Computer Hacking Forensic Investigator CHFI (CHFI) — Questions 76–150

A SYN flood attack sends many SYN packets without completing the handshake, exhausting the target's connection queue. The different source IPs indicate a distributed SYN flood or IP spoofing.

GPT uses a Protective MBR in the first sector, followed by the GPT header and partition entries. A hidden partition might be created by modifying the GPT header or by using alternative partitioning schemes that are not listed in the main GPT table.

The cron job is a persistence mechanism. The examiner should capture the script and analyze it to understand the attacker's actions, preserving the file as evidence.

The DKIM-Signature domain (evil.com) does not match the claimed sender domain (paypal.com). This mismatch indicates the email is likely spoofed.

TestDisk is a powerful tool for recovering lost partitions and fixing boot sectors. It can also carve data from unallocated space.

Identification of potential evidence is a core initial step in the EC-Council's computer forensics investigation process because it defines the scope and sources of data that may contain relevant evidence. Without proper identification, investigators risk missing critical data or collecting irrelevant information, which can compromise the entire investigation. This step involves recognizing potential evidence sources such as hard drives, network logs, and volatile memory, ensuring that all relevant data is accounted for before collection begins.

When an Android backup is created via ADB with default settings, the resulting .ab file is encrypted using the device's lock screen PIN or password as the encryption key. This is a built-in security feature of the Android Backup Manager to protect backup data from unauthorized access. The encryption is applied regardless of whether full-disk encryption is enabled, as it is a separate layer of protection for the backup stream.

A webshell is a script that provides a backdoor for remote administration. The presence of 'cmd.aspx' in the web root with command execution capability confirms a webshell attack.

An expert witness is someone with specialized knowledge who provides opinion testimony to assist the court in understanding technical evidence.

The mutex name 'Global\{5B9E4E7E-8B2C-4F6D-A1A3-F2C8D9E0A1B2}' is a well-known technique used by malware to ensure only one instance of itself runs on the system, preventing conflicts or multiple infections. The outbound connection to 203.0.113.50 on TCP port 4444 is a classic indicator of command and control (C2) communication, as port 4444 is commonly associated with reverse shells and C2 traffic (e.g., Metasploit default). Together, these two behaviors directly demonstrate single-instance execution safeguard and C2 communication.

The missing DKIM-Signature and mismatched X-Originating-IP suggest that the email may be spoofed. DKIM provides cryptographic verification; its absence combined with an IP mismatch indicates a lack of authentication and possible forgery.

FTK Imager is a free forensic imaging tool that supports multiple output formats including E01 (EnCase), DD, and segmented images.

Volatile evidence such as memory and running processes disappears when an instance is stopped or terminated, making timely acquisition critical.

Cron jobs, startup scripts in /etc/init.d, and modifications to /etc/passwd to create backdoor accounts are all persistence techniques on Linux. SSH keys are not a persistence mechanism but rather an access method.

FTK Imager can acquire a logical drive but may not reassemble RAID 0 stripes automatically. The analyst needs to identify stripe size and order, then combine the disks using a RAID reconstruction tool.

Cellebrite UFED (Universal Forensic Extraction Device) is the correct answer because it is a dedicated hardware and software solution specifically engineered to extract data from a vast array of mobile devices, including iOS and Android, through both physical and logical acquisition methods. It is widely adopted by law enforcement agencies globally due to its ability to bypass lock screen security, support over 30,000 device profiles, and extract deleted data via advanced techniques like JTAG and chip-off.

Using a write blocker ensures the drive is not modified during acquisition. Unlocking via the OS may alter data; imaging the encrypted drive preserves the original state.

Large off-hours data transfers to an external IP are typical of data exfiltration. Normal backup traffic may occur but is usually scheduled and to known destinations.

Prefetch files store information about recently executed programs, and LNK files (shortcuts) record execution details including timestamps and target paths.

Cellebrite UFED (Universal Forensic Extraction Device) is a specialized hardware and software tool designed for physical extraction of data from mobile devices, including bypassing lock screen security on iOS and Android devices. It uses advanced techniques such as bootloader exploits, JTAG, chip-off, and proprietary software-based methods to acquire full file system images, even when the device is locked or encrypted.

The MBR uses a 32-bit Logical Block Address (LBA) which limits the maximum addressable disk size to 2 TiB. It stores a 64-byte partition table with four primary partitions.

Foremost and PhotoRec are well-known file carving tools that recover files based on headers/footers.

Event ID 4625 indicates a failed logon attempt. This is a standard Windows security event used to track authentication failures.

Run keys under HKLM\Software\Microsoft\Windows\CurrentVersion\Run configure programs to start automatically for all users. The HKCU equivalent is per-user.

B is correct because the presence of svchost.exe in C:\Users\Public\ instead of C:\Windows\System32 indicates a deviation from the expected execution path, which is a classic behavioral indicator. Behavioral indicators focus on anomalous actions or file placements rather than static attributes like hashes or network traffic.

