Courseiva

Computer Hacking Forensic Investigator CHFI (CHFI) — Questions 76150

205 questions total · 3pages · All types, answers revealed

Page 1

Page 2 of 3

Page 3
76
MCQmedium

A security analyst is reviewing firewall logs and notices repeated connection attempts from an internal IP to an external server on TCP port 4444. The internal host is a web server. What is the MOST likely explanation?

A.The web server is serving HTTPS traffic on port 4444
B.The web server is performing DNS queries
C.The web server is being scanned for open ports
D.The web server has a reverse shell connection to a command-and-control server
AnswerD

An outbound TCP connection from a compromised web server to a single external IP on a non-standard high port such as 4444 is a classic reverse-shell indicator. Because the server initiates the connection, it can evade typical inbound firewall restrictions, allowing an attacker to receive a shell session through a listener on the command-and-control host. The repeated nature of the connections suggests beaconing for instructions, a hallmark of C2 communication.

Why this answer

Repeated outbound connections from an internal web server to an external server on TCP port 4444 strongly indicate a reverse shell, which is a common technique used by malware to establish command-and-control (C2) communication. Unlike a standard client-server model, the internal host initiates the connection to bypass firewalls that block inbound traffic, and port 4444 is frequently associated with Metasploit's default reverse shell payload (e.g., meterpreter). This behavior is anomalous for a web server, which typically serves HTTP/HTTPS on ports 80/443 and does not initiate persistent outbound connections to arbitrary external IPs on non-standard ports.

Exam trap

The key trap here is that candidates see 'connection attempts' and assume it is an inbound scan (Option C), but the question specifies the internal IP is the source, meaning the web server is initiating the connection, which is the hallmark of a reverse shell or C2 beacon. In CHFI, understanding traffic direction and common C2 port usage is critical.

How to eliminate wrong answers

Option A is wrong because HTTPS traffic is served on TCP port 443 by default, not 4444; while a server could be configured to use a non-standard port, a web server serving HTTPS would not repeatedly initiate outbound connections to an external server—it would listen for inbound connections. Option B is wrong because DNS queries use UDP port 53 (or TCP port 53 for zone transfers), not TCP port 4444, and DNS traffic is typically ephemeral and not characterized by repeated connection attempts to a single external IP. Option C is wrong because a port scan would originate from an external source targeting the internal web server, not from the internal web server to an external server; the log shows outbound connections from the internal host, indicating it is the initiator, not the target of a scan.

77
MCQhard

During a forensic examination of a solid-state drive (SSD), you notice that files deleted several months ago cannot be recovered using traditional file carving tools. Which SSD feature is MOST likely preventing recovery?

A.TRIM
B.Over-provisioning
C.Garbage Collection
D.Wear levelling
AnswerA

TRIM is an ATA command that explicitly informs the SSD controller of pages that are no longer in use, prompting the controller to erase those physical blocks either immediately or during idle time. Because the erasure is performed at the flash level, the actual data is removed or invalidated, preventing recovery via file carving. This makes TRIM the critical factor that distinguishes SSD forensic examinations from HDD ones, as deleted files become inaccessible to software-based recovery tools.

Why this answer

The TRIM command (ATA Data Set Management command) allows the operating system to inform the SSD which data blocks are no longer in use. When TRIM is enabled, the SSD's controller immediately erases those blocks internally, making the original file data unrecoverable by file carving tools because the physical NAND cells are zeroed or marked as invalid. For files deleted months ago, TRIM would have already been issued for those LBAs, so traditional carving that relies on residual data in unallocated space fails.

Exam trap

EC-Council often tests the distinction between TRIM (an OS-to-SSD command that explicitly tells the drive to erase unused blocks) and Garbage Collection (a firmware-level process that may or may not erase data without TRIM), leading candidates to incorrectly choose Garbage Collection because they confuse background maintenance with the specific command that prevents recovery.

How to eliminate wrong answers

Option B (Over-provisioning) is wrong because over-provisioning reserves extra NAND capacity for performance and wear levelling, but it does not actively erase user-deleted data; it only provides spare blocks for the controller. Option C (Garbage Collection) is wrong because garbage collection consolidates valid data and erases stale blocks in the background, but it is triggered by the SSD's firmware and typically occurs after TRIM has marked blocks as invalid; without TRIM, garbage collection may not immediately erase deleted files. Option D (Wear levelling) is wrong because wear levelling distributes write/erase cycles across all NAND blocks to prolong drive life, but it does not intentionally erase user data; it moves data around and may incidentally overwrite old blocks, but it is not the primary mechanism preventing recovery of long-deleted files.

78
MCQhard

During a forensic examination, an analyst runs the following command: 'dd if=/dev/sda of=/mnt/evidence/image.dd bs=4k conv=noerror,sync'. The source drive has bad sectors. What is the effect of the 'conv=noerror,sync' option?

A.It stops the imaging process when an error is encountered.
B.It skips the bad sectors and compresses the output.
C.It retries reading the bad sector multiple times before giving up.
D.It fills the bad sectors with zeros in the output image, allowing the imaging to complete without errors.
AnswerD

With `conv=noerror,sync`, `dd` treats any read error as a non-fatal event and continues copying the remainder of the source device, but it also pads the failed block with zeros so that the output image is the exact same size as the original media. This means the image contains placeholders for the unreadable sectors, preserving partition offsets and file system layout. It does not recover the original data in those sectors, but it lets the imaging finish and produces a valid forensic image.

Why this answer

The 'conv=noerror,sync' option in dd instructs the tool to continue reading even when encountering read errors (noerror) and to pad the output with zeros (sync) to maintain the original block size alignment. This ensures the forensic image is a complete bit-for-bit copy of the source drive, with bad sectors replaced by zeros, allowing the imaging process to finish without halting on errors.

Exam trap

The trap here is that candidates confuse 'sync' with 'synchronization' or 'skip' rather than understanding it as a padding mechanism that fills bad sectors with zeros to maintain block alignment and allow the imaging to complete.

How to eliminate wrong answers

Option A is wrong because 'conv=noerror' explicitly tells dd to NOT stop on errors; it continues processing. Option B is wrong because dd does not compress output; compression requires a separate tool or pipe (e.g., gzip), and 'sync' pads with zeros, not skips. Option C is wrong because dd does not retry reads; it simply moves to the next block after an error, and retry behavior would require additional options like 'conv=noerror,notrunc' or a separate script.

79
MCQeasy

What is the primary purpose of maintaining a chain of custody during a forensic investigation?

A.To document the handling of evidence from collection to presentation in court
B.To reduce the size of evidence for easier storage
C.To analyze the evidence for hidden data
D.To encrypt the evidence to prevent unauthorized access
AnswerA

The chain of custody is a legal and administrative record that creates an unbroken chronological log of every individual who collected, handled, transferred, or stored a piece of evidence. This documentation is critical because it demonstrates that the evidence has not been altered, substituted, or contaminated, thereby establishing the authenticity and integrity required for the evidence to be admissible in a court of law. Without a proper chain of custody, the opposing counsel can challenge the evidence's reliability, potentially leading to its exclusion.

Why this answer

The primary purpose of maintaining a chain of custody is to create a documented, unbroken record of every person who handled the evidence, from the moment it is collected until it is presented in court. This documentation is critical to establish the authenticity and integrity of the evidence, ensuring it has not been tampered with or altered, which is a foundational requirement for admissibility under legal standards like the Federal Rules of Evidence (FRE) 901. Without a proper chain of custody, the evidence can be challenged as inadmissible due to lack of trustworthiness.

Exam trap

EC-Council often tests the distinction between the chain of custody's documentation purpose and other forensic activities like analysis or security, so candidates mistakenly choose options that describe evidence handling steps (e.g., encryption or analysis) rather than the core legal documentation requirement.

How to eliminate wrong answers

Option B is wrong because reducing the size of evidence for easier storage is not a forensic goal; it would actually destroy or compress data, potentially losing critical metadata and violating the principle of maintaining evidence in its original state. Option C is wrong because analyzing evidence for hidden data is a separate investigative step (e.g., using tools like FTK or EnCase for steganography detection), not the purpose of the chain of custody, which is purely about documenting handling. Option D is wrong because encrypting evidence to prevent unauthorized access is a security measure, not a documentation process; encryption can even complicate chain of custody if the key is not properly managed, and the chain of custody itself does not involve cryptographic operations.

80
MCQeasy

An Android phone is seized, and the forensic examiner needs to acquire the device in a forensically sound manner. The phone is running Android 12 and has USB debugging enabled. Which acquisition method provides the most complete data without physically modifying the device?

A.File system acquisition via Cellebrite UFED
B.Physical acquisition via ADB with appropriate exploit
C.Logical acquisition through ADB backup
D.Manual extraction using screen captures
AnswerB

Physical acquisition via ADB leverages a custom recovery or a privilege-escalation exploit to execute a low-level block device read, such as dd if=/dev/block/mmcblk0 of=/image.dd, yielding a complete bit-for-bit replica of the flash storage. This preserves deleted files, unallocated clusters, file system slack, and application remnants that are absent from logical or file-system extractions, making it the most comprehensive and forensically defensible approach for Android devices when feasible.

Why this answer

Physical acquisition via ADB with an appropriate exploit allows the examiner to obtain a complete bit-for-bit copy of the device's flash memory, including deleted data and unallocated space, without physically modifying the device. Since Android 12 has USB debugging enabled, ADB can be used to push an exploit that bypasses security restrictions to perform a physical dump, which is the most comprehensive method available for this scenario.

Exam trap

EC-Council often tests the misconception that file system acquisition via Cellebrite UFED is the most complete method, but candidates must remember that physical acquisition captures raw flash memory including deleted data, whereas file system acquisition only retrieves active files.

How to eliminate wrong answers

Option A is wrong because Cellebrite UFED file system acquisition typically extracts only the file system structure (files and directories) and does not capture raw flash memory or unallocated space, missing deleted data and hidden partitions. Option C is wrong because logical acquisition through ADB backup only retrieves app data and system settings specified by the backup API, not the entire device storage, and it cannot recover deleted files or raw disk images. Option D is wrong because manual extraction using screen captures is not a forensic acquisition method; it only captures visible screen content and provides no access to underlying data, making it forensically unsound and incomplete.

81
MCQhard

An analyst retrieves a forensic image of a hard drive and discovers that the size reported by the operating system is smaller than the actual physical capacity. The extra space is not accessible through standard partition tools. This hidden area is MOST likely:

A.Device Configuration Overlay
B.Host Protected Area
C.Volume slack
D.RAM slack
AnswerB

Host Protected Area (HPA) is the correct answer because it is a hidden region created using the ATA Set Max Address command, which makes the operating system see a smaller disk than the physical platter actually contains. This area cannot be accessed through normal OS commands and is frequently used to conceal data for forensic analysis or other purposes. When an analyst observes that the OS-reported capacity is less than the physical drive size, the HPA is exactly the hidden area responsible for that discrepancy.

Why this answer

The Host Protected Area (HPA) is a region on a hard drive that is hidden from the operating system by using the ATA SET MAX ADDRESS command to reduce the reported capacity. This area is not accessible through standard partition tools because the OS sees only the reduced address space, making it ideal for storing forensic or diagnostic data. The analyst's observation of a smaller reported size than physical capacity directly matches HPA behavior.

Exam trap

EC-Council often tests the distinction between HPA and DCO, where candidates confuse the ATA commands (SET MAX ADDRESS vs. DEVICE CONFIGURATION) and incorrectly assume DCO is the primary hidden area when the symptom is a reduced OS-reported size.

How to eliminate wrong answers

Option A is wrong because a Device Configuration Overlay (DCO) is a separate hidden area created by the ATA DEVICE CONFIGURATION command that can be removed to reveal additional space, but it does not reduce the OS-reported size below physical capacity via a simple address limit like HPA. Option C is wrong because volume slack refers to unused space at the end of a partition that is still within the partition's logical boundaries and accessible via partition tools, not a hidden area beyond the OS-reported capacity. Option D is wrong because RAM slack is the unused space in the last sector of a file's allocated clusters that is filled with RAM contents, which is a file system concept unrelated to hard drive hidden areas.

82
MCQmedium

A forensic analyst is examining an Android device that was factory reset before seizure. Which Google account artefacts are MOST likely still recoverable from the device's storage?

A.All installed application APK files
B.Full SMS message history
C.Google account authentication tokens and cached account data
D.Encryption keys for user data partition
AnswerC

Google account authentication tokens and cached account data are written by the AccountManager service to /data/system/users/0/accounts.db and an encrypted credential store; after a factory reset, the /data partition is formatted but the underlying NAND blocks are not necessarily zeroized, allowing forensic recovery of deleted SQLite pages and token blobs. On many Android builds, the primary Google account username and its OAuth token are also cached in the Google Services Framework and can survive in unallocated space or even in a persistent FRP/device-protection partition. This combination of flash-memory remnants plus a designated persistent location makes account tokens the artifact most likely to be recovered after a reset compared to APKs, SMS, or encryption keys.

Why this answer

Factory reset on Android typically wipes user data partitions (e.g., /data) but does not securely overwrite the entire flash storage. Google account authentication tokens (e.g., OAuth 2.0 tokens) and cached account data (e.g., account names, sync settings) are often stored in system-level databases or encrypted key stores that may persist in unallocated or residual flash blocks, especially if TRIM or secure erase was not executed. These artefacts can be recovered via forensic imaging and carving of the raw NAND or eMMC.

Exam trap

EC-Council often tests the misconception that a factory reset securely erases all user data, when in reality residual artefacts like authentication tokens can persist in unallocated flash storage due to incomplete overwrite or lack of TRIM execution.

How to eliminate wrong answers

Option A is wrong because APK files are stored in the /data/app directory, which is part of the user data partition that is wiped during a factory reset; residual APK fragments are rarely recoverable in a complete, installable form. Option B is wrong because SMS messages are stored in the /data/data/com.android.providers.telephony/databases/mmssms.db file, which is also on the user data partition and is deleted during reset; while some fragments may remain in unallocated space, full message history is not reliably recoverable. Option D is wrong because encryption keys for the user data partition (e.g., FBE or FDE keys) are stored in the device's hardware-backed keystore or TEE and are cryptographically invalidated or wiped during factory reset, making them unrecoverable.

83
MCQmedium

During incident response, a first responder discovers a compromised system with signs of an active command-and-control (C2) connection. What is the MOST important immediate action to preserve evidence and prevent further damage?

A.Create a full disk image before taking any other action.
B.Disconnect the network cable to isolate the system from the network.
C.Immediately shut down the system to prevent further data exfiltration.
D.Run a full antivirus scan to remove the malware.
AnswerB

Physically unplugging the network cable is the correct immediate action because it provides an OS-independent isolation that halts command-and-control channels and prevents remote tampering without initiating any shutdown routines. This preserves critical volatile evidence such as active TCP/UDP connections, ARP cache entries, running processes, and memory contents, enabling a later live forensic acquisition. It also stabilizes the host so that subsequent imaging and analysis can be performed in a controlled, defensible manner.

Why this answer

Disconnecting the network cable immediately stops the active C2 communication, preventing further data exfiltration and command injection while preserving the current state of memory and disk. This action maintains the integrity of volatile evidence (e.g., network connections, running processes) and avoids the data loss that would occur with a shutdown or the evidence contamination that would result from running a scan.

Exam trap

EC-Council often tests the misconception that a full disk image is always the first priority, but in an active C2 scenario, network isolation must come first to prevent ongoing damage and preserve volatile evidence.

