers, or browser history). By demonstrating that these artifacts could only have been created by the suspect's specific actions or device, the investigator refutes the claim of planting.

Under Section 78 of PACE, the court has discretion to exclude prosecution evidence if its admission would have such an adverse effect on the fairness of the proceedings that it ought not to be admitted. Since the computer was seized without a warrant, the court must weigh the potential breach of PACE safeguards against the probative value of the digital evidence. This is not automatic exclusion, but a judicial balancing test specific to the circumstances of the seizure.

Successful uploads of aspx or php files that contain web shell code (e.g., with cmd parameter) and subsequent access to those files are strong indicators. The 404 for cmd.exe indicates a path traversal attempt, not a web shell.

Current network connections (A) are volatile because they show active communication channels that could indicate data exfiltration in progress. If the system is shut down or disconnected, this evidence is lost immediately, making it a top priority for collection during initial response.

Chain of custody documentation is the most critical action for evidence admissibility because it establishes a verifiable record of who handled the evidence, when, and under what conditions, ensuring the evidence has not been tampered with. Without a proper chain of custody, even technically sound evidence can be ruled inadmissible under rules like Federal Rule of Evidence 901. In forensic practice, this involves logging every access with timestamps, digital signatures, and hash values (e.g., SHA-256) to maintain integrity.

Containers are ephemeral (volatile evidence), they share the host kernel (limited isolation), and they rely on layered images that must be analyzed. Standard disk imaging tools may not work; network isolation is not a specific challenge.

The request attempts to execute a command (id) via a PHP file in the uploads directory, indicating a webshell. Webshells allow attackers to execute commands on the server.

The Run key under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run is a common persistence mechanism that starts programs when the user logs on.

MBR uses 32-bit entries and supports up to 4 primary partitions and disks up to 2 TB. GPT uses 64-bit entries, supports up to 128 partitions, and disks larger than 2 TB, with backup partition table for redundancy.

Option A is correct because the Fourth Amendment generally requires a warrant for searches, but an exception exists when the owner of the device voluntarily consents to the search. In digital forensics, consent must be knowing, intelligent, and voluntary, and it can be revoked at any time. This exception is commonly applied when a suspect agrees to a forensic examination of their computer or mobile device without a court order.

UID 0 is the root user. Changing a user's UID to 0 grants that user root privileges, providing privileged access.

Cron jobs in /etc/cron.daily are scheduled tasks that run daily. Malicious scripts placed there provide persistence by re-executing at regular intervals.

Static malware analysis involves examining the malware's code (e.g., disassembly, strings, headers) without executing it, while dynamic analysis runs the sample in a controlled environment (e.g., sandbox, debugger) to observe its runtime behavior. Option C correctly captures this fundamental distinction: static analysis is code-centric and non-executional, whereas dynamic analysis is behavior-centric and executional.

Timestomping is an anti-forensics technique that deliberately modifies file timestamps (e.g., MAC times: Modified, Accessed, Created) using tools like `touch` on Linux or `SetFileTime` on Windows. By altering these timestamps, an attacker can hide the true timeline of malicious file creation, modification, or access, thereby evading forensic timeline analysis and making it appear that malicious activity occurred at a different time or was part of legitimate system operations.

Option C is correct because a factory reset typically does not overwrite the flash memory where Google account tokens and cached credentials are stored. Advanced forensic techniques, such as chip-off or JTAG, can recover these remnants from the NAND flash memory, as the reset only marks the storage blocks as available for reuse without physically erasing the data.

Event ID 7045 is logged in the System event log when a service is installed on a Windows system.

The MFT is a relational database containing one or more records for each file and directory on the volume, storing metadata such as timestamps, permissions, and data runs.

The registry key indicates persistence. The analyst should document it as an IoC, delete the key to remove persistence, and examine other common persistence locations. Running a full system scan may be helpful but is less specific; contacting law enforcement is premature unless required.

When a write-blocker is powered on after the suspect drive is already connected, the drive may have already been enumerated by the operating system as a writable device. Write-blockers rely on intercepting and filtering ATA/SCSI commands at the hardware level before the OS sees the drive; if the drive is connected first, the OS may have already sent write commands or cached write attributes, bypassing the blocker's protection. This is why the proper sequence is to power on the write-blocker first, then connect the suspect drive.