ADB (Android Debug Bridge) extraction requires USB debugging to be enabled on the device because ADB operates over a USB connection using the Android Debug Bridge protocol, which is only active when USB debugging is turned on in Developer Options. Without this setting, the device will not respond to ADB commands, making extraction impossible. This is a fundamental prerequisite for any ADB-based forensic acquisition.

Option B is correct because the system's date and time settings are critical for establishing a reliable timeline of events during forensic analysis. The first responder must document these settings (e.g., from the BIOS or operating system) before any changes occur, as they directly affect the timestamps of file system metadata (MAC times) and log entries. Without this baseline, correlating events across multiple sources becomes unreliable, potentially invalidating the entire investigation.

A legal hold requires suspending routine deletion policies and preserving potentially relevant data in its current state. Notifying custodians and disabling automatic deletion mechanisms are critical steps.

Option A is correct because the $UsnJrnl (Update Sequence Number Journal) records that the file was modified, and on Windows systems, when a file is opened for reading, the last access time is updated by default. The discrepancy arises because the user claims the file was last accessed at 09:15, but the NTFS metadata shows a different last access time, which could be due to the system updating the last access time upon modification or read operations, as recorded in the $UsnJrnl.

A is correct because an Xmas scan sends packets with the FIN, PSH, and URG flags set (like a Christmas tree lit up). According to RFC 793, a closed port must respond with an RST packet, while an open port should drop the packet silently (no response). The NIDS alert triggered on these three flags together, which is the signature of an Xmas scan.

Creating a bit-for-bit forensic image (option A) is the correct first step because it preserves the malware in an immutable, write-protected state, preventing any accidental execution or modification. This ensures the integrity of the evidence and allows the analyst to work with a safe copy without risking infection of the host system or network. In malware forensics, this aligns with the fundamental principle of maintaining a chain of custody and avoiding alteration of the original sample.

Prefetch files record execution times. If PowerShell ran but no interactive logon, it likely ran via a scheduled task or service, which doesn't create an interactive logon event (Event ID 4624 with logon type 2).

GPT stores a primary partition table at LBA 1 (sector 1) and a backup at the end of the disk. The protective MBR is at LBA 0.

Option C is correct because it prioritizes capturing volatile RAM first using win32dd (a memory acquisition tool) locally to the external drive, which preserves the most volatile evidence before any shutdown or network transfer. After RAM capture, FTK Imager over the network creates a verified physical disk image, satisfying the legal requirement for cryptographic hash verification while minimizing downtime. This approach avoids the risk of losing RAM data (as in shutdown) and avoids bandwidth constraints (as in network RAM acquisition).

Event ID 7045 in the System log indicates a service was installed on the system.

Foremost and Scalpel are well-known file carving tools that use header/footer signatures to recover files from disk images.

Plaso (Python Log2Timeline) is the command-line tool for creating super timelines from various forensic artifacts.

EmailTracker is a tool that parses email headers and extracts metadata for forensic analysis, such as tracking the path of an email.

The string is URL-encoded HTML/JavaScript (<script>alert('XSS')</script>). It is a typical cross-site scripting payload attempting to execute in a browser.

The Fourth Amendment protects against unreasonable searches and seizures and requires warrants supported by probable cause.

Process Monitor (ProcMon) is the correct tool because it integrates real-time monitoring of registry changes, file system modifications, and process/thread activity into a single interface. It combines the legacy tools Regmon (registry) and Filemon (file system) with process monitoring, allowing an analyst to correlate events across all three subsystems simultaneously, which is essential for dynamic malware analysis.

pslist lists processes by walking the doubly-linked list. pstree displays process hierarchy. Both are standard process enumeration plugins.

The log entry contains 'UNION SELECT username, password FROM users--', which is a SQL injection attempt to retrieve data from the users table.

Option D is correct because `netstat -an` displays all active TCP and UDP connections along with their listening ports and states, which is critical for identifying unauthorized or malicious network connections on a live system. This command provides a snapshot of current network sessions without altering system state, making it a standard volatile evidence collection technique.

In MySQL binary logs, the timestamp in the 'Query' event header (e.g., '190101 10:00:00') records the server's local time when the statement began executing. This is the time the DELETE statement was actually processed by the MySQL server, not when the client sent it or when the log was written. The binary log captures the exact moment the server starts executing the query, making option A correct.

The fstrim command sends TRIM commands to the SSD, causing the device to garbage-collect and erase deleted blocks. Wear leveling may have moved data, complicating recovery.

An external principal appearing in the log indicates that the bucket's IAM policy allowed access from outside the organization, a common misconfiguration.

TRIM allows the SSD to erase data blocks that are no longer in use, making it difficult to recover deleted files because the physical data may be zeroed out.

Multi-tenancy means multiple customers share the same physical resources. This complicates evidence isolation and can lead to data comingling, making forensic acquisition difficult.

The use of '../' indicates path traversal, and the target file (SAM) is a common target for privilege escalation.

A hardware write blocker prevents any modification to the original evidence by intercepting write commands at the hardware level, ensuring the integrity of the source drive.

The File Allocation Table (FAT) contains cluster chains for files; deleted entries may still be recoverable if not overwritten.

Wireshark's 'Export Objects' feature allows extraction of files transferred via HTTP, SMB, etc. 'Follow TCP Stream' shows the stream content but does not export files.

Option C is correct because creating a forensic image of the encrypted drive before decryption preserves the original evidence in its pristine, unaltered state. Decrypting the image later using the recovery key ensures that the original encrypted data remains intact and verifiable, maintaining data integrity throughout the investigation.

The primary reason for using a hardware write blocker is to ensure that the suspect drive is connected in a read-only manner, preventing any write operations from the forensic workstation from reaching the drive. This preserves the integrity of the evidence by guaranteeing that no data is altered, added, or deleted during the acquisition process, which is a fundamental requirement for admissibility in legal proceedings.

Docker images consist of read-only layers. The topmost writable layer (container layer) holds changes made at runtime, such as installing tools or scripts. The attack scripts would be in this layer.

The registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run is a standard Windows autostart location. Malware commonly adds an entry here to achieve persistence, ensuring it executes every time the user logs in. The suspicious name 'WindowsUpdate' is a common masquerade tactic to hide malicious intent.

The `hashwindow` parameter in `dcfldd` specifies the size of the data chunks for which individual hash values are computed. With `hashwindow=10M`, the tool generates a SHA-256 hash for every 10 MB block of the input data, allowing verification of integrity on a per-block basis rather than only a single hash for the entire image. This is useful for detecting corruption or tampering in specific segments of large forensic images.

The log shows a POST request to shell.aspx in the uploads directory with a 200 status, indicating a likely webshell upload. The investigator should retrieve and analyze the uploaded file for malicious content to confirm the compromise.

Slack space is the unused portion of a cluster that remains after a file is written, potentially containing residual data from previous files.

EmailTracker is a tool that parses email headers and visualizes the route, timing, and geolocation of mail servers.

Option B is correct because the malware resides only in memory, making it invisible to disk-based scans. Memory forensics with tools like Volatility allows investigators to analyze RAM artifacts (e.g., processes, network connections, injected code) to detect stealthy malware that never writes to disk.

RAID reconstruction involves identifying the order of disks, stripe size, and parity layout, then using a tool that can reassemble the array to access the file system.

The log entry directly states that User JohnDoe accessed contract.pdf at a specific time, which is a firsthand account of the event without requiring inference. In digital forensics, direct evidence is evidence that, if believed, proves a fact without any additional reasoning or presumption. This log is a direct record of the user's action, making it direct evidence.

Aid4Mail is a forensic email analysis tool that supports PST file parsing and extraction.

SeDebugPrivilege allows a process to debug other processes, including accessing and modifying their memory. Malware often enables this privilege to perform process injection, where malicious code is written into the memory of a legitimate process (e.g., via WriteProcessMemory and CreateRemoteThread) to evade detection and execute under the target process's context.

In FAT file systems, when a file is deleted, the first byte of the directory entry is set to 0xE5 to mark it as deleted, while the rest of the entry remains until overwritten.

Kernel for OST Viewer is specifically designed to parse offline Outlook data files (.OST).

The signature 'UPX 0.89.6 - 1.02 / 1.05 - 1.24' indicates the file is packed with UPX (Ultimate Packer for eXecutables). Packing is a common technique used by malware authors to obfuscate the original code and evade signature-based detection. The analyst must unpack the file using a UPX unpacker or manual unpacking to reveal the actual executable code for further static or dynamic analysis.

The $MFT is a core component of NTFS. EnCase has built-in support for parsing $MFT and extracting file metadata.

The PEiD detection of 'UPX 0.89.6 - 1.02 / 1.05 - 1.24' confirms the file is packed with UPX (Ultimate Packer for eXecutables). Packing obfuscates the original code and often evades static analysis. The most appropriate next step is to unpack the file using the UPX tool (with the -d switch) or manual unpacking to recover the original executable for deeper static and dynamic analysis.

The attribute 'kSecAttrAccessibleWhenUnlockedThisDeviceOnly' in iOS Keychain indicates that the item can only be accessed when the device is unlocked and is not included in any backup (iCloud or iTunes). This is because the 'ThisDeviceOnly' suffix ties the encryption key to the device's UID, preventing migration to another device or restoration from backup. Option C correctly captures both conditions: accessibility only when unlocked and exclusion from backups.

Deleted emails in PST files are often not immediately overwritten. Using forensic tools to scan the PST file for unallocated space or deleted items can recover them.