How to eliminate wrong answers

Option A is wrong because creating a full disk image before isolating the system allows the active C2 connection to continue exfiltrating data and potentially destroying evidence during the imaging process. Option C is wrong because immediately shutting down the system destroys volatile evidence (e.g., network connections, running processes, memory-resident malware) and may trigger anti-forensic mechanisms that wipe logs or encrypt data. Option D is wrong because running a full antivirus scan modifies the system state (e.g., file access times, registry keys) and may alert the attacker, causing them to terminate the C2 session or trigger a kill switch, thereby losing evidence of the active connection.

84
MCQmedium

During an investigation, an analyst recovers a file from unallocated space that contains fragments of a deleted document. The file size is 512 bytes, but the cluster size of the volume is 4096 bytes. What is the term for the unused bytes between the end of the file and the end of the last cluster?

A.Volume slack
B.Drive slack
C.File slack
D.RAM slack
AnswerC

File slack is the unused bytes from the logical end of a file to the end of the last cluster allocated to that file, and it is the correct location for recovered remnant data. It consists of RAM slack (up to the sector boundary) plus the remaining bytes in the trailing cluster, which are typically not zeroed by the filesystem. Because old data can persist there after a file is overwritten or deleted, forensic examiners regularly recover intact fragments from file slack.

Why this answer

File slack refers to the unused bytes between the end of a file and the end of the last cluster allocated to that file. In this scenario, the file is 512 bytes but resides in a 4096-byte cluster, leaving 3584 bytes of slack space. This area can contain remnants of previously deleted data or metadata, making it a critical forensic artifact.

Exam trap

EC-Council often tests the distinction between RAM slack and file slack, and the trap here is that candidates confuse 'file slack' with 'RAM slack' because both involve unused bytes, but file slack encompasses the entire cluster remainder, while RAM slack is only the sector-level portion.

How to eliminate wrong answers

Option A is wrong because volume slack is the unused space at the end of a volume or partition, not between the end of a file and its cluster boundary. Option B is wrong because drive slack is not a standard forensic term; it is often confused with volume slack or unallocated space on the entire drive. Option D is wrong because RAM slack specifically refers to the unused bytes between the end of a file and the end of the sector (typically 512 bytes) that are filled with RAM contents during a write operation, not the cluster-level slack described here.

85
MCQmedium

A first responder arrives at a suspected intrusion scene. A desktop computer is powered on and logged in. The user claims they saw suspicious files being copied to a USB drive. Which of the following should the first responder do FIRST?

A.Capture volatile data such as memory and running processes.
B.Power off the computer immediately to prevent further data loss.
C.Photograph the scene and document everything in a notebook.
D.Create a forensic image of the hard drive using a write blocker.
AnswerA

Volatile data must be collected first because RAM, active network connections, and running processes exist only while the system is powered. A memory dump can recover encryption keys, injected malicious code, and open handles, while a process listing and netstat output capture attacker activity that would vanish at shutdown. This follows the order of volatility, moving from the most ephemeral evidence to the least ephemeral evidence.

Why this answer

In a live intrusion where a USB transfer is in progress, volatile data (memory, running processes, network connections) is the most ephemeral and will be lost if the system is powered down. Capturing this data first preserves evidence of the malicious activity, such as the process that initiated the copy and any network connections, which is critical for reconstructing the attack. This follows the order of volatility (RFC 3227), which mandates capturing volatile data before non-volatile data.

Exam trap

The CHFI exam often tests the principle of the order of volatility, and the trap here is that candidates mistakenly prioritize preserving the hard drive (non-volatile) over capturing volatile data, thinking that powering off or imaging the drive first prevents evidence tampering.

How to eliminate wrong answers

Option B is wrong because powering off the computer immediately destroys volatile evidence (e.g., memory contents, running processes, network connections) and may trigger anti-forensic mechanisms that wipe or encrypt data. Option C is wrong because photographing and documenting the scene, while important, is a secondary step that should occur after volatile data capture to avoid losing transient evidence. Option D is wrong because creating a forensic image of the hard drive is a non-volatile acquisition step that should be performed after volatile data has been secured, and doing it first risks overwriting or losing memory-resident evidence.

86
MCQeasy

What is the PRIMARY purpose of a chain of custody document in a forensic investigation?

A.To provide a chronological record of who handled the evidence, when, and why.
B.To document the tools used during the investigation.
C.To list all the files found on the suspect's computer.
D.To authorize the search and seizure of digital evidence.
AnswerA

The chain of custody document exists to create a verifiable, chronological account of every individual who came into possession of evidence, along with the specific timestamps and reasons for each transfer. This unbroken record is what establishes the item's integrity and continuity from collection through courtroom presentation, assuring the fact-finder that the evidence was not altered, substituted, or contaminated. Without a defensible chain of custody, even forensically sound evidence may be ruled inadmissible.

Why this answer

The chain of custody document is the foundational record that ensures evidence integrity and admissibility in court. Its primary purpose is to create a chronological, unbroken log of every person who handled the evidence, the exact time and date of each transfer, and the reason for the transfer. This directly supports the legal requirement to prove that the evidence has not been tampered with or altered from the moment of seizure to its presentation in court.

Exam trap

EC-Council often tests the distinction between the chain of custody (which tracks handling history) and the search warrant (which grants legal authority), causing candidates to mistakenly choose the authorization option.

How to eliminate wrong answers

Option B is wrong because documenting the tools used during the investigation is a separate activity, typically recorded in a forensic workstation log or case notes, not in the chain of custody form. Option C is wrong because listing files found on a suspect's computer is the output of forensic analysis (e.g., a file listing from a tool like FTK Imager or EnCase), not the purpose of the chain of custody document. Option D is wrong because authorization for search and seizure is obtained via a legal warrant or consent form, not through the chain of custody; the chain of custody begins after the evidence has been legally seized.

87
MCQmedium

Which of the following email headers is used to verify the domain of the sending server and is commonly used for authentication to prevent spoofing?

A.Content-Type
B.Received
C.X-Mailer
D.DKIM-Signature
AnswerD

DKIM-Signature provides a digital signature for domain verification.

Why this answer

DKIM-Signature is the correct answer because it is an email authentication method that uses a digital signature to verify the domain of the sending server. It allows the receiver to check that the email was not forged or altered during transit, directly preventing domain spoofing. This header is defined in RFC 6376 and is a core component of email authentication frameworks like DMARC.

Exam trap

EC-Council often tests the distinction between headers used for authentication (DKIM-Signature) versus headers used for routing or metadata (Received, X-Mailer), leading candidates to mistakenly choose Received because it shows server hops, but it does not verify domain ownership.

How to eliminate wrong answers

Option A is wrong because Content-Type is a MIME header that specifies the media type of the message body (e.g., text/plain or multipart/mixed) and has no role in authentication or spoofing prevention. Option B is wrong because Received is a trace header added by each mail transfer agent (MTA) along the delivery path; it is used for routing diagnostics and forensic tracing, not for verifying the sending domain's authenticity. Option C is wrong because X-Mailer is an informal header that indicates the email client software used to compose the message (e.g., Outlook or Thunderbird) and is easily forged, providing no security or authentication function.

88
MCQeasy

In a macOS forensic investigation, which log system provides a timeline of high-level system events such as application launches and user logins?

A.syslog
B.FSEvents
C..plist files
D.Unified logging
AnswerD

Unified logging is the modern, centralized logging architecture on macOS, introduced in macOS 10.12, which aggregates all system and user-level log messages into a high-performance, structured data store accessible via the `log` command and Console app. It captures high-level forensic events such as logon/logoff, application launches, and background daemon activity, along with rich metadata like timestamps, process IDs, and privacy-annotated content. This makes Unified logging the authoritative artifact for investigating high-level system events because it provides a unified, queryable, and tamper-resistant timeline of system activity.

Why this answer

Unified logging is the correct answer because it is the comprehensive logging system in macOS that captures high-level system events such as application launches and user logins, providing a timeline for forensic analysis. FSEvents, on the other hand, only records file system changes at the directory level.

Exam trap

Candidates may incorrectly assume that FSEvents records high-level system events due to its name, but it only captures file system changes. Unified logging is the primary source for application launches and user logins.

How to eliminate wrong answers

Option A is wrong because syslog is a legacy Unix logging system that collects kernel and application messages but does not specifically track high-level system events like application launches or user logins in a structured timeline; it is more generic and less forensically focused on user actions. Option C is wrong because .plist files are property list files used for storing application preferences and configuration data, not for logging system events or providing a timeline of user activity. Option D is wrong because Unified logging (os_log) is the modern macOS logging framework that captures detailed debug and system messages, but it is not designed to provide a persistent, high-level timeline of events like FSEvents; it is more granular and ephemeral unless specifically configured for persistence.

89
MCQmedium

During a forensic examination of a Mac system, an investigator needs to recover historical record of file system events, such as file modifications and deletions. Which artifact should they examine?

A..plist files
B.Unified logging
C.Syslog
D.FSEvents
AnswerD

FSEvents is a Mac feature that records changes to the file system, including modifications and deletions.

Why this answer

FSEvents (File System Events) is a macOS framework that logs historical file system changes, including modifications, deletions, and renames, at the volume level. This data is stored in the `.fseventsd` directory and can be queried using the `fsevents` command or tools like `fs_usage`, making it the primary artifact for recovering a timeline of file system activity on a Mac.

Exam trap

EC-Council often tests the distinction between general logging mechanisms (Unified logging, Syslog) and macOS-specific file system event tracking (FSEvents), leading candidates to confuse system logs with dedicated file system change journals.

How to eliminate wrong answers

Option A is wrong because .plist files (property lists) store application preferences and configuration data, not a historical record of file system events like modifications or deletions. Option B is wrong because Unified logging captures system and application log messages via the `log` command, but it does not specifically record file system event history; it focuses on process and kernel logs. Option C is wrong because Syslog is a legacy logging protocol (RFC 5424) that collects system messages but lacks the dedicated file system event tracking and persistent history that FSEvents provides on macOS.

90
MCQeasy

During a forensic analysis of an NTFS volume, an investigator finds a file that appears to be hidden. Which NTFS feature allows data to be stored in a file without affecting the file's visible size in the directory listing?

A.Alternate Data Streams (ADS)
B.Volume Shadow Copy
C.USN Journal
D.Master File Table ($MFT)
AnswerA

Alternate Data Streams (ADS) are a legitimate NTFS feature that allow additional named data streams to be attached to a file, accessible via the syntax file.txt:stream. Because standard directory listings and file properties typically report only the primary unnamed stream, an investigator using conventional utilities may completely miss malicious payloads hidden in ADS. Forensic examiners must explicitly enumerate streams using specialized tools (e.g., streams.exe, lads, or forensic suites) and inspect the $MFT attribute list to identify these hidden data regions, as they are a classic anti-forensic hiding technique.

Why this answer

Alternate Data Streams (ADS) allow additional data to be attached to a file on an NTFS volume without altering the file's main data stream or its visible size in directory listings. This is possible because NTFS organizes file data into multiple streams; the default $DATA stream holds the visible content, while additional named streams can store hidden data. Tools like `dir` or Windows Explorer only report the size of the unnamed $DATA stream, making ADS an effective method for concealing data.

Exam trap

The CHFI exam often tests the misconception that the Master File Table ($MFT) is the primary location for hiding data, but the trap here is that ADS directly allows data to be stored in a file without changing its visible size, while $MFT manipulation (e.g., slack space) is a different, more complex technique.

How to eliminate wrong answers

Option B (Volume Shadow Copy) is wrong because it is a backup and recovery feature that creates point-in-time snapshots of volumes, not a mechanism for hiding data within a file without affecting its visible size. Option C (USN Journal) is wrong because it is a change journal that records modifications to files on an NTFS volume, used for tracking changes, not for storing hidden data. Option D (Master File Table ($MFT)) is wrong because it is the central directory structure that stores metadata about every file and folder, but it does not allow data to be hidden within a file without affecting its visible size; the $MFT itself can be a target for hiding data via techniques like slack space, but that is not the feature described.

91
MCQeasy

An analyst examines the following Apache access log entry: 192.168.1.10 - - [10/Jan/2023:13:45:22 +0000] "GET /search.php?q=1%27%20UNION%20SELECT%201,2,3-- HTTP/1.1" 200 1234 "-" "Mozilla/5.0". Which attack is MOST likely indicated?

A.Path Traversal
B.SQL Injection
C.Cross-Site Scripting (XSS)
D.Remote File Inclusion
AnswerB

The UNION SELECT statement in the query parameter is a SQL injection technique to extract data from the database.

Why this answer

The log shows a UNION SELECT statement in the query parameter, indicating a SQL injection attempt. The URL-encoded single quote (') and comment (--) are classic SQLi payloads.

92
MCQhard

During an iOS forensic examination of an iCloud backup, an analyst finds that the SQLite database files for the Health app are encrypted. Which component is MOST likely responsible for encrypting this data, and what is required to decrypt it?

A.The data is encrypted with the device's hardware UID; decryption is impossible without Apple's assistance.
B.The data is encrypted using Apple's FileVault; decryption requires the user's iCloud password.
C.The data is encrypted using SQLCipher; decryption requires a 256-bit key stored in the Keychain.
D.The data is protected by iOS Data Protection using a key derived from the device passcode; decryption requires the passcode or a forensic bypass tool.
AnswerD

This is correct: iOS Health data is stored in HealthKit and protected by iOS Data Protection using a per-file key wrapped by a class key that depends on the device's UID and the user's passcode. The passcode is the critical user-supplied secret; without it, decryption typically requires a forensic bypass tool that can brute-force or otherwise recover the passcode, or leverage a trusted pairing/escrow keybag when available. Apple cannot simply decrypt the data because the passcode is not known to them.

Why this answer

IOS Health app data is protected by iOS Data Protection, which uses a class key derived from the user's device passcode. This key encrypts the SQLite database files in iCloud backups, and decryption requires either the passcode or a forensic bypass tool that can extract the key from the device's Secure Enclave.

Exam trap

EC-Council often tests the distinction between device-level encryption (hardware UID) and iCloud backup encryption (passcode-derived keys), and the trap here is confusing SQLCipher (a third-party tool) with Apple's proprietary iOS Data Protection framework.

How to eliminate wrong answers

Option A is wrong because the hardware UID is used for device-level encryption of files on the local device, not for iCloud backup encryption; iCloud backups use a different key hierarchy involving the user's iCloud account and passcode. Option B is wrong because FileVault is a macOS full-disk encryption technology, not used on iOS or for iCloud backup encryption. Option C is wrong because SQLCipher is a third-party encryption library that apps can use, but Apple's Health app uses iOS Data Protection (Apple's built-in encryption framework), not SQLCipher; the key is derived from the passcode and stored in the Secure Enclave, not in the Keychain as a 256-bit key.

93
MCQhard

You are a forensic investigator responding to an incident at a financial institution. The organization uses Microsoft SQL Server 2016 for its transaction processing system. The database is configured with full recovery model and transaction log backups are taken every 15 minutes. The incident response team has identified that an attacker gained access to the database server via compromised credentials and executed a series of malicious SQL statements, including data exfiltration and deletion of critical records. The time of the attack is estimated to be between 2:00 PM and 2:05 PM. The last full backup was taken at 12:00 AM (midnight) the same day. Transaction log backups are available for the entire day. The last transaction log backup before the attack was taken at 1:45 PM. The next transaction log backup after the attack was taken at 2:15 PM. The database is still online and being used by the business. Management wants to recover the database to a point just before the attack (2:00 PM) to minimize data loss, while preserving evidence for investigation. Which of the following actions should you take FIRST?