/var/log/auth.log records authentication attempts (login, sudo, SSH). /var/log/syslog contains general system logs including some auth messages. /var/log/kern.log is for kernel messages, /var/log/boot.log for boot, and /var/log/dmesg for kernel ring buffer.

The `netscan` plugin in Volatility scans memory for network connections (TCP and UDP) and listening ports, including those from hidden or terminated processes.

Forensic tools like EnCase or FTK can reconstruct RAID arrays if the parameters (stripe size, parity order) are known. Manual reconstruction using dd and parity calculations is possible but error-prone.

WinPmem is a memory acquisition tool for Windows that supports capturing RAM. It is widely used in forensics. LiME is for Linux, FTK Imager can acquire disk images but not RAM.

Prefetch files contain metadata about application execution including the full path to the executable, run count, and last run time. They can also list DLLs loaded. The run count and last run time are useful for forensic timeline.

Cuckoo Sandbox is an open-source automated malware analysis system designed specifically for dynamic analysis. It executes suspicious files in a controlled, isolated environment (a virtual machine) and monitors their behavior, including system calls, file system changes, registry modifications, and network traffic, to produce a comprehensive report without risking the host system.

Option B is correct because capturing active network connections (e.g., using `netstat -anob` or `netstat -ano`) retrieves volatile data that is lost when the system is powered off. This data includes current TCP/UDP connections, listening ports, and associated process IDs, which are critical for identifying active network threats or unauthorized communications during incident response.

Cloud Audit Logs record API calls and resource changes, while Cloud Asset Inventory tracks resource history and configuration changes.

/etc/passwd stores user account details. /etc/shadow stores password hashes.

On iOS 11, a locked device prevents physical and file system acquisitions due to hardware encryption and the Secure Enclave. Logical acquisition via iTunes backup is the recommended method because it can extract most user data (contacts, messages, photos) without requiring the passcode to be bypassed, as the backup process is authorized by the device's trust relationship with a previously paired computer.

Option D is correct because the first priority at a live crime scene is to preserve the state of the system and its environment through documentation. Photographing the screen and surroundings captures volatile data (e.g., open documents, running processes, network connections) before any interaction alters the system. This aligns with the order of volatility and the principle of minimizing changes to the evidence.

log2timeline (and Plaso) is a toolset for creating super timelines from various forensic artifacts.

Autopsy (Sleuth Kit) can list alternate data streams when viewing file metadata. The `istat` command in TSK also shows ADS, but Autopsy is a common GUI tool.

Web shells are often uploaded as scripts and generate unusual HTTP requests; logs will show these patterns.

Cron jobs in /etc/cron.d are system-wide scheduled tasks. This entry runs a script every minute as root, providing persistence.

GCP audit logs include the principal email (authenticationInfo), operation type (methodName), and resource name (resourceName). IP address and user agent may be in requestMetadata but not always in every log entry.

Option B is correct because the first step in responding to a litigation hold is to immediately preserve all potentially relevant data, including backups and archives, and suspend any automatic deletion or rotation policies. This ensures that no spoliation of evidence occurs, which could lead to legal sanctions. The preservation order must be broad to cover all data that might be relevant, as determining exact relevance comes later in the e-discovery process.

Hearsay evidence is defined as a statement made outside of court that is presented to prove the truth of the matter asserted. In digital forensics, this applies when a witness testifies about what another person said regarding an event, rather than recounting their own direct observation. The CHFI exam categorizes this under evidence types because it is not based on the witness's firsthand knowledge, making it generally inadmissible unless an exception applies.

$MFT is a key component of NTFS, storing metadata about files and directories.

Option C is correct because metadata, such as file system timestamps (e.g., $STANDARD_INFORMATION and $FILE_NAME attributes in NTFS), provides indirect evidence that a file was created during the incident timeframe. This does not directly prove the suspect's actions but supports an inference of involvement, which is the hallmark of circumstantial evidence.

These methods hide data in different file types.

SSDs use flash memory and have features like TRIM, wear leveling, and garbage collection that can destroy or relocate data, making recovery difficult. These are distinct from HDD behavior.