Computer Hacking Forensic Investigator CHFI (CHFI) — Questions 901–975

When a container is stopped, its process state and other in-memory data are lost. The best first step is to create a forensic image of the container's filesystem layers, which are still available on the host. Docker containers' filesystems are stored as layers on the host, accessible via docker export or by copying the container's filesystem from /var/lib/docker/overlay2/.

Option B is correct because the `hash=sha256` parameter in `dcfldd` instructs the tool to compute a SHA-256 hash of the input device (`/dev/sda`) during the acquisition process. This hash is then logged to the file specified by `hashlog=hash.txt`, providing a verifiable integrity check that the forensic image matches the original source. This is a standard forensic practice to ensure the image has not been altered or corrupted.

Option A is correct because evidence must be relevant to the case and obtained through lawful means. In digital forensics, this aligns with the legal principle of relevance under the Federal Rules of Evidence (FRE 401) and the requirement that evidence be obtained via a lawful search warrant or consent, otherwise it may be suppressed under the exclusionary rule (e.g., Fourth Amendment violations).

Run keys (e.g., HKCU\Software\Microsoft\Windows\CurrentVersion\Run) specify programs to run at user logon.

Option B is correct because the Python script located in /tmp/.payload.py (PID 1310) is a hidden file in a temporary directory, which is a common technique for storing malicious payloads. The command 'python /tmp/.payload.py' indicates execution of an arbitrary script, often used for reverse shells, data exfiltration, or persistence mechanisms, making it the most suspicious process in an incident response context.

On a non-rooted Android device, the /data/data/ directory contains application-specific data, including SQLite databases and Shared Preferences XML files. These are typical artefacts because apps store structured data (e.g., user credentials, chat logs) in SQLite databases and configuration settings in Shared Preferences XML files. A physical acquisition with full file system access can recover these files even without root, as the acquisition method bypasses normal permission restrictions.

Discrepancies in the Received headers, especially IP mismatches, are a classic sign of email spoofing where the origin is forged.

The creation of a file named 'svchost.exe' in the user's AppData\Roaming directory is a classic persistence technique. By placing a copy of itself with the name of a legitimate Windows system process (svchost.exe) in a user-writable location, the malware aims to execute automatically at startup (e.g., via a registry Run key or scheduled task) while evading suspicion. This is not a legitimate Windows update, as system files reside in C:\Windows\System32, not in a user profile directory.

The audit log (auditLog) is the correct source because it is specifically designed to record user authentication and database operations, including which user executed a write operation. MongoDB's audit system captures detailed events such as insert, update, and delete commands along with the authenticated user identity, making it the definitive forensic artifact for user attribution.

B is correct because a matching MD5 hash between the image and the original drive confirms that the forensic image is an exact bit-for-bit copy. Hashing algorithms like MD5 produce a unique fixed-size hash value based on the binary content; if two hashes match, the data is identical with no alterations. This validates the integrity of the acquisition process, ensuring that the image is a perfect forensic duplicate.

FSEvents records file system changes including file access and execution on macOS, providing a timeline of user activity.

Polymorphic code (C) is correct because it mutates its decryption loop with each infection while preserving the original malicious payload, generating functionally equivalent but bytewise different code. This signature mutation evades signature-based antivirus detection by ensuring no static byte sequence remains constant across samples. Encryption with a variable key (E) is correct because it changes the decryption key per sample, producing different ciphertext each time and thus defeating signature matching on the encrypted payload.

C is correct because NTFS supports Alternate Data Streams (ADS), a feature that allows multiple data streams to be associated with a single file. The 'hidden.txt' stream attached to 'notes.txt' is a classic example of ADS, which can be used to hide data or store metadata without affecting the file's primary content.

Isolating the VM, exporting the Activity Log, and checking for data backups are critical steps to preserve evidence.

Option A is correct because cloud forensic investigations often involve data stored across multiple geographic regions, each with its own data protection laws (e.g., GDPR, CLOUD Act). This creates jurisdictional conflicts regarding lawful access, data privacy, and chain of custody, which are not present in traditional on-premises forensics.

The Fourth Amendment protects against unreasonable searches and seizures, requiring law enforcement to obtain a warrant based on probable cause before searching or seizing digital devices. This directly governs the legality of accessing data on computers, smartphones, and storage media in forensic investigations.

Event ID 4625 indicates a failed logon attempt. Multiple failures in a short time suggest a brute-force attack against the user account.

The FAT contains entries for each cluster, indicating whether a cluster is free, bad, or part of a file chain. The directory entry points to the first cluster, and the FAT provides the chain.

Admissibility requires that evidence is relevant (admissible), reliable (authentic), and complete (not partial).

The `dir /r` command in Windows displays alternate data streams. `streams.exe` from Sysinternals is also commonly used, but among the options, `dir /r` is the native method.

Belkasoft RAM Capturer is the most appropriate tool for acquiring RAM from a live Windows 10 system because it is designed specifically for live memory acquisition on Windows, uses a lightweight kernel-mode driver to read physical memory without causing system instability, and supports acquisition from 64-bit systems. Unlike other tools, it minimizes interaction with the target process list and avoids loading unnecessary user-mode components that could trigger crashes or alter the memory state.

File carving recovers files based on headers and footers without relying on file system metadata. Foremost and PhotoRec are common carving tools. Inode recovery fails if metadata is overwritten.

AWS CloudTrail records all API calls made to the AWS environment, including S3 bucket deletions. It logs the identity, source IP, and request parameters.

Resident files have their data stored directly in the $MFT record, typically for files smaller than about 900 bytes.

PEiD is specifically designed to detect packers, cryptors, and compilers by scanning PE files for known signatures in the entry point and section headers. Since the question asks for identifying a packer that obfuscates code, PEiD's signature-based detection directly targets this need, unlike general-purpose disassemblers or string extractors.

The MD5 hash of a file's binary contents is a unique cryptographic fingerprint that remains consistent across all copies of the exact same malware strain, regardless of where it is stored or what metadata the filesystem assigns. This makes it a reliable indicator of compromise (IoC) for identifying a specific malware sample across multiple systems, as the hash will match even if file names, sizes, or timestamps differ.

Alternate Data Streams (ADS) and slack space are native NTFS features that can be used to conceal data.

Registry keys created by malware are often tied to persistence mechanisms (e.g., Run keys) or configuration storage that remain consistent across polymorphic mutations. While the malware's code and file hash change with each mutation, the registry key path and value name typically stay the same to ensure the malware can re-launch or maintain its foothold. This makes the registry key a stable indicator of compromise (IoC) that is least likely to change.

Google account authentication tokens and sync settings are stored in the device's internal flash memory within the 'accounts.db' database and the 'authtoken' table, which are not wiped by a standard factory reset because the reset only clears user data partitions but does not overwrite the underlying NAND flash blocks. These tokens can survive a reset if the device was previously synced with Google servers, allowing recovery of the Google account credentials and sync configurations, which are critical for linking the device to a user identity.

Option D is correct because FTK Imager embeds hash values (MD5 and SHA1) directly into the E01 file during acquisition. These embedded hashes can be verified later by FTK Imager or compatible tools to confirm that the image has not been altered, ensuring data integrity without relying on an external hash file.

Host audit logs, Docker daemon logs, and container image layers are critical for investigating container escapes.

Option C is correct because the `conv=noerror,sync` parameter tells `dd` to continue reading even if a read error occurs, and to pad the output block with zeros to maintain the correct offset and size. This ensures the image remains usable for analysis despite bad sectors on the source disk.

The USN journal records changes to files. If the journal shows many entries after the last modified timestamp, it indicates that the file was accessed or modified in ways that did not update the $MFT timestamps (e.g., via alternate data streams, timestomping, or changes to metadata). This could be evidence of anti-forensics.

Option A is correct because the server is actively compromised — the attacker gained access via anonymous FTP, executed a destructive SQL query, and performed lateral movement. Capturing a memory dump preserves volatile evidence (e.g., running processes, network connections, and in-memory malware), disconnecting the network cable prevents further data exfiltration or remote control, and imaging the hard drive captures persistent evidence. This follows the CHFI first responder priority: preserve volatile data first, then isolate, then acquire non-volatile evidence.

The ephemeral nature, layered file systems, and shared kernel are key challenges in container forensics.

FTK Imager Lite is designed for live forensic acquisition on Windows systems, including capturing RAM contents without altering the system state. It uses a lightweight, read-only approach that avoids writing to the disk or modifying memory pages, preserving the integrity of the evidence.

Option B is correct because the `key_remote_jid` column stores the remote party's identifier (e.g., a phone number with country code), and the `LIKE '%1234%'` pattern matches any value containing '1234' anywhere in the string. This retrieves all messages where the contact's phone number ends with '1234', as required by the question.

The Best Evidence Rule requires that the original evidence be presented, but in digital forensics, a forensic image is considered the best evidence if the original is not practical.

The log shows failed SSH login attempts for root from a specific IP, indicating a brute-force attack on SSH. The source IP is remote (not localhost). The attempts are unsuccessful (failed).

The 'debugfs' tool can access ext2/3/4 file systems directly and recover files from inodes. 'extundelete' also works, but debugfs is more versatile.

/var/log/auth.log (or /var/log/secure on RHEL) stores authentication logs. /var/log/syslog contains general system messages. /var/log/kern.log is for kernel messages.

The difference between actual data size and allocated size is slack space. The file was allocated a cluster of 1024 bytes, but only 900 bytes are used, leaving 124 bytes of slack space that could contain residual data.

log2timeline (now Plaso) typically uses log2timeline.py to create a storage file, then psort.py to output the timeline in a readable format.

Option C is correct because the primary role of an expert witness in digital forensics is to provide an impartial opinion on technical facts, helping the trier of fact (judge or jury) understand complex digital evidence. Unlike a lay witness, an expert is permitted to offer interpretations and conclusions based on their specialized knowledge, as defined under Federal Rule of Evidence 702. This opinion must be based on sufficient facts or data, reliable principles and methods, and a reliable application of those methods to the case.

Timeline creation involves parsing metadata, exporting, and analyzing events.

Authenticity is a core component of the rules of evidence because it requires the proponent to show that the digital evidence is what it claims to be and has not been tampered with. For digital evidence, this is typically established through cryptographic hash verification (e.g., SHA-256) and a documented chain of custody. Without authenticity, the court cannot rely on the evidence's integrity, making it inadmissible.

Loadable kernel modules (LKM) are a common rootkit technique. Modified system binaries and hidden processes are also typical indicators.

PACE and GDPR are relevant legal frameworks. PACE governs police powers, and GDPR regulates data protection and processing of personal data.

Stegdetect is a tool that uses statistical analysis to detect steganography in JPEG images. Autopsy has steganography detection modules but Stegdetect is specialized.

Cron jobs, SSH authorized keys, and systemd services are common persistence mechanisms on Linux.

Option A is correct because the `adb backup -f backup.ab -apk -shared -all` command creates a full Android backup that includes both app data (via `-apk`) and shared storage (via `-shared`), outputting a single `.ab` file. This is the standard ADB method for non-rooted devices to capture a comprehensive backup of the data partition, including user-installed apps and their data, as well as internal shared storage like `/sdcard`.

TRIM allows the SSD to erase data blocks immediately after deletion, making recovery nearly impossible because the data is actually zeroed out.

The `pslist` command lists processes from the doubly linked list, but `psscan` uses pool scanning to find processes, including hidden ones.

GPT (GUID Partition Table) uses a protective MBR for compatibility and supports disks larger than 2 TB. MBR is limited to 2 TB.

The iOS Keychain is a secure, encrypted database designed to store sensitive user credentials and secrets. Wi-Fi passwords and website login credentials are explicitly stored in the Keychain to protect them from unauthorized access, making them recoverable during forensic analysis of a backup.

Option A is correct because booting into recovery mode on a rooted Android device allows you to use ADB to execute the `dd` command, which can create a bit-for-bit physical image of the userdata partition without needing to bypass the lock screen. Since the device is rooted, you have the necessary privileges to read the raw block device, and recovery mode ensures the filesystem is not mounted, preventing data corruption during acquisition.

The presence of ' OR '1'='1 in the query string is a classic SQL injection attempt, designed to bypass authentication or extract data.

GPT (GUID Partition Table) uses a 64-bit scheme and supports up to 128 partitions by default. MBR uses 32-bit and supports only 4 primary partitions.

Wireshark is the primary tool for packet capture and analysis, including TCP stream reconstruction.

GrayKey is specifically designed for physical extraction of iOS devices, leveraging advanced techniques to bypass passcode restrictions on modern iPhones, including those with Secure Enclave and full-disk encryption. It is widely adopted by law enforcement for its ability to perform brute-force attacks on the device's passcode without triggering the auto-wipe feature, making it the correct answer.

These hives contain specific types of configuration data.

Option C is correct because services.exe (the Service Control Manager) should not normally listen on any TCP port. When it is found listening on TCP port 4444—a port commonly associated with Metasploit and reverse shells—it strongly indicates that malware has injected code into the legitimate services.exe process, hijacking it to establish a persistent backdoor listener. This is a classic sign of process hollowing or reflective DLL injection, where the malware hides its network activity under a trusted system process.

log2timeline (and its successor Plaso) is a tool designed to parse multiple forensic artifacts and output a timeline. Plaso is the current version.

Preserving the container's file system and logs is key. 'docker commit' creates an image from the container's current state. 'docker export' exports the filesystem as a tar archive. 'docker logs' retrieves logs. 'docker inspect' shows metadata. The container is stopped, so 'docker exec' won't work without starting it, which alters state. 'docker save' saves images, not containers. The best first step is to create an image or export the filesystem.

When a file is deleted in FAT32, the directory entry is marked as deleted (first byte set to 0xE5) and the FAT entries are set to 0, marking clusters as free.

Many SSDs implement TRIM, which instructs the controller to erase blocks that are no longer in use. If the OS issued TRIM commands before shutdown, the deleted data may have been physically erased.

Event ID 4625 indicates failed logon attempts. A sudden spike from random external IPs is characteristic of a brute‑force attack, where an attacker tries many passwords across multiple accounts.

When a self-encrypting drive (SED) is powered on and logged in, the drive's hardware encryption key is already loaded and the data is accessible through the operating system. The best method to preserve the encrypted data in its decrypted state is to acquire a logical image from the running OS, which captures files and metadata without powering off the drive and losing the decryption context. Removing power or rebooting would cause the SED to lock, requiring the authentication key again and potentially altering the data state.

The analyst should document the file's location and metadata, then use a validated tool to extract and view the content while maintaining a chain of custody and ensuring the original is not altered.

Event ID 4625 with Logon Type 10 indicates a failed remote interactive logon attempt, typically via Remote Desktop (RDP).

The 'log' command is the native tool to query the unified logging system on macOS.