A.Perform a tail-log backup of the database using the NORECOVERY option to capture all transactions since the last log backup.
B.Immediately restore the full backup from midnight and all transaction log backups up to 1:45 PM to a separate server for forensic analysis.
C.Shut down the SQL Server service to prevent further changes and then restore the database from backup.
D.Restore the database to a point in time using the full backup and all transaction log backups up to 1:45 PM, then apply the 2:15 PM backup to recover lost data.
AnswerA

Performing a tail-log backup with NORECOVERY captures every transaction that was recorded in the active portion of the transaction log after the last full transaction log backup, including transactions in flight or not yet backed up. The NORECOVERY option transitions the database into the Restoring state, preserving the current transaction log as a backup file that can be used for point-in-time recovery. This is the only way to preserve the complete post-backup forensic evidence, and it must be done before any restore operation is attempted.

Why this answer

Performing a tail-log backup with NORECOVERY captures all transactions committed after the last log backup (1:45 PM) up to the current point in time, including the attack period. This preserves the database in a restoring state, preventing further changes while allowing point-in-time recovery to just before 2:00 PM. It is the mandatory first step to minimize data loss and maintain forensic integrity before any restore operations.

Exam trap

The CHFI exam often tests the misconception that you should immediately restore from the last known good backup or shut down the server, when the correct first action is always to secure the current transaction log via a tail-log backup to capture all recent changes and enable precise point-in-time recovery.

How to eliminate wrong answers

Option B is wrong because restoring backups to a separate server for forensic analysis is a valid subsequent step, but it should not be performed first; the immediate priority is to capture the tail of the transaction log from the live database to avoid losing transactions that occurred after the last log backup. Option C is wrong because shutting down the SQL Server service would abruptly terminate the database and could corrupt the transaction log, potentially losing the tail-log data needed for point-in-time recovery; a controlled tail-log backup is required instead. Option D is wrong because applying the 2:15 PM backup would include the attacker's malicious transactions and deletions, which would reintroduce the compromised data and fail to achieve recovery to just before the attack.

94
Multi-Selectmedium

A forensic analyst is investigating a Windows system for persistence mechanisms. Which TWO registry locations are commonly used by malware to achieve auto-start? (Select TWO.)

Select 2 answers
A.HKLM\SYSTEM\CurrentControlSet\Services
B.HKLM\SAM\SAM
C.HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
D.HKCU\Software\Microsoft\Windows\CurrentVersion\Run
E.HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AnswersD, E

This is the Run key for the current user.

Why this answer

The HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key is a standard auto-start location where malware can add entries to execute programs when a user logs in. This key is commonly abused because it does not require administrative privileges to modify, making it a frequent persistence mechanism for user-level malware.

Exam trap

In the CHFI exam, the trap here is that candidates may confuse the Run keys with other persistence locations like the Services key (Option A) or Winlogon (Option C), but the question specifically asks for the two most common auto-start registry locations, which are the HKLM and HKCU Run keys.

95
MCQmedium

A forensic examiner uses Oxygen Forensic Detective to acquire data from an Android device. The tool reports that it performed a 'full file system' extraction. Which of the following is a prerequisite for this type of extraction?

A.The bootloader must be unlocked
B.The device must be rooted
C.The device must be in recovery mode
D.USB debugging must be enabled
AnswerB

Root access is the decisive prerequisite because Android's kernel sandbox prevents the unprivileged adbd shell user from reading package-private app data, protected system directories, or raw block devices. With root, Oxygen Forensic Detective can execute su or other elevated commands to access /data, application databases, caches, and system partitions, enabling a true file-system extraction. Without root, the tool may still perform a logical extraction of contacts, call logs, and media via public APIs, but the deep application artifacts and deleted-record areas hidden in the file system remain out of reach.

Why this answer

A full file system extraction in Oxygen Forensic Detective requires root access on the Android device because the tool must bypass the Linux kernel's permission model to read protected partitions (e.g., /data, /cache). Without root privileges, the extraction is limited to the logical or file-based scope, as the Android security model restricts user-space processes from accessing raw block devices or system files owned by root.

Exam trap

EC-Council often tests the misconception that USB debugging alone enables full file system extraction, but in reality, USB debugging only provides ADB shell access with limited (shell) user privileges, not the root-level access required for raw partition imaging.

How to eliminate wrong answers

Option A is wrong because an unlocked bootloader is a prerequisite for flashing custom recovery or rooting, but it is not directly required for a full file system extraction; the extraction itself can be performed on a device with a locked bootloader if root access is already obtained. Option C is wrong because recovery mode is used for flashing firmware or performing factory resets, not for forensic extraction; Oxygen Forensic Detective typically requires the device to be booted into Android with USB debugging enabled and root access granted. Option D is wrong because USB debugging is necessary for ADB communication and logical extractions, but it alone does not grant the elevated privileges needed to read the full file system; root access is the critical prerequisite.

96
MCQhard

An organization uses Microsoft SQL Server 2019 with full recovery model. A database administrator accidentally executed a DROP TABLE statement. The transaction log was backed up immediately after the incident. Which forensic technique would allow the analyst to restore the dropped table?

A.Restore the transaction log backup taken after the DROP TABLE and apply it to the database.
B.Use the RESTORE LOG statement with the NO_TRUNCATE option to recover the table.
C.Perform a tail-log backup, then restore the full backup and all subsequent transaction log backups, stopping before the DROP TABLE.
D.Restore the most recent full backup and ignore subsequent transaction log backups.
AnswerC

The correct procedure is to first back up the tail of the transaction log to capture all log records generated since the last backup, including the DROP TABLE transaction. Then restore the most recent full backup in NORECOVERY mode, followed by every subsequent transaction log backup using STOPAT (or STOPBEFOREMARK) set to a time just before the drop. This rolls the database forward to the pre-drop state while preserving all earlier committed changes.

Why this answer

Under the full recovery model, point-in-time recovery is required to undo the DROP TABLE. By performing a tail-log backup (to capture any transactions after the last log backup), then restoring the full backup and all subsequent transaction log backups with STOPAT or STOPBEFOREMARK to the moment just before the DROP TABLE, the analyst can recover the table without losing other transactions. This is the only method that preserves the dropped table's data while maintaining database consistency.

Exam trap

The trap here is that candidates often think a simple transaction log restore (Option A) or a full backup restore (Option D) will suffice, failing to recognize that point-in-time recovery with a tail-log backup and STOPAT is required to skip the destructive DDL statement.

How to eliminate wrong answers

Option A is wrong because restoring only the transaction log backup taken after the DROP TABLE would apply the DROP TABLE operation again, permanently removing the table. Option B is wrong because the NO_TRUNCATE option is used to back up a tail of the log when the database is damaged or offline, not to recover a dropped table; it does not provide point-in-time recovery to skip the DROP. Option D is wrong because restoring only the most recent full backup would lose all changes made after that backup, including the data that existed before the DROP, and would not recover the dropped table.

97
MCQmedium

An investigator needs to acquire data from a suspect's hard drive without altering any data. Which tool is MOST appropriate to ensure write-blocking at the hardware level?

A.Tableau Forensic Bridge (hardware write-blocker)
B.FTK Imager (software write-blocker)
C.dd command with 'iflag=noatime'
D.EnCase software acquisition module
AnswerA

A Tableau Forensic Bridge is a dedicated hardware write-blocker physically interposed between the forensic workstation and the suspect drive; it intercepts and discards all write commands at the bus level (e.g., SATA, IDE, or USB) using its own firmware and logic, rather than relying on the operating system. This makes it impossible for the OS, forensic software, or malicious code to alter the evidence drive, because write operations are terminated at the hardware interface before reaching the storage medium. Hardware write-blocking is the forensic gold standard and is the most defensible method for maintaining a pristine image.

Why this answer

A hardware write-blocker like the Tableau Forensic Bridge sits between the suspect drive and the forensic workstation at the physical layer, intercepting and blocking any write commands (e.g., ATA WRITE DMA, SCSI WRITE) before they reach the drive. This ensures that no data—including metadata, timestamps, or file system artifacts—is altered during acquisition, which is critical for maintaining evidentiary integrity. Software-based blockers can be bypassed by the OS or a malicious driver, making hardware-level blocking the gold standard in forensic acquisition.

Exam trap

EC-Council often tests the misconception that a software write-blocker (like FTK Imager’s built-in blocker) provides the same level of protection as a hardware write-blocker, when in fact only hardware-level blocking can prevent all write operations—including those from the OS, BIOS, or malicious firmware—from reaching the drive.

How to eliminate wrong answers

Option B (FTK Imager software write-blocker) is wrong because software write-blockers operate at the OS or driver level and can be circumvented by a compromised kernel, a buggy driver, or a direct hardware access command (e.g., via ATA passthrough), so they do not guarantee true hardware-level write protection. Option C (dd command with 'iflag=noatime') is wrong because 'iflag=noatime' only prevents the OS from updating access timestamps on the source file during a dd read, but it does not block write commands at the hardware interface—any write issued by the OS or a misconfigured tool could still reach the drive. Option D (EnCase software acquisition module) is wrong because, while EnCase can use a hardware write-blocker, its software acquisition module alone relies on the OS’s read-only mount or driver-level filtering, which is not a hardware-level write-block and can be overridden by direct disk writes or firmware commands.

98
MCQmedium

An organization receives a legal hold notice regarding pending litigation. The IT department is instructed to preserve all relevant electronically stored information. What is the primary action the IT department should take?

A.Place a hold on relevant data and suspend routine deletion policies
B.Ignore the notice and continue normal operations
C.Create a forensic image of all servers immediately
D.Permanently delete all emails older than 30 days to reduce storage
AnswerA

A legal hold triggers a duty to preserve all potentially relevant data in their native form, so you must place a litigation hold on the specific systems, files, email mailboxes, and backups that could contain responsive information. This includes actively suspending any automated deletion, archival, or retention policies that would destroy or alter that data, ensuring it remains intact and available for later discovery without necessarily needing forensic duplication.

Why this answer

The primary action is to place a legal hold on relevant data and suspend routine deletion policies. This ensures that all potentially relevant electronically stored information (ESI) is preserved in its current state, preventing spoliation and compliance with the legal hold notice. Suspending deletion policies stops automated processes like email purge jobs or document retention schedules from destroying evidence, which is a foundational step in the e-discovery process.

Exam trap

EC-Council often tests the misconception that the immediate response to a legal hold is to create forensic images of all systems, but the correct first step is to suspend deletion policies to prevent data loss before any imaging or collection occurs.

How to eliminate wrong answers

Option B is wrong because ignoring the notice and continuing normal operations would constitute spoliation of evidence, violating the legal hold and potentially leading to severe legal sanctions, including adverse inference instructions or monetary penalties. Option C is wrong because creating a forensic image of all servers immediately is an overreaction and not the first step; imaging is a preservation technique but should be targeted and performed after identifying the scope of relevant data, not indiscriminately across all servers, which is disruptive and unnecessary. Option D is wrong because permanently deleting all emails older than 30 days is the exact opposite of preservation; it would destroy potentially relevant ESI and directly violate the legal hold, risking spoliation charges.

99
MCQeasy

A forensic analyst is examining a Windows malware sample using static analysis. Which tool is BEST suited for viewing the PE header structure, including sections, imports, and exports?

A.Strings
B.Ghidra
C.IDA Pro
D.PEiD
AnswerD

PEiD (Portable Executable Identifier) is a specialized forensic and reverse-engineering tool that statically parses PE files to identify the compiler, linker, and—most importantly—the packer or protector used. It extracts and displays PE header details such as the entry point, the section table with names and sizes, and optional header fields, then cross-references them against a signature database of known packers (e.g., UPX, ASPack, Themida) using byte patterns and section heuristics. For a malware analyst performing triage, PEiD instantly reveals whether a binary is packed and which tool packed it, making it the correct choice for PE header and packer analysis.

Why this answer

PEiD is specifically designed to analyze PE (Portable Executable) headers, making it ideal for quickly viewing section tables, import/export tables, and detecting packers or compilers. It parses the IMAGE_NT_HEADERS structure directly, providing a concise summary of the PE layout without requiring disassembly or decompilation.

Exam trap

EC-Council often tests the distinction between a specialized PE header analysis tool (PEiD) and general-purpose reverse-engineering tools (Ghidra, IDA Pro), leading candidates to choose a more complex tool when a simpler, purpose-built one is correct.

How to eliminate wrong answers

Option A is wrong because Strings is a command-line tool that extracts readable ASCII/Unicode strings from a binary, not a PE header parser. Option B is wrong because Ghidra is a full reverse-engineering framework focused on disassembly and decompilation, not a lightweight PE header viewer. Option C is wrong because IDA Pro is a disassembler/debugger that can show PE headers but is overkill for this specific task and not the best tool for a quick header inspection.

100
Multi-Selecthard

During a forensic analysis of an SSD, the analyst encounters challenges due to TRIM and wear-leveling. Which TWO statements accurately describe the impact of these features on data recovery?

Select 2 answers
A.TRIM immediately and permanently erases deleted file data at the block level
B.Wear-leveling can scatter fragments of a file across different NAND chips, complicating physical imaging
C.Both TRIM and wear-leveling are transparent to the operating system and have no impact on forensic analysis
D.Wear-leveling ensures that deleted files are overwritten with zeros to prevent forensic recovery
E.TRIM is only effective on HDDs, not SSDs
AnswersA, B

TRIM commands cause the SSD to erase blocks, preventing recovery.

Why this answer

A is correct because TRIM commands (ATA Data Set Management command) instruct the SSD controller to immediately erase invalidated logical block addresses (LBAs) at the block level, making the original data unrecoverable via standard forensic tools. This is not a simple deletion of file system metadata but a physical erasure of the underlying NAND flash cells, which prevents recovery of the file content even with advanced carving techniques.

Exam trap

EC-Council's CHFI exam often tests the misconception that TRIM is a file system operation or that wear-leveling actively sanitizes deleted data, when in reality TRIM is a hardware-level command and wear-leveling is a longevity mechanism that incidentally complicates forensic reconstruction.

101
MCQeasy

In Android forensics, which of the following acquisition methods provides the most complete and forensically sound image of the device's internal storage?

A.Manual extraction through the user interface
B.Logical extraction via ADB
C.File system extraction
D.Physical extraction using a JTAG or chip-off technique
AnswerD

Physical extraction using a JTAG or chip-off technique is the most comprehensive acquisition method because it reads the raw flash memory chips directly, bypassing the Android operating system and its file system driver. JTAG (Joint Test Action Group) connects to the device's test access port to command the CPU to dump the flash contents, while chip-off involves physically desoldering the NAND/eMMC chip and reading it with a dedicated programmer; both yield a complete bit-for-bit image of the entire flash memory, including deleted files, unallocated space, hidden partitions, and data remnants that software-based methods cannot access. This approach is particularly valuable when the device is damaged, locked, or otherwise unresponsive, though it is invasive, may require breaking the device, and demands deep knowledge of the specific chip datasheet and interface protocols.

Why this answer

Physical extraction using a JTAG or chip-off technique provides the most complete and forensically sound image because it accesses the raw NAND flash memory at the hardware level, bypassing the operating system and any software-based restrictions. This method captures deleted data, unallocated space, and the entire file system structure, including areas not accessible via logical or file system extractions, ensuring a bit-for-bit copy of the internal storage.

Exam trap

EC-Council often tests the misconception that logical extraction via ADB is sufficient for a complete forensic image, but candidates must recognize that only physical methods (JTAG/chip-off) capture the entire raw storage, including deleted and hidden data.

How to eliminate wrong answers

Option A is wrong because manual extraction through the user interface only captures data visible to the user through the device's screen and does not access underlying file systems, deleted data, or unallocated space, making it highly incomplete and not forensically sound. Option B is wrong because logical extraction via ADB (Android Debug Bridge) uses the Android operating system's APIs to retrieve only active files and directories, missing deleted data, slack space, and low-level system partitions. Option C is wrong because file system extraction, while more thorough than logical extraction, still relies on the device's kernel to parse the file system and cannot recover data from unallocated blocks or areas outside the mounted file system, unlike physical extraction.

102
MCQmedium

A security analyst reviews Windows Security Event Logs and finds multiple Event ID 4625 entries from a single source IP address targeting various usernames. Which type of attack is MOST likely occurring?

A.Password spraying attack
B.Brute-force attack on a single account
C.Pass-the-hash attack
D.Kerberoasting attack
AnswerA

Password spraying is a low-and-slow attack in which an adversary chooses a handful of common passwords and tries them individually across many user accounts from a single source IP. In Windows Security logs this manifests as multiple Event ID 4625 failed-logon events with different account names but the same source workstation/IP and a common failure code such as 0xC000006D, often within a short window. Because each account is hit only once or twice, the total event volume stays low, evading threshold-based brute-force detection while still matching the observed pattern of many usernames from the same source.

Why this answer

Event ID 4625 indicates a failed logon attempt. When multiple usernames are targeted from a single source IP, it suggests the attacker is trying a small set of common passwords against many accounts to avoid account lockout thresholds. This is the hallmark of a password spraying attack, which differs from a brute-force attack that focuses on many passwords for one account.

Exam trap

EC-Council often tests the distinction between 'many passwords, one user' (brute-force) and 'few passwords, many users' (password spraying), and the trap here is that candidates see multiple failed logons and immediately think brute-force, overlooking the pattern of multiple usernames from a single IP.

How to eliminate wrong answers

Option B is wrong because a brute-force attack on a single account would show repeated 4625 events for the same username, not multiple different usernames. Option C is wrong because a pass-the-hash attack uses NTLM hash values to authenticate without needing the plaintext password, and it typically results in successful logon events (Event ID 4624), not a series of failed logons. Option D is wrong because Kerberoasting targets service accounts by requesting Kerberos service tickets (TGS-REQ) and does not generate Event ID 4625; it instead produces Event ID 4769 with specific attributes.

103
Multi-Selectmedium

During a forensic investigation of a Windows 10 system, you need to analyze the file system to recover deleted files. Which TWO file system artifacts would be most useful for this purpose?

Select 2 answers
A.$LogFile
B.$Boot file
C.$MFT (Master File Table)
D.$Volume
E.$Bitmap
AnswersA, C

The $LogFile records metadata changes, including deletions; can help reconstruct file history.

Why this answer

$LogFile (A) records metadata changes to the NTFS volume, including transactions that can be replayed to recover file names and directory entries for recently deleted files. $MFT (C) contains the master file table entries for every file and directory; even after deletion, the MFT entry often remains until overwritten, allowing recovery of file attributes and data runs.

Exam trap

EC-Council often tests the misconception that $Bitmap is the primary artifact for file recovery, but it only shows which clusters are free, not the file names or metadata needed to reconstruct deleted files.

104
MCQeasy

A security analyst reviews Windows Security Event Log and observes Event ID 4625 repeatedly for a single user account from a remote IP address within a short timeframe. What is the MOST likely cause?

A.The user successfully logged on from a remote workstation
B.A brute-force password attack is occurring against that account
C.The user's account was created
D.A service was installed on the system
AnswerB

Repeated failed logons from a remote IP indicate a brute-force attack.

Why this answer

Event ID 4625 indicates a failed logon attempt. When this event is logged repeatedly for the same user account from a single remote IP address within a short timeframe, it is a classic indicator of an automated brute-force password attack, where an attacker tries many passwords against that account in rapid succession.

Exam trap

The trap here is that candidates may confuse Event ID 4625 with a successful logon (4624) or think it indicates account creation, but the CHFI exam tests the precise mapping of Event IDs to security events to catch those who rely on vague memory rather than exact knowledge.

How to eliminate wrong answers

Option A is wrong because Event ID 4625 specifically denotes a failed logon, not a successful one (which would be Event ID 4624). Option C is wrong because account creation is logged as Event ID 4720, not 4625. Option D is wrong because service installation generates Event ID 4697 (or 7045 in the System log), not 4625.

105
MCQmedium

During a forensic investigation, you need to acquire the RAM of a running Linux system. Which tool is specifically designed for memory acquisition on Linux?

A.Memdump
B.Volatility
C.WinPmem
D.LiME
AnswerD

LiME is the recommended tool for Linux memory acquisition.

Why this answer

LiME (Linux Memory Extractor) is the correct tool because it is specifically designed to capture volatile memory (RAM) from Linux systems, loading as a loadable kernel module (LKM) to dump memory contents to a file or over the network. Unlike generic tools, LiME handles kernel address space layout randomization (KASLR) and can acquire memory without altering the system state, making it the standard for Linux forensic memory acquisition.

Exam trap

The CHFI exam often tests the distinction between acquisition and analysis tools, so the trap here is that candidates confuse Volatility (an analysis tool) with a memory acquisition tool, or assume WinPmem works on Linux because of the 'pmem' name, when it is Windows-only.

How to eliminate wrong answers

Option A is wrong because Memdump is a generic term for memory dumping utilities and not a specific tool for Linux memory acquisition; it often refers to Windows-based tools or simple dd commands, lacking the kernel module approach needed for reliable Linux RAM capture. Option B is wrong because Volatility is a memory analysis framework used to examine memory dumps, not a tool for acquiring memory; it processes existing dumps but does not perform the acquisition itself. Option C is wrong because WinPmem is a memory acquisition tool designed exclusively for Windows systems, using the winpmem driver to access physical memory, and is not compatible with Linux.

106
MCQeasy

During a mobile forensics investigation, an examiner needs to acquire data from an iPhone running iOS 14. Which of the following acquisition methods provides the MOST complete data extraction?

A.File system acquisition via jailbreak
B.Manual acquisition by browsing the device
C.Physical acquisition via JTAG or chip-off
D.Logical acquisition via iTunes backup
AnswerC

Physical acquisition via JTAG or chip-off is the gold standard for mobile forensic imaging because it accesses the raw NAND/eMMC storage controller directly, independent of the device's operating system. JTAG exploits the Joint Test Action Group debug port to force the CPU to dump memory, while chip-off removes the memory chip and reads it with a programmer; both produce a complete bit-for-bit forensic image, including deleted data, unallocated clusters, and partially overwritten file remnants that would be unavailable through any logical method. This approach preserves the entire chip's contents and allows advanced data recovery, though it requires skill, may destroy the device during chip removal, and must be performed with proper anti-static and bitstream-level hashing procedures.

Why this answer

Physical acquisition via JTAG or chip-off provides the most complete data extraction because it captures a bit-for-bit copy of the raw NAND flash memory, including deleted files, unallocated space, and system partitions that are otherwise inaccessible. On iOS 14, Apple's security features (e.g., full-disk encryption, SEP) limit logical and file system methods, but physical techniques bypass the operating system to retrieve the entire storage image, albeit with decryption challenges.

Exam trap

EC-Council often tests the misconception that jailbreak-based file system acquisition is the most complete method, but physical acquisition (JTAG/chip-off) is technically superior because it captures the entire raw storage, including areas the OS hides or encrypts.

How to eliminate wrong answers

Option A is wrong because jailbreaking iOS 14 is often not possible or reliable due to Apple's hardened security (e.g., KTRR, PAC), and even if achieved, file system acquisition still cannot access the raw physical memory or unallocated space, leaving gaps in data recovery. Option B is wrong because manual acquisition only captures visible data through the user interface, missing hidden files, metadata, and deleted content, making it the least complete method. Option D is wrong because logical acquisition via iTunes backup only retrieves files that iOS chooses to include in the backup (e.g., app data, settings), excluding system files, deleted data, and unallocated space, and it relies on the backup encryption state.

107
MCQmedium

Which of the following is a key requirement for digital evidence to be considered admissible in court?

A.The evidence must be authentic and its integrity must be verifiable
B.The evidence must have been collected by a law enforcement officer
C.The evidence must be stored on a write-blocked device
D.The evidence must be encrypted to ensure confidentiality
AnswerA

To be admissible, digital evidence must be authenticated — the proponent must show it is what it claims to be — and its integrity must be verifiable through a demonstrable chain of custody and cryptographic hash values. Courts require these to ensure the evidence has not been altered or corrupted from the time of acquisition to presentation, as a failure to prove authenticity or integrity undermines its reliability and relevance.

Why this answer

Digital evidence must be authentic and its integrity verifiable to meet the legal standard of admissibility, as established by rules such as the Federal Rules of Evidence (FRE 901) and the Daubert standard. Authentication requires proving that the evidence is what it claims to be, typically through a hash value (e.g., MD5, SHA-1, or SHA-256) computed before and after analysis to ensure no tampering occurred. Without verifiable integrity, the evidence could be challenged as altered, making it inadmissible regardless of how it was collected.

Exam trap

EC-Council often tests the misconception that procedural steps like write-blocking or law enforcement involvement are legal requirements, when in fact the core admissibility criterion is the ability to prove authenticity and integrity through verifiable means like hash values and chain of custody documentation.

How to eliminate wrong answers

Option B is wrong because digital evidence can be collected by any qualified forensic examiner, not exclusively a law enforcement officer; private-sector investigators or certified forensic analysts often handle evidence in civil cases. Option C is wrong because while write-blocking is a best practice to preserve evidence integrity, it is not a legal requirement for admissibility; evidence stored on a non-write-blocked device may still be admissible if integrity is otherwise proven (e.g., via hash verification). Option D is wrong because encryption is not a requirement for admissibility; in fact, encrypted evidence may be inadmissible if the decryption key is unavailable or if encryption obscures the evidence's authenticity, and confidentiality is separate from the legal standards of authenticity and integrity.

108
MCQeasy

In Android forensics, which command is used to extract a full physical image of a device's flash memory over USB using the Android Debug Bridge (ADB)?

A.adb pull /data data.img
B.adb shell dd if=/dev/block/mmcblk0 of=/sdcard/physical.img
C.adb backup -f backup.ab
D.adb install physical.img
AnswerB

adb shell dd if=/dev/block/mmcblk0 of=/sdcard/physical.img invokes the dd utility on the device to read the raw block device /dev/block/mmcblk0, which typically represents the entire internal storage or eMMC chip. This creates a bit-for-bit physical image that includes all data, including deleted files and unallocated sectors, making it ideal for forensic analysis; in practice, you would often redirect output via adb exec-out to a host rather than write to /sdcard to avoid altering evidence.

Why this answer

The `adb shell dd if=/dev/block/mmcblk0 of=/sdcard/physical.img` command uses the `dd` utility to perform a bit-for-bit copy of the raw block device representing the internal flash memory (mmcblk0) to a file on the device's SD card, which can then be pulled via ADB. This method captures a full physical image, including deleted data and unallocated space, which is essential for deep forensic analysis.

Exam trap

The CHFI exam often tests the distinction between logical acquisition (adb pull) and physical acquisition (adb shell dd), so the trap here is that candidates confuse the simple file copy command (adb pull) with the raw block-level imaging command (adb shell dd), assuming any command with 'pull' or 'backup' can produce a forensic image.

How to eliminate wrong answers

Option A is wrong because `adb pull /data data.img` only copies the logical contents of the /data partition, not a raw block-level image, and thus misses deleted files, unallocated space, and metadata from other partitions. Option C is wrong because `adb backup -f backup.ab` creates a logical backup of app data and system settings, not a physical image of flash memory; it does not capture the raw block device or unallocated space. Option D is wrong because `adb install physical.img` is used to install an APK file, not to extract an image; attempting to install a raw image file would fail or corrupt the device.

109
MCQmedium

During an investigation, a forensic analyst must preserve a hard drive that is part of a RAID array. Which of the following is the MOST appropriate method to preserve the evidence?

A.Power off the system and remove only the drive with the operating system
B.Disconnect all drives and image a logical volume after the RAID controller
C.Image each physical drive individually using a write blocker
D.Rebuild the array in a different system and then image
AnswerC

Imaging each physical drive individually with a write blocker is the correct forensic method because it guarantees that no write operations reach the source disks, allowing a true bit-for-bit copy of every member, including unallocated space, deleted metadata, and RAID configuration data. With complete images of all drives, the array can be reconstructed offline in a controlled environment using tools like mdadm or specialist RAID recovery software, preserving the original order and stripe parameters. This maintains chain of custody and enables repeatable analysis without modifying evidence.

Why this answer

Imaging each physical drive individually with a write blocker preserves the exact bit-for-bit state of every disk in the RAID array, including metadata, parity, and superblock information. This approach ensures that the logical volume can be reconstructed later in a controlled environment without altering the original evidence, which is critical for maintaining chain of custody and forensic integrity.

Exam trap

EC-Council often tests the misconception that imaging a logical volume or rebuilding the array is acceptable, but the trap here is that any operation that allows the RAID controller or OS to write to the drives (even during a read) can alter evidence, making individual physical imaging with a write blocker the only forensically sound method.

How to eliminate wrong answers

Option A is wrong because removing only the operating system drive from a RAID array destroys the array's configuration and may cause the controller to mark the remaining drives as degraded or foreign, potentially overwriting critical metadata. Option B is wrong because imaging a logical volume after the RAID controller introduces the risk of the controller altering data during read operations (e.g., on-the-fly parity recalculation or bad block remapping), and it does not capture the physical state of each drive, which may be needed for parity analysis or recovery of deleted data. Option D is wrong because rebuilding the array in a different system can trigger automatic synchronization or reconstruction processes that modify data on the drives, thereby contaminating the evidence and violating forensic best practices.

110
MCQhard

A forensic examiner is analyzing an Android device that has been factory reset. Which of the following artefacts is MOST likely to still be recoverable from the device's flash memory after a factory reset, assuming no overwrite has occurred?

A.The GUID Partition Table (GPT)
B.The device's encryption keys
C.The Android OS system files
D.User data such as photos and contacts
AnswerD

A factory reset in Android formats the userdata partition by deleting its ext4 or f2fs metadata and marking blocks as free, but it does not necessarily overwrite the underlying sectors on the flash storage. Forensic examiners can therefore carve files from unallocated space using techniques like file signature carving, and if the device's encryption was disabled or the cryptographic keys can be derived/reset, data like photos and contacts may be reconstructed. This is precisely why the examiner should focus on residual user data in unallocated space after a reset.

Why this answer

After a factory reset on an Android device, the operating system typically performs a 'fastboot format' or 'wipe data/factory reset' which only unmounts the userdata partition and marks its blocks as free in the ext4 or F2FS filesystem metadata. The actual user data (photos, contacts, etc.) remains physically stored in the NAND flash memory until those blocks are overwritten by new data. Because no overwrite has occurred in this scenario, the raw data is still recoverable using forensic tools that bypass the filesystem and read the flash memory directly.

Exam trap

EC-Council often tests the misconception that a factory reset securely erases all data, when in fact it only removes filesystem pointers, leaving the underlying data recoverable until overwritten.

How to eliminate wrong answers

Option A is wrong because the GUID Partition Table (GPT) is stored in the boot partition area (LBA 1–34) and is not erased or affected by a factory reset; it remains intact and is not a user-data artifact. Option B is wrong because encryption keys are stored in the device's dedicated hardware-backed keystore (e.g., Trusted Execution Environment or StrongBox) and are securely wiped or invalidated during a factory reset, making them unrecoverable. Option C is wrong because Android OS system files reside in the system partition, which is read-only and not modified by a factory reset; they are not user data and are not the target of recovery in this context.

111
MCQmedium

An email forensic analyst receives a suspicious email and wants to verify the originating IP address. The analyst extracts the email headers and sees multiple 'Received' fields. Which 'Received' header should the analyst consider as the most trustworthy source of the sender's IP?

A.The first 'Received' header at the top
B.The last 'Received' header at the bottom
C.The 'X-Originating-IP' header
D.The 'Return-Path' header
AnswerB

The bottommost Received header is chronologically the first hop recorded, inserted by the sender's first SMTP server or mail user agent at the time of submission. It is the deepest part of the routing chain and provides the closest traceable IP/HELO information to the true origin, making it the best evidence for identifying the actual source. Analysts rely on this header because subsequent servers append above it without altering its content in normal operation.

Why this answer

The last 'Received' header at the bottom is the most trustworthy because email headers are added in reverse chronological order: each mail server prepends its own 'Received' field to the top of the header block. Therefore, the bottommost 'Received' header represents the first hop from the sender's MTA (Mail Transfer Agent) or the originating client, making it the closest to the true source IP.

Exam trap

A common trap in CHFI is to assume headers are chronological from top to bottom, leading candidates to select the first 'Received' header as the origin. In reality, the bottommost header is the earliest hop.

How to eliminate wrong answers

Option A is wrong because the first 'Received' header at the top is the most recent addition, added by the recipient's mail server, not the sender's; it reflects the last hop, not the origin. Option C is wrong because 'X-Originating-IP' is a non-standard, optional header that may be set by the sender's webmail interface (e.g., Outlook Web Access) but is often absent, easily spoofed, or not present in SMTP-transmitted emails; it is not a reliable forensic source. Option D is wrong because the 'Return-Path' header (or envelope sender) contains the bounce address (MAIL FROM) and is set by the sender's MTA, but it does not carry the originating IP address; it is used for delivery failure notifications, not for IP traceability.

112
MCQhard

A forensic investigator is analyzing a malware sample that appears to be packed. Using PEiD, the analyst detects an entropy value of 7.8 and the entry point section is named 'UPX0'. Which of the following tools should the analyst use NEXT to unpack the malware for static analysis?

A.UPX -d
B.Ghidra
C.Process Monitor
D.IDA Pro
AnswerA

UPX -d is the correct command-line invocation because the -d flag tells the UPX utility to decompress (unpack) an executable that was previously packed with UPX. This restores the original program code and data so a malware analyst can statically inspect the actual malicious logic rather than the small decompression stub. It is the most direct, automated method available in the standard toolset for this exact purpose.

Why this answer

The presence of 'UPX0' as the entry point section name and an entropy value of 7.8 (very high, indicating compression or encryption) strongly suggests the malware is packed with UPX (Ultimate Packer for eXecutables). The correct next step is to use UPX with the -d (decompress) switch to unpack the binary, restoring the original executable for static analysis. This is a standard, reversible unpacking method that does not require dynamic analysis or disassembly of the packed stub.

Exam trap

EC-Council often tests the distinction between tools for unpacking versus tools for analysis, expecting candidates to recognize that UPX -d is the direct unpacking utility, while Ghidra and IDA Pro are analysis tools that require an already-unpacked binary for effective static analysis.

How to eliminate wrong answers

Option B (Ghidra) is wrong because Ghidra is a reverse-engineering framework for disassembly and decompilation, not a dedicated unpacking tool; attempting to analyze a packed binary in Ghidra without first unpacking it would yield obfuscated or compressed code, making static analysis ineffective. Option C (Process Monitor) is wrong because Process Monitor is a dynamic analysis tool for capturing real-time system activity (registry, file system, process/thread activity), not for unpacking or static analysis of a binary. Option D (IDA Pro) is wrong because IDA Pro is an interactive disassembler and debugger; while it can be used to analyze packed binaries with plugins, the immediate next step after detecting UPX packing is to use the UPX tool itself to decompress the file, as IDA Pro is not a dedicated unpacker and would still require unpacking first for effective static analysis.

113
MCQhard

During a forensic investigation, an analyst uses the following command: dd if=/dev/sda of=/mnt/evidence/image.dd bs=4096 conv=noerror,sync. What is the effect of the conv=noerror,sync option?

A.It verifies the integrity of the image using a hash algorithm
B.It ignores read errors and pads bad blocks with zeros in the output image
C.It creates a compressed image to save disk space
D.It enables logging of all I/O errors to a separate file
AnswerB

The `noerror` flag instructs `dd` to continue copying when it encounters read errors, while the `sync` flag pads each failed read block with zeros so that the output image retains the same block size and overall length as the source. This prevents the process from aborting and produces a complete, though partially zero-filled, image for analysis. Without these flags, `dd` would terminate on the first read error and leave an incomplete image.

Why this answer

The `conv=noerror,sync` option in `dd` instructs the tool to continue processing even when a read error is encountered (`noerror`) and to pad the output block with zeros (`sync`) to maintain the correct block size and offset alignment. This ensures that the forensic image remains a bit-for-bit copy of the source device in terms of size and structure, with corrupted sectors replaced by zeros rather than causing the imaging process to abort or produce a truncated image.

Exam trap

The CHFI exam often tests the misconception that `conv=noerror,sync` performs error correction or data recovery, when in fact it simply ignores errors and pads with zeros, which can lead to data loss if the analyst assumes the image is pristine.

How to eliminate wrong answers

Option A is wrong because `conv=noerror,sync` does not perform any hash verification; integrity verification is done separately using tools like `md5sum`, `sha1sum`, or `dd` with `conv=noerror` combined with a separate hash calculation. Option C is wrong because `dd` does not compress data; compression requires piping through `gzip` or using `conv=lz4` (if supported) or a separate compression tool. Option D is wrong because `dd` does not have a built-in logging feature for I/O errors; error logging must be implemented by redirecting stderr or using wrapper scripts.

114
MCQmedium

Which Windows artifact is specifically designed to track the most recently used (MRU) files for specific applications and can be found in the NTUSER.DAT registry hive?

A.Prefetch files
B.Jump Lists
C.MRU lists in the registry
D.LNK files
AnswerC

Most Recently Used (MRU) lists in the registry are exactly the artifact designed for tracking recently opened files. For example, HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU stores PIDLs of files selected through common dialog boxes, while application-specific keys like HKCU\Software\Microsoft\Notepad and HKCU\Software\Microsoft\WordPad record the last file paths opened by those applications. These registry values are maintained by the operating system and applications specifically to store this historical MRU data, making them the canonical answer.

Why this answer

The NTUSER.DAT registry hive contains per-user MRU (Most Recently Used) lists that track files recently accessed by specific applications, such as the 'RecentDocs' key for Office applications or 'ComDlg32' for common dialog boxes. These registry keys are explicitly designed to store MRU data, making them the direct artifact for this purpose.

Exam trap

EC-Council often tests the distinction between registry-based MRU lists (stored in NTUSER.DAT) and file-system artifacts like Jump Lists or LNK files, so candidates mistakenly choose Jump Lists because they also track recent files, but they are not stored in the registry hive.

How to eliminate wrong answers

Option A is wrong because Prefetch files are located in the C:\Windows\Prefetch folder and track application launch sequences and file paths for system-wide performance optimization, not per-user MRU lists in the registry. Option B is wrong because Jump Lists are stored as .customDestinations-ms files in the user's AppData\Roaming\Microsoft\Windows\Recent directory and provide a graphical list of recent files for taskbar applications, but they are not stored in the NTUSER.DAT hive. Option D is wrong because LNK files (shortcuts) are stored in the user's Recent folder and other locations, tracking file access via shell link data, but they are not registry-based MRU lists within NTUSER.DAT.

115
MCQhard

During an internal investigation, an employee is suspected of leaking sensitive data. The security team finds that the employee's computer has been turned off. Which of the following evidence types would be LOST due to the system being powered off?

A.System logs stored in the Event Viewer
B.Files stored on the hard drive
C.Registry hives
D.Contents of RAM and network connections
AnswerD

The contents of RAM and active network connections are the most volatile evidence on a live system. RAM loses all data the instant power is cut, wiping out running processes, open network sockets, and any decrypted data or encryption keys; likewise, the current TCP/UDP connection table, ARP cache, and routing state exist only while the operating system is operational. Consequently, these must be captured using live forensic toolkits before shutdown, as any delay or power loss destroys them irrecoverably.

Why this answer

When a system is powered off, the contents of volatile memory (RAM) are immediately lost because RAM requires constant electrical power to retain data. Similarly, active network connections are terminated and their state is lost, as they are maintained in kernel memory structures that are not persisted to disk. Therefore, any evidence residing only in RAM (e.g., encryption keys, running processes, unencrypted data) or transient network session details (e.g., active TCP/UDP connections, IP addresses) is permanently lost upon shutdown.

Exam trap

The CHFI exam often tests the distinction between volatile and non-volatile evidence, and the trap here is that candidates mistakenly think system logs or registry hives are volatile because they are 'system' data, when in fact they are stored on the hard drive and persist after power-off.

How to eliminate wrong answers

Option A is wrong because system logs stored in the Event Viewer are written to the hard drive (e.g., %SystemRoot%\System32\winevt\Logs\) and persist across reboots; they are not lost when the system is powered off. Option B is wrong because files stored on the hard drive are non-volatile and remain intact after shutdown; they can be imaged and analyzed forensically even after power loss. Option C is wrong because registry hives (e.g., SAM, SYSTEM, SOFTWARE) are stored as files on the hard drive (e.g., C:\Windows\System32\config\) and survive power-off; they are not dependent on RAM for persistence.

116
MCQeasy

Which mobile forensics tool is specifically designed for physical extraction of iOS devices, including bypassing passcodes and extracting full file system images?

A.Oxygen Forensic Detective
B.Magnet AXIOM
C.Cellebrite UFED
D.GrayKey
AnswerD

GrayKey, developed by Grayshift, is a dedicated iOS forensic tool engineered specifically for physical extraction and passcode bypass. It exploits hardware and software vulnerabilities to gain full file-system access from locked iPhones/iPads, bypassing the Secure Enclave's retry limits. Law enforcement agencies use GrayKey for targeted deep extraction of iOS devices, making it the only option in this list uniquely designed for this purpose.

Why this answer

GrayKey is a specialized forensic tool developed by GrayShift that performs physical extraction on iOS devices, including bypassing passcodes and obtaining full file system images. It exploits hardware and software vulnerabilities in iOS to extract data, making it the correct choice for this specific task.

Exam trap

The trap here is that candidates often confuse Cellebrite UFED's broad device support with the specific ability to perform physical extraction and passcode bypass on iOS, but Cellebrite's iOS capabilities are more limited compared to GrayKey's specialized focus.

How to eliminate wrong answers

Option A is wrong because Oxygen Forensic Detective is a comprehensive forensic platform that supports logical and file system extractions for iOS, but it does not specialize in physical extraction or passcode bypass for iOS devices. Option B is wrong because Magnet AXIOM is a digital forensic tool that focuses on artifact analysis and logical extractions, not physical extraction or passcode bypass for iOS. Option C is wrong because Cellebrite UFED supports physical extraction for many devices, but for iOS, it primarily relies on logical extraction or using the device's backup, and does not consistently bypass passcodes for full physical extraction like GrayKey does.

117
MCQhard

During a forensic examination of a solid-state drive (SSD), the analyst notices that the TRIM command was enabled. What challenge does this pose for data recovery?

A.It erases data blocks immediately after deletion, preventing recovery
B.It causes fragmentation, making file recovery more complex
C.It causes the drive to encrypt data automatically
D.It physically destroys the NAND cells, making the drive unusable
AnswerA

When the OS deletes a file on an SSD with TRIM enabled, it sends an ATA DATA SET MANAGEMENT command that instructs the controller to physically erase the involved NAND blocks right away, rather than simply marking the space as reusable in the file system. This immediate erasure means that the actual data cells are zeroed or invalidated, eliminating the possibility of recovery with conventional file carving or deep recovery tools, which rely on residual data. From a forensic perspective, TRIM effectively defeats many standard deleted-file recovery workflows on modern SSDs.

Why this answer

The TRIM command (ATA Data Set Management command) instructs the SSD controller to immediately erase the physical NAND blocks corresponding to deleted logical block addresses (LBAs). This proactive garbage collection operation resets the cells to an erased state, making it impossible for forensic tools to recover the original data from those blocks, as the data is physically overwritten with null values or marked as invalid.

Exam trap

The trap here is that candidates may confuse TRIM with wear leveling or assume it only affects performance, missing the critical forensic implication that TRIM permanently destroys deleted data at the physical NAND level, making recovery impossible even with advanced techniques like chip-off or JTAG.

How to eliminate wrong answers

Option B is wrong because TRIM does not cause fragmentation; in fact, TRIM helps maintain performance by allowing the SSD controller to optimize block allocation, reducing write amplification and fragmentation. Option C is wrong because TRIM is a command for block erasure, not encryption; SSDs may support hardware encryption (e.g., OPAL or eDrive), but TRIM itself does not encrypt data. Option D is wrong because TRIM does not physically destroy NAND cells; it simply marks blocks as invalid for garbage collection, and normal wear from program/erase cycles is what eventually degrades cells, not the TRIM command itself.

118
Multi-Selectmedium

Which TWO of the following are essential components of a proper chain of custody documentation? (Select TWO)

Select 2 answers
A.The IP address of the forensic workstation
B.Backup location of the evidence
C.Date and time of evidence collection
D.Signature of the person handling the evidence
E.The forensic tool used to analyze the evidence
AnswersC, D

The exact date and time of evidence collection is a cornerstone of chain of custody, as it creates an unambiguous chronological reference point. This timestamp, along with the location and the person collecting the evidence, establishes when the evidence first came into official custody. It allows the court to reconcile the evidence's timeline with investigator actions and to detect any gaps or irregularities. Without a precise date and time, the entire chain of custody could be challenged for lack of evidence integrity.

Why this answer

The date and time of evidence collection is a fundamental element of chain of custody documentation, establishing a precise chronological record of when the evidence was acquired. This timestamp is critical for proving the integrity and continuity of the evidence from the moment of seizure, and it must be recorded with accuracy (often to the second) and in a consistent time zone (e.g., UTC) to avoid disputes. Without this, the chain of custody cannot demonstrate that the evidence was not tampered with between collection and analysis.

Exam trap

CHFI often tests the distinction between chain of custody elements (who, when, signature) and forensic analysis details (tools, IP addresses, backup locations), so candidates mistakenly select options like A or E because they confuse the documentation of the evidence's handling with the technical steps of the investigation.

119
MCQeasy

In an email header, which field typically contains the IP address of the original sending client?

A.Return-Path
B.Message-ID
C.Received
D.DKIM-Signature
AnswerC

The Received header is inserted by every SMTP server that handles the message, and each line records the IP address of the transmitting host, the receiving server, protocol information, and a timestamp. The bottommost Received line is the first one added, showing the connection from the originating client or its final relay. Therefore, forensically it is the go-to field for discovering the sending IP address.

Why this answer

The 'Received' field in an email header is added by each mail transfer agent (MTA) that processes the message, and the first 'Received' header (at the bottom of the header block) typically contains the IP address of the original sending client (the SMTP client that initiated the connection). This field records the 'from' IP and the 'by' host, making it the definitive source for tracing the origin of the email.

Exam trap

EC-Council often tests the misconception that the 'Return-Path' field contains the sender's IP address, when in fact it only holds the email address for bounce handling, not any network-layer information.

How to eliminate wrong answers

Option A is wrong because the 'Return-Path' field contains the envelope sender (the bounce address), not the IP address of the sending client; it is used for non-delivery reports, not for tracing the original source IP. Option B is wrong because the 'Message-ID' field is a unique identifier string generated by the sending MUA or MTA, but it does not contain any IP address information; it is used for message tracking and threading. Option D is wrong because the 'DKIM-Signature' field contains a cryptographic signature and associated domain information (e.g., d=domain), but it does not include the sending client's IP address; it is used for email authentication, not origin IP tracing.

120
MCQmedium

A company receives a legal hold notice regarding a lawsuit. What immediate action should the company take to comply?

A.Delete all emails older than 30 days to free up storage
B.Immediately format the hard drives of all employees involved
C.Preserve all potentially relevant electronic documents and data
D.Ignore the notice because it is not a court order
AnswerC

The correct action is to implement a litigation hold preserving all potentially relevant electronic documents and data, including emails, attachments, metadata, and backup copies. The organization must notify custodians of their duty and suspend any automated deletion, archiving, or alteration processes. This protects the integrity and provenance of the ESI so it can be produced in discovery without allegations of spoliation.

Why this answer

A legal hold notice triggers a duty to preserve all potentially relevant electronically stored information (ESI). Under the Federal Rules of Civil Procedure (FRCP) Rule 37(e), failure to preserve can lead to spoliation sanctions. The immediate action is to issue a litigation hold notice and suspend routine data deletion policies, ensuring that all relevant emails, documents, and logs are preserved in their current state.

Exam trap

EC-Council often tests the misconception that a legal hold notice is optional or that routine deletion policies can continue, but the trap is that preservation duties begin immediately upon anticipation of litigation, regardless of whether a formal court order has been served.

How to eliminate wrong answers

Option A is wrong because deleting emails older than 30 days violates the preservation obligation and constitutes spoliation, which can result in adverse inference instructions or monetary sanctions. Option B is wrong because formatting hard drives destroys all data, including potentially relevant evidence, and is a textbook example of intentional spoliation. Option D is wrong because a legal hold notice, even if not a formal court order, carries legal weight under FRCP and common law; ignoring it can lead to severe penalties for failure to preserve evidence.

121
MCQmedium

An investigator is examining a FAT32 filesystem and needs to recover a deleted file. In FAT32, the directory entry for a deleted file has the first byte of the filename set to 0xE5. What does this indicate?

A.The file is a system file
B.The file is hidden
C.The file is encrypted
D.The file has been deleted
AnswerD

In FAT32, when a file or directory is deleted, the first byte of its 8.3 directory entry is replaced with 0xE5, which serves as a deletion/free marker. This is why 0xE5 in the first byte of a directory entry is a reliable indicator that the file has been deleted (or the directory entry is free). The remainder of the entry—including the starting cluster number, file size, and timestamps—often remains unchanged until the entry is reused, which is what makes data recovery possible.

Why this answer

In FAT32, when a file is deleted, the directory entry's first byte (the filename's first character) is overwritten with the value 0xE5. This is a deliberate marker used by the file system to indicate that the entry is available for reuse, meaning the file has been logically deleted. The data clusters remain intact until overwritten, which is why recovery tools look for entries with this byte to restore deleted files.

Exam trap

The trap here is that candidates confuse the 0xE5 deletion marker with other attribute flags (like hidden or system) or assume it indicates encryption, because they memorize attribute bits but overlook the specific byte value used for deletion in FAT directory entries.

How to eliminate wrong answers

Option A is wrong because system files in FAT32 are marked by the 'System' attribute bit in the directory entry's attribute byte, not by the first byte of the filename being 0xE5. Option B is wrong because hidden files are indicated by the 'Hidden' attribute bit (0x02) in the attribute field, not by the filename's first byte. Option C is wrong because FAT32 does not support native file encryption; encryption is handled at the application or OS level (e.g., EFS on NTFS), and there is no filename byte marker for encryption in FAT32.

122
MCQmedium

An investigator needs to recover a deleted partition from a disk that originally used an MBR partition table. Which tool can scan the disk for lost partitions and rebuild the partition table?

A.TestDisk
B.FTK Imager
C.Autopsy
D.PhotoRec
AnswerA

TestDisk is a specialized partition recovery utility that scans raw disk media for the signatures of missing or deleted partition entries, then rebuilds the Master Boot Record (MBR) or GUID Partition Table (GPT) so the original logical volumes become accessible again. Unlike file carvers, it restores the partition-level addressing that the operating system needs before any filesystem or file-level analysis can proceed. This makes it the correct tool when the goal is recovering a deleted partition rather than individual files.

Why this answer

TestDisk is specifically designed for data recovery and can scan a disk for lost partitions by analyzing the underlying MBR (Master Boot Record) structure. It can rebuild the partition table by searching for partition boot sectors and file system signatures, allowing recovery of deleted or corrupted partitions. This makes it the correct tool for the scenario described.

Exam trap

The trap here is that candidates often confuse PhotoRec (file recovery) with TestDisk (partition recovery), assuming both tools perform the same function, when in fact PhotoRec only recovers files and cannot rebuild partition tables.

How to eliminate wrong answers

Option B (FTK Imager) is wrong because it is a forensic imaging tool used to create bit-for-bit copies of drives and view file system contents, not to scan for lost partitions or rebuild partition tables. Option C (Autopsy) is wrong because it is a digital forensics platform that analyzes disk images and file systems, but it does not have native functionality to recover deleted partitions or rebuild MBR partition tables. Option D (PhotoRec) is wrong because it is a file carving tool that recovers individual files based on file signatures, not partitions; it operates at the file level, not the partition table level.

123
MCQeasy

A first responder is called to investigate a potential insider threat. The suspect's computer is turned off. What is the BEST procedure?

A.Compute a hash of the hard drive using a live CD.
B.Check the power cord and peripherals for tampering.
C.Seize the computer and transport it to a forensic lab for imaging.
D.Turn on the computer to see if it boots normally.
AnswerC

Seizing the computer and transporting it to a forensic lab preserves the original evidence for a proper bit-for-bit image using a write-blocker, ensuring data integrity and admissibility. A controlled lab environment allows for secure storage and careful analysis before any acquisition, maintaining a documented chain of custody from the scene onward. This is the recognized best practice for first responders.

Why this answer

When a suspect's computer is already turned off, the best procedure is to seize it and transport it to a forensic lab for imaging. This preserves the integrity of the evidence by preventing any accidental modification of the hard drive's contents, which could occur if the system is powered on or booted from a live CD. In forensic best practices, the first responder should never boot a suspect's computer, as doing so can alter critical system files, timestamps, and volatile data, compromising the chain of custody and admissibility of evidence.

Exam trap

EC-Council often tests the misconception that booting from a live CD is safe because it doesn't touch the hard drive, but in reality, even a live CD can modify the system's registry, page file, or metadata through normal operation, which is why seizing the computer for lab imaging is the only forensically sound option.

How to eliminate wrong answers

Option A is wrong because computing a hash of the hard drive using a live CD requires booting the suspect's computer, which alters the system state (e.g., writes to the page file, updates last access times) and violates the forensic principle of not modifying evidence. Option B is wrong because checking the power cord and peripherals for tampering is a physical inspection step that, while potentially useful, is not the best procedure; the priority is to secure the digital evidence by seizing the computer intact. Option D is wrong because turning on the computer to see if it boots normally will immediately alter the hard drive's contents (e.g., writing to the registry, updating logs, modifying file timestamps), destroying potential evidence and violating the forensic requirement to preserve the original state.

124
Multi-Selecteasy

Which TWO of the following hashing algorithms are commonly used to verify the integrity of forensic images? (Choose two.)

Select 2 answers
A.SHA-3
B.SHA-1
C.RSA
D.AES
E.MD5
AnswersB, E

SHA-1 is widely used in forensic imaging tools.

Why this answer

SHA-1 and MD5 are the two hashing algorithms most commonly used in forensic practice to verify the integrity of forensic images. They produce a fixed-size hash value (160-bit for SHA-1, 128-bit for MD5) that acts as a digital fingerprint; if the hash of the original image matches the hash of a copy, the data is considered unchanged. Despite known collision weaknesses, they remain the de facto standards in tools like FTK Imager, EnCase, and dd due to their speed and widespread tool support.

Exam trap

EC-Council often tests the distinction between hashing algorithms (integrity) and encryption algorithms (confidentiality), so the trap here is that candidates confuse RSA and AES as hashing algorithms because they are cryptographic primitives, but they serve entirely different purposes.

125
MCQmedium

During a forensic investigation, a lawyer objects to the admissibility of a log file on the grounds that it is hearsay. Which of the following is the BEST argument to overcome this objection?

A.The log file qualifies as a business record exception to the hearsay rule.
B.The log file is circumstantial evidence, not hearsay.
C.The log file is direct evidence of the intrusion.
D.The log file is the best evidence because it is an original record.
AnswerA

Under FRE 803(6), a log file is admissible as a business record if it was created at or near the time of the event by a person with knowledge, kept in the regular course of business, and it was the regular practice to make such a record. The custodian or qualified witness must lay a foundation, but once established, the log is an exception to the hearsay rule, not excluded as hearsay. This exception reflects the reliability of records routinely relied upon in business operations.

Why this answer

The log file is admissible under the business records exception to the hearsay rule (Federal Rule of Evidence 803(6)). This exception applies because logs are created automatically or by a person with knowledge, near the time of the event, in the regular course of business, and it is the regular practice to make such records. In digital forensics, system logs (e.g., Windows Event Logs, syslog) are routinely admitted under this exception, as they are generated by the system without the declarant's bias or memory issues.

Exam trap

EC-Council often tests the misconception that 'best evidence' or 'original record' automatically overcomes hearsay, but the trap here is that hearsay and best evidence are separate evidentiary rules, and only a specific exception like business records can defeat a hearsay objection.

How to eliminate wrong answers

Option B is wrong because circumstantial evidence is still subject to hearsay rules; the log file is an out-of-court statement offered to prove the truth of the matter asserted (e.g., that an intrusion occurred), which is hearsay, not circumstantial. Option C is wrong because direct evidence is evidence that directly proves a fact without inference, but a log file still requires interpretation and is a recorded statement, making it hearsay unless an exception applies. Option D is wrong because the best evidence rule (original document rule) applies to proving the content of a writing, recording, or photograph, but it does not overcome a hearsay objection; the log file could still be excluded as hearsay even if it is the original.

126
MCQhard

During a network forensic investigation, the analyst examines firewall logs and notices a large number of outbound connections from an internal server to various IP addresses on port 443 at regular intervals. The connections are all initiated by a process called 'svchost.exe' running from a non-standard location (C:\Windows\Temp). What is the MOST likely explanation?

A.The server is running a scheduled backup to an external cloud service
B.The server is performing legitimate Windows Update checks
C.The server is infected with malware that is beaconing to a command-and-control server
D.The server is being used as a proxy for internal users
AnswerC

The correct indicator set is process-name spoofing combined with network beaconing: the malware uses the legitimate name svchost.exe but executes from the Temp folder, which no built-in Windows service does because the Service Control Manager loads service binaries using the full ImagePath—normally C:\Windows\System32\svchost.exe. The attacker then creates periodic outbound connections at fixed or jittered intervals to a small set of external IPs, typically carrying small, encrypted payloads, to receive commands or exfiltrate data—a classic C2 beacon signature. Defenders observe a single host producing repeatable timing patterns with low data volume per connection, which is nearly pathognomonic for malware.

Why this answer

Svchost.exe running from C:\Windows\Temp is a classic sign of malware masquerading as a legitimate Windows process. The regular outbound connections on port 443 (HTTPS) at fixed intervals indicate beaconing behavior, where the infected host periodically contacts a command-and-control (C2) server to receive instructions or exfiltrate data. Legitimate svchost.exe resides in C:\Windows\System32, and any deviation from this path is a strong indicator of compromise.

Exam trap

EC-Council CHFI exam often tests the misconception that svchost.exe is always legitimate, but the key trap here is that the process path (C:\Windows\Temp) is abnormal, and candidates may overlook this detail and incorrectly assume the activity is a normal Windows Update or backup operation.

How to eliminate wrong answers

Option A is wrong because scheduled backups to cloud services typically use dedicated backup software or Windows Server Backup, not svchost.exe from a non-standard path, and would not exhibit regular beaconing intervals. Option B is wrong because legitimate Windows Update checks use svchost.exe from C:\Windows\System32, not C:\Windows\Temp, and updates are initiated by the Windows Update service (wuauserv) via HTTP/HTTPS on port 80/443 but not at rigidly regular intervals. Option D is wrong because using a server as a proxy for internal users would involve a proxy service (e.g., Squid, Microsoft TMG) or a configured proxy role, not svchost.exe from a temp directory, and would show connections from multiple internal clients, not just outbound from the server.

127
MCQhard

A malware analyst is examining a suspicious Windows executable. Running 'strings' reveals references to 'C:\Windows\System32\drivers\etc\hosts' and IP addresses 185.130.5.21 and 192.168.1.1. Dynamic analysis in a sandbox shows the binary modifies the hosts file and creates a mutex named 'Global\Mtx_Update'. Which behavioral indicator is MOST clearly associated with persistence?

A.Modifying the hosts file with an entry for 192.168.1.1
B.Connecting to IP 185.130.5.21 on port 443
C.Writing temporary files to %TEMP%
D.Creating the mutex 'Global\Mtx_Update'
AnswerA

The hosts file at %SystemRoot%\System32\drivers\etc\hosts is consulted by the Windows DNS resolver on every name-resolution attempt, so an entry mapping a domain to 192.168.1.1 changes system-wide resolution behavior even after a reboot. This is a persistent system-level configuration change that can silently redirect a target hostname to an attacker-controlled IP, enabling traffic interception, credential harvesting, or bypass of DNS-based defenses. Unlike transient runtime actions, this modification remains active until the file is edited or the entry is removed.

Why this answer

Modifying the hosts file to redirect a legitimate domain to 192.168.1.1 is a classic persistence mechanism: the malware ensures that every time the system resolves that domain, it points to the attacker-controlled IP, effectively hijacking network traffic persistently across reboots without needing to run at startup. This behavior directly maintains unauthorized control over name resolution, which is a hallmark of persistence.

Exam trap

EC-Council often tests the distinction between persistence (surviving reboot) and other behavioral indicators like mutex creation or network connections, so the trap here is confusing a mutex (used for single-instance control) with a persistence mechanism.

How to eliminate wrong answers

Option B is wrong because connecting to an external IP (185.130.5.21) on port 443 is a network communication indicator (C2 beaconing), not a persistence mechanism—it does not ensure the malware survives a reboot. Option C is wrong because writing temporary files to %TEMP% is a common execution artifact (e.g., dropping payloads or logs) but does not by itself guarantee the malware will re-execute after a system restart. Option D is wrong because creating a mutex (Global\Mtx_Update) is a synchronization primitive used to prevent multiple instances of the malware from running simultaneously; it does not provide any mechanism for automatic re-execution upon boot.

128
MCQeasy

An analyst is examining a Windows 10 system and discovers a file in the $Recycle.bin folder with a name like '$RABCDEF.txt'. The analyst wants to recover the original file path and deletion date. Which forensic artifact should the analyst examine?

A.The corresponding $I file (e.g., $IABCDEF.txt) in $Recycle.bin
B.The Windows Event Logs
C.The USN journal
D.The $MFT entry for the $R file
AnswerA

The $I file in the $Recycle.bin folder is an index entry created when a file is deleted via Explorer; it stores the original file name, full path before deletion, and the deletion timestamp. Because the $R file is renamed to a random name, the $I file is the authoritative source for reconstructing the original location and time. Forensic tools parse $I files to recover this metadata directly.

Why this answer

The $I file (e.g., $IABCDEF.txt) in the $Recycle.bin folder is the index file that stores metadata about the deleted file, including the original file path, original size, and the date and time when the file was deleted. The $R file contains only the actual data content of the deleted file, not its metadata. Therefore, examining the corresponding $I file is the correct method to recover the original file path and deletion date.

Exam trap

EC-Council CHFI often tests the misconception that the $R file itself contains metadata like the original path or deletion date, when in fact the $R file is only the data content, and all metadata is stored exclusively in the corresponding $I file.

How to eliminate wrong answers

Option B is wrong because Windows Event Logs may record some deletion events (e.g., via Sysmon or auditing), but they do not reliably store the original file path and deletion date for every file moved to the Recycle Bin, and they are not the primary forensic artifact for this purpose. Option C is wrong because the USN journal records changes to files (e.g., rename, delete) but does not store the original file path or the exact deletion timestamp in a structured way that directly maps to the $R file; it is a change journal, not a metadata store for recycled files. Option D is wrong because the $MFT entry for the $R file only contains metadata about the $R file itself (e.g., its name, timestamps, data runs) but does not contain the original file path or the deletion date; the original path is stored only in the $I file's header.

129
MCQmedium

A forensic investigator is examining a Mac system and wants to review recently accessed files and applications. Which macOS artifact is MOST useful for this purpose?

A.bash_history
B..plist files in ~/Library/Preferences/
C.Unified Logging (log stream)
D.FSEvents (/.fseventsd)
AnswerD

FSEvents records file system changes and can be used to reconstruct user activity.

Why this answer

FSEvents (/.fseventsd) is the correct choice because it maintains a persistent, chronological record of file system changes on macOS, including file accesses and modifications. This artifact allows an investigator to reconstruct a timeline of recently accessed files and applications, as the FSEvents daemon logs events such as file opens, renames, and deletions at the volume level, making it the most direct source for this purpose.

Exam trap

EC-Council often tests the misconception that bash_history is the primary source for user activity on macOS, but the trap here is that FSEvents provides a more comprehensive and persistent record of file accesses and application launches, including those not performed via the command line.

How to eliminate wrong answers

Option A is wrong because bash_history only records commands entered in the Bash shell, not file accesses or application launches outside the terminal, and it can be easily cleared or bypassed. Option B is wrong because .plist files in ~/Library/Preferences/ store application settings and user preferences, not a comprehensive log of file access events; they may indicate which apps were used but lack timestamps and file-level access details. Option C is wrong because Unified Logging (log stream) captures system-wide diagnostic messages and can include some file access events, but it is not optimized for forensic timeline reconstruction of file accesses and is often filtered or pruned, whereas FSEvents is specifically designed for this purpose.

130
MCQhard

A security analyst observes a suspicious process creating multiple mutexes with names like 'XxX_12345' and 'XxX_67890' and making outbound connections to an IP address 185.130.5.1 on port 443. Which behavioral indicator is MOST consistent with malware communication?

A.The process is performing data exfiltration via DNS tunneling
B.The process is attempting to spread to other machines via SMB
C.The mutexes indicate an attempt to prevent multiple instances, and outbound connections suggest C2 activity
D.The process is a legitimate application using mutexes for inter-process communication
AnswerC

Malware commonly creates specific named mutexes to ensure only one instance runs, preventing duplicate infections and making analysis harder; the presence of these mutexes is a behavioral indicator. Multiple outbound TLS connections to a fixed external IP on 443 are a classic command-and-control pattern, especially when the IP is a known suspicious address like 185.130.5.1, so combined these observations point to C2 activity.

Why this answer

The creation of mutexes with a consistent naming pattern (e.g., 'XxX_12345') is a classic anti-replication mechanism used by malware to ensure only one instance runs on a system, preventing conflicts and detection. The outbound connections to a specific IP on port 443 (HTTPS) are highly indicative of command-and-control (C2) communication, as malware often uses encrypted channels to blend in with legitimate traffic. Option C correctly identifies both the mutex's purpose (preventing multiple instances) and the network behavior (C2 activity), making it the most consistent with malware communication.

Exam trap

The CHFI exam often tests the misconception that any outbound connection on port 443 is automatically legitimate HTTPS traffic, but the trap here is that malware frequently uses this port for C2, and the mutex pattern is a key differentiator from benign software.

How to eliminate wrong answers

Option A is wrong because DNS tunneling involves encoding data in DNS queries/responses, typically on UDP port 53, not outbound HTTPS connections on port 443; the mutex names also have no relation to DNS. Option B is wrong because SMB propagation uses port 445 (or 139) for file and printer sharing, not port 443, and mutexes are not a standard mechanism for spreading via SMB. Option D is wrong because while legitimate applications do use mutexes for inter-process communication, the combination of suspicious mutex names (e.g., 'XxX_') and outbound connections to an external IP on a common C2 port (443) is not typical of benign software; legitimate apps rarely hardcode such patterns for external communication.

131
MCQmedium

During a forensic investigation, an analyst uses a tool to create a bit-for-bit copy of a hard drive while ensuring the original is not modified. Which of the following is a hardware write blocker that can be used for this purpose?

A.FTK Imager
B.Tableau
C.dd
D.EnCase
AnswerB

Tableau is a manufacturer of dedicated hardware write blockers, not just imaging software. A Tableau device sits between the suspect drive and the forensic workstation, intercepting ATA/SCSI commands at the hardware level and physically gating any write command from reaching the storage medium. This hardware-level enforcement is exactly what forensic investigators need to guarantee that the original evidence remains unaltered, making Tableau the correct answer.

Why this answer

A hardware write blocker physically prevents any write commands from reaching the original drive at the SATA/IDE bus level, ensuring the drive remains unaltered during acquisition. Tableau is a well-known manufacturer of forensic hardware write blockers that operate transparently to the imaging software, making it the correct choice for a hardware-based solution.

Exam trap

The CHFI exam often tests the distinction between software tools (FTK Imager, dd, EnCase) and dedicated hardware write blockers (Tableau), trapping candidates who assume any forensic imaging tool inherently provides write protection.

How to eliminate wrong answers

Option A is wrong because FTK Imager is a software tool, not a hardware device; it relies on the operating system or a separate hardware blocker to prevent writes. Option C is wrong because dd is a Unix/Linux command-line utility for bit-for-bit copying, but it is software and does not inherently block writes to the source drive without additional safeguards like a hardware blocker or a read-only mount. Option D is wrong because EnCase is a forensic software suite that can acquire images, but it is not a hardware write blocker; it depends on external hardware or software write protection to ensure the source is not modified.

132
MCQhard

A forensic examiner finds a file on an NTFS volume that appears to have data hidden in its alternate data stream. The file's size is reported as 10 KB, but the volume's cluster size is 4 KB. How many clusters of file slack could potentially contain hidden data in the primary stream?

A.12 KB
B.4 KB
C.2 KB
D.0 KB
AnswerC

The file size is 10 KB, and NTFS uses 4 KB clusters on this volume. The file consumes two full clusters (8 KB) and then 2 KB of a third cluster, leaving 2 KB of slack in that final cluster. This remaining space is not part of the file size but is still allocated to the file, and it may contain remnants of previously stored data that a forensic examiner should analyze.

Why this answer

The file's primary stream occupies 10 KB, which requires 3 clusters (3 × 4 KB = 12 KB). The slack space is the unused portion of the last cluster: 12 KB - 10 KB = 2 KB. This 2 KB of file slack in the primary stream could potentially contain hidden data, making option C correct.

Exam trap

EC-Council CHFI often tests the distinction between allocated space and slack space, and the trap here is that candidates mistakenly calculate the total allocated clusters (12 KB) as slack instead of subtracting the actual file size from the allocated space.

How to eliminate wrong answers

Option A is wrong because 12 KB is the total allocated space (3 clusters × 4 KB), not the slack. Option B is wrong because 4 KB would be the slack if the file size were exactly 8 KB (2 clusters), but here the file is 10 KB, leaving only 2 KB of slack. Option D is wrong because file slack always exists when the file size is not a multiple of the cluster size; 10 KB is not a multiple of 4 KB, so slack is present.

133
Multi-Selecthard

During dynamic analysis of a suspected malware sample, an analyst observes the following behaviors: (1) The process creates a service named 'WindowsDefender' that starts automatically. (2) It writes an encrypted payload to the registry under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. (3) It injects code into explorer.exe. (4) It attempts to resolve the domain 'malware-update.com'. (5) It creates a mutex named 'Global\MyMutex'. Which THREE behaviors are indicators of malware persistence? (Select THREE.)

Select 3 answers
A.Injecting code into explorer.exe
B.Writing an encrypted payload to the registry under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
C.Creating a mutex named 'Global\MyMutex'
D.Creating a service named 'WindowsDefender' that starts automatically
E.Attempting to resolve the domain 'malware-update.com'
AnswersA, B, D

Code injection into a commonly running process helps maintain persistence.

Why this answer

Injecting code into explorer.exe (option A) is a persistence mechanism because the injected code runs within the context of a trusted system process that starts automatically at user logon. By hijacking explorer.exe, the malware ensures its malicious code executes every time the user logs into the system, surviving a reboot without needing a separate startup entry.

Exam trap

The trap here is that candidates confuse indicators of execution or communication (like mutex creation or DNS resolution) with persistence mechanisms, which specifically ensure the malware re-executes automatically after a reboot or logon.

134
Multi-Selectmedium

An analyst is investigating a potential data breach on an Android device. Which TWO artefacts are MOST useful for determining which third-party apps were installed and used? (Select TWO.)

Select 2 answers
A.Full system dump (dd image)
B.packages.xml file in /data/system/
C.Wi-Fi connection logs
D./data/data/ directory listing
E.SMS database (mmssms.db)
AnswersB, D

This file lists all installed packages (apps) on the device.

Why this answer

The packages.xml file in /data/system/ records all installed packages, including third-party apps, their permissions, and installation metadata. The /data/data/ directory contains per-package subdirectories with application-specific data, confirming actual usage and stored data. Together, these two artefacts provide definitive evidence of which third-party apps were installed and used on the device.

Exam trap

The CHFI exam often tests the misconception that a full system dump (dd image) is the most useful artefact for app analysis, when in reality the structured packages.xml and /data/data/ directory provide more direct and actionable evidence.

135
MCQmedium

A legal hold is issued by an organization's legal department. What is the primary purpose of a legal hold?

A.To notify employees that litigation is pending
B.To authorize law enforcement to seize computers
C.To preserve all relevant data that may be needed for a legal case
D.To encrypt all company data for security
AnswerC

The legal hold ensures that evidence is not destroyed or altered during the pendency of a legal matter.

Why this answer

A legal hold is a directive issued by an organization's legal department to suspend the routine deletion or alteration of data that may be relevant to pending or reasonably anticipated litigation. Its primary purpose is to preserve all potentially relevant electronically stored information (ESI) and physical records in their current state, ensuring spoliation does not occur. This obligation arises under the Federal Rules of Civil Procedure (FRCP) Rule 37(e) and similar e-discovery regulations, which require organizations to take reasonable steps to preserve data once litigation is reasonably anticipated.

Exam trap

CHFI often tests the distinction between a legal hold (a civil preservation duty) and law enforcement seizure (a criminal investigative action), leading candidates to incorrectly select Option B because they conflate 'hold' with 'seize'.

How to eliminate wrong answers

Option A is wrong because a legal hold is not merely a notification to employees that litigation is pending; it is a directive to preserve data, and while notification may be part of the process, the primary purpose is preservation, not notification. Option B is wrong because a legal hold is an internal civil litigation preservation mechanism, not a law enforcement seizure authorization; law enforcement seizures are governed by warrants or subpoenas under statutes like the Electronic Communications Privacy Act (ECPA), not by a legal hold. Option D is wrong because encryption is a security measure for protecting data confidentiality, not a preservation technique; a legal hold requires data to be retained in its original form, and encryption could actually hinder forensic acquisition and analysis if keys are lost.

136
MCQhard

You are investigating a Windows 10 workstation that exhibits slow performance and frequent pop-ups. The user reports that the system started acting strangely after installing a 'PDF Converter' from an email attachment. You suspect malware. You have captured a memory dump using FTK Imager and a network capture during the infection. In the memory dump, you find a suspicious process 'conhost.exe' running from a non-standard location (C:\Users\Public\Temp). The process has an open handle to a file named 'config.ini' in the same directory. The network capture shows periodic HTTPS connections to 'malicious.com' on port 443 from the workstation's IP. Using Volatility, you extract the process's command line: 'conhost.exe -hidden -log C:\Users\Public\Temp\output.log'. Which of the following is the BEST immediate course of action to contain the threat and preserve evidence?

A.Delete the config.ini file and the conhost.exe executable immediately.
B.Restore the system to a previous restore point.
C.Terminate the suspicious conhost.exe process and run a full antivirus scan.
D.Isolate the workstation from the network, then create a forensic image of the hard disk for analysis.
AnswerD

Isolating the workstation from the network by disconnecting the cable or disabling the NIC immediately severs Command & Control (C2) channels and halts any lateral movement to other hosts, preserving the network flow data and the current state of live connections. Creating a forensic image of the hard disk using a write-blocker and bit-for-bit imaging tools maintains the integrity of evidence, allowing recovery of deleted files, unallocated space, and file system slack that may contain residual malware or attacker artifacts. This evidence-preserving approach aligns with forensic best practices, keeps proper chain of custody, and enables thorough static and dynamic analysis in a controlled lab environment—unlike the destructive or ineffective alternatives.

Why this answer

The primary goal in a malware incident is to contain the threat and preserve evidence for forensic analysis. Isolating the workstation from the network prevents further data exfiltration (e.g., the HTTPS connections to malicious.com) and stops the malware from communicating with its C2 server. Creating a forensic image of the hard disk preserves the full state of the system, including the malicious conhost.exe, config.ini, and output.log files, which are critical for reverse engineering and attribution.

Terminating the process or deleting files before imaging would destroy volatile evidence and potentially trigger anti-forensic mechanisms.

Exam trap

EC-Council often tests the principle that containment and evidence preservation take precedence over immediate remediation, so candidates mistakenly choose to terminate the process or delete files (Option A or C) thinking they are stopping the threat, but this destroys volatile evidence and may trigger anti-forensic behavior.

How to eliminate wrong answers

Option A is wrong because deleting the config.ini file and conhost.exe executable destroys evidence and may trigger anti-forensic routines (e.g., file wiping or self-deletion) that could corrupt the memory dump or hinder analysis. Option B is wrong because restoring to a previous restore point overwrites critical system files and registry keys, destroying evidence of the infection and potentially leaving remnants of the malware in shadow copies or unallocated space. Option C is wrong because terminating the process and running an antivirus scan may alter the system state (e.g., killing the process removes its memory artifacts) and the scan could quarantine or delete malicious files, compromising the forensic integrity of the evidence.

137
Multi-Selectmedium

Which TWO of the following are valid justifications for a first responder to power off a computer at a crime scene? (Select TWO)

Select 2 answers
A.To prevent the computer from overheating
B.To save time during the investigation
C.The computer is destroying evidence (e.g., running a data wiping program)
D.The computer is in a hazardous environment (e.g., flooding)
E.The computer is actively being used to commit a crime
AnswersC, D

Powering off can stop the destruction, but ideally capture volatile data first if possible.

Why this answer

If a computer is actively running a data wiping program (e.g., a tool that overwrites storage sectors with zeros or random data), leaving it powered on will cause the irreversible destruction of potential evidence. A first responder must immediately cut power to halt the wiping process and preserve the remaining data, as volatile memory (RAM) is not the primary concern in this scenario—the non-volatile storage is being actively sanitized.

Exam trap

EC-Council often tests the distinction between 'actively being used to commit a crime' (which requires live acquisition) and 'actively destroying evidence' (which justifies immediate power-off), causing candidates to mistakenly select Option E as a valid justification.

138
Multi-Selectmedium

Which TWO of the following are valid techniques for acquiring RAM in a Windows system?

Select 2 answers
A.WinPmem
B.Sleuth Kit
C.LiME
D.dd
E.FTK Imager
AnswersA, E

WinPmem is a memory acquisition tool for Windows.

Why this answer

WinPmem is a dedicated memory acquisition tool for Windows that uses the WinPmem driver to access physical memory directly, bypassing OS protections. It is widely used in forensic acquisitions because it can capture RAM with minimal interference and supports both 32-bit and 64-bit Windows systems.

Exam trap

EC-Council often tests the distinction between disk forensics tools and memory acquisition tools, leading candidates to mistakenly select Sleuth Kit or dd as valid RAM acquisition methods for Windows.

139
MCQeasy

According to Locard's exchange principle, which of the following is TRUE in a digital forensic context?

A.A suspect will always leave traces of their activity on a computer system.
B.Only physical evidence, not digital evidence, is subject to exchange.
C.Digital evidence is always volatile and cannot be preserved.
D.The absence of evidence proves the suspect is innocent.
AnswerA

Locard's principle implies that digital interactions leave residual data that can be recovered.

Why this answer

In a digital forensic context, Locard's exchange principle holds that whenever a suspect interacts with a computer system, they will inevitably leave traces of that activity. This can include artifacts such as registry entries, log files, prefetch files, browser history, or metadata, even if the user attempts to delete or obfuscate their actions. The principle underpins the entire field of digital forensics, asserting that digital interaction always produces residual data.

Exam trap

The CHFI exam often tests the misconception that Locard's principle only applies to physical evidence, leading candidates to incorrectly select Option B, when in fact the principle is universally applied to all forms of evidence, including digital.

How to eliminate wrong answers

Option B is wrong because Locard's exchange principle applies to both physical and digital evidence; digital evidence is subject to exchange through data remnants, logs, and metadata, not just physical traces. Option C is wrong because digital evidence is not always volatile — many types, such as files on a hard drive or logs on a server, are persistent and can be preserved through proper forensic imaging and write-blocking techniques. Option D is wrong because the absence of evidence does not prove innocence; it may indicate that the suspect used anti-forensic techniques, that evidence was overwritten, or that the examiner lacked the tools or authority to recover it.

140
Multi-Selecthard

A forensic examiner has acquired a disk image using FTK Imager and needs to ensure the image is an exact duplicate of the original drive. Which THREE of the following methods can be used to verify integrity? (Select THREE)

Select 3 answers
A.Compute the SHA-256 hash of the image and compare it to the original drive's hash
B.Compute the MD5 hash of the image and compare it to the original drive's MD5 hash
C.Verify the cyclical redundancy check (CRC-32) of the image file
D.Use the 'verify' function within FTK Imager which automatically computes and compares hashes
E.Check the file size of the image matches the original drive's capacity
AnswersA, B, D

Computing the SHA-256 hash of the acquired image and comparing it against the hash computed from the original drive is the gold standard for forensic integrity verification. SHA-256 is a NIST-approved cryptographic hash function that produces a unique 256-bit digest; because it is collision-resistant and preimage-resistant, even a single flipped bit in the image will cause a completely different digest. This comparison verifies that the acquisition process created a bit-for-bit identical copy, providing a defensible basis for subsequent analysis and court testimony.

Why this answer

SHA-256 is a cryptographic hash function that produces a unique 256-bit digest. By computing the SHA-256 hash of the acquired image and comparing it to the hash computed from the original drive, the examiner can verify bit-for-bit integrity with extremely high collision resistance, ensuring the image is an exact duplicate.

Exam trap

EC-Council often tests the distinction between error-detection codes (CRC-32) and cryptographic hash functions (SHA-256, MD5), leading candidates to mistakenly select CRC-32 as a valid integrity verification method for forensic images.

141
MCQmedium

During a Windows forensic analysis, you find a suspicious LNK file in a user's Recent folder. Which of the following is NOT typically retrievable from an LNK file?

A.Username of the user who created the LNK file
B.Target file creation timestamp
C.Volume serial number of the target drive
D.Target file path
AnswerA

The Shell Link binary format has no dedicated field for the creating user's username or SID. LNK files identify the machine via the MachineID string and the target volume via a serial number, but attribution to a specific account must be reconstructed through indirect evidence like the NTFS USN journal, Prefetch, or shellbags, not read directly from the .lnk file.

Why this answer

LNK files store metadata about the target file and the system environment, but they do not record the username of the user who created the LNK file. The creation timestamp of the LNK file itself is stored, but the username is not part of the LNK file structure. Instead, the username context is inferred from the user's profile folder path where the LNK resides, not from the file's internal data.

Exam trap

EC-Council CHFI often tests the misconception that LNK files store the creator's username because they associate the file with a user's Recent folder, but the username is derived from the folder path, not the file's internal data.

How to eliminate wrong answers

Option B is wrong because LNK files do store the target file's creation timestamp in the shell link header (as a FILETIME structure). Option C is wrong because the volume serial number of the target drive is stored in the volume ID structure within the LNK file. Option D is wrong because the target file path is stored in the link target identifier (ITPIDLIST) and the link info structure, making it fully retrievable.

142
MCQeasy

Under the US Fourth Amendment, when is a warrant generally NOT required for a computer search and seizure?

A.When the evidence is stored in the cloud
B.When the computer is owned by a corporation
C.When the investigation involves a civil case
D.When the suspect has given consent
AnswerD

Consent is a classic exception to the Fourth Amendment's warrant requirement, as recognized in Schneckloth v. Bustamonte, because a person who voluntarily, knowingly, and intelligently relinquishes his or her privacy interest in the premises or effects cannot later complain about the search. The consent must be freely given and may be limited in scope or withdrawn at any time, but when it is valid, it renders a warrant unnecessary.

Why this answer

Under the Fourth Amendment, a warrant is generally required for searches and seizures, but one well-established exception is voluntary consent. When a suspect freely and knowingly agrees to a search of their computer or digital device, law enforcement may proceed without a warrant, provided the consent is not coerced and the scope of the search is not exceeded. This principle applies regardless of whether the data is stored locally or remotely, as long as the consenting party has actual or apparent authority over the device or data.

Exam trap

EC-Council often tests the misconception that the Fourth Amendment does not apply to corporate-owned devices or cloud data, but the trap here is that consent is a specific, well-recognized exception that overrides the warrant requirement, whereas the other options describe scenarios where a warrant is still generally required unless another exception applies.

How to eliminate wrong answers

Option A is wrong because the Fourth Amendment generally requires a warrant for cloud-stored data, as the user retains a reasonable expectation of privacy in data held by a third-party provider under the Stored Communications Act (18 U.S.C. § 2703), unless an exception like consent or exigent circumstances applies. Option B is wrong because corporate ownership does not automatically waive Fourth Amendment protections; while business records may have reduced privacy expectations, a warrant is still required for a search unless an exception such as consent from an authorized corporate officer or the plain view doctrine is present. Option C is wrong because the Fourth Amendment applies to government searches in both criminal and civil cases; in civil investigations, a warrant or a valid exception (e.g., consent, subpoena) is still required, and the absence of criminal charges does not eliminate the need for a warrant.

143
Multi-Selecteasy

A forensic analyst reviews a Windows system for signs of malware persistence. Which TWO registry locations are commonly used to achieve persistence via auto-start programs?

Select 2 answers
A.HKLM\SAM\SAM\Domains\Account\Users
B.HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist
C.HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
D.HKLM\SYSTEM\CurrentControlSet\Services
E.HKCU\Software\Microsoft\Windows\CurrentVersion\Run
AnswersC, E

This HKLM Run key is a critical persistence location: at every user logon, the Winlogon process reads it and launches each listed executable for all accounts, requiring administrative privileges to modify. Values are command lines (e.g., 'C:\malware.exe') that run early in the logon sequence, before the desktop is fully interactive. Because it has system-wide scope, it is a top target for malware persistence and a primary check during a forensic investigation for auto-start mechanisms.

Why this answer

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and HKCU\Software\Microsoft\Windows\CurrentVersion\Run are standard auto-start locations for all users and current user respectively. RunOnce keys execute once and are also used. But the most common are Run keys.

144
MCQmedium

A security analyst observes multiple Event ID 4625 logon failures for a single user account within a short time frame, followed by Event ID 4624 logon success. Which attack technique is MOST likely indicated?

A.Kerberos golden ticket attack
B.SQL injection attack on the authentication database
C.Brute-force or password spraying attack
D.Pass-the-hash attack
AnswerC

The correct finding: a burst of 4625 events followed by a 4624 event is the canonical signature of brute-force or password-spraying. Brute-force creates many failed attempts per target account with different passwords, while spraying uses one password across many accounts; both generate numerous 4625 audit records. When one guess finally matches, a 4624 success appears, confirming the attack succeeded.

Why this answer

Event ID 4625 indicates failed logon attempts, and Event ID 4624 indicates a successful logon. A rapid sequence of failures followed by a success for the same user account is the classic signature of a brute-force or password spraying attack, where an attacker tries multiple passwords until one works. This pattern is specific to authentication attempts against the local SAM or domain controller via NTLM or Kerberos, not to post-authentication attacks.

Exam trap

EC-CHFI often tests the distinction between pre-authentication attacks (brute-force, password spraying) and post-authentication attacks (pass-the-hash, golden ticket), where candidates mistakenly associate any successful logon after failures with a hash-based attack instead of recognizing the sequential failure-success pattern as brute-force.

How to eliminate wrong answers

Option A is wrong because a Kerberos golden ticket attack forges a Ticket Granting Ticket (TGT) using the KRBTGT hash, which does not generate multiple Event ID 4625 failures; instead, it produces a single successful logon (4624) with unusual attributes like a non-existent user or anomalous ticket options. Option B is wrong because SQL injection targets the database query layer, not Windows Security Log events 4625/4624; it would generate SQL server errors or application-level logs, not sequential logon failures. Option D is wrong because a pass-the-hash attack uses stolen NTLM hashes to authenticate without knowing the plaintext password, typically resulting in a single successful logon (4624) without preceding 4625 failures, as the hash is valid.

145
MCQhard

During dynamic analysis of a suspicious executable in Cuckoo Sandbox, the report shows that the process created a registry key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run named 'WindowsUpdate' and dropped a file 'svchost.exe' in %AppData%. Which conclusion is MOST consistent with these indicators?

A.The executable is cleaning up after itself by deleting temporary files
B.The executable is a dropper that installs a rootkit
C.The executable is a legitimate Windows update component
D.The executable is attempting to establish persistence via a Run key and masquerading as a system process
AnswerD

Run key persistence and masquerading as svchost.exe indicates malware.

Why this answer

The creation of a Run key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run is a classic persistence mechanism that causes the executable to launch automatically at user logon. Dropping a file named 'svchost.exe' in %AppData% is a common masquerading technique, as the legitimate svchost.exe (Service Host) resides in C:\Windows\System32, not in the user's AppData folder. Together, these actions indicate the executable is establishing persistence and disguising itself as a trusted system process.

Exam trap

EC-Council often tests the distinction between persistence mechanisms and other malware behaviors, and the trap here is that candidates may confuse a dropper with a rootkit or assume any file named 'svchost.exe' is legitimate, ignoring the abnormal file path.

How to eliminate wrong answers

Option A is wrong because creating a Run key and dropping a file are actions that establish persistence, not cleanup; deleting temporary files would involve removing artifacts, not adding them. Option B is wrong because while the executable is a dropper (it drops a file), there is no evidence of a rootkit—rootkits typically hide processes or files via kernel-level hooks, not by simply adding a Run key and a masqueraded executable. Option C is wrong because legitimate Windows Update components do not write themselves to HKCU\Run or drop svchost.exe in %AppData%; Windows Update uses trusted system paths like C:\Windows\System32 and is managed by Windows Update service, not user-level Run keys.

146
MCQmedium

In an AWS environment, a security analyst detects unusual API calls that created several IAM users with administrative privileges from an unfamiliar IP address. Which AWS service log should be examined first to identify the specific API calls and the IAM user that made them?

A.Amazon S3 access logs
B.AWS CloudWatch Logs
C.AWS CloudTrail
D.AWS Config
AnswerC

CloudTrail logs all AWS API calls, making it the primary source for investigating API activity.

Why this answer

AWS CloudTrail is the correct service because it records all API calls made to the AWS environment, including the identity of the caller (IAM user or role), the source IP address, and the specific API actions (e.g., CreateUser, AttachUserPolicy). In this scenario, CloudTrail logs will directly show which IAM user made the unusual API calls from the unfamiliar IP address, enabling the analyst to trace the unauthorized activity.

Exam trap

EC-CHFI often tests the distinction between CloudTrail (API activity logging) and CloudWatch Logs (monitoring and log aggregation), leading candidates to mistakenly choose CloudWatch Logs because they think 'logs' implies all logging, but CloudTrail is the specific service for API call auditing.

How to eliminate wrong answers

Option A is wrong because Amazon S3 access logs record requests made to S3 buckets (e.g., GET, PUT, DELETE objects), not IAM management API calls like creating users or assigning policies. Option B is wrong because AWS CloudWatch Logs is a service for monitoring, storing, and accessing log files from various sources (e.g., application logs, system logs), but it does not natively capture AWS API calls; it can only ingest CloudTrail logs if configured, but it is not the primary source for API call records. Option D is wrong because AWS Config is a service for evaluating and auditing resource configurations and compliance over time, not for recording real-time API calls or identifying the specific user who made them.

147
MCQmedium

During malware analysis, an investigator finds that a suspicious process is injecting code into a legitimate system process (e.g., explorer.exe). Which technique is being used?

A.API hooking
B.Process hollowing
C.Code injection
D.DLL injection
AnswerC

Code injection is the correct classification because the finding that code was inserted into a running process directly matches this term. It encompasses any technique that places executable code into the virtual address space of another process and then causes it to run, often by creating a remote thread or using an asynchronous procedure call. The stem's description is a general definition of code injection, not limited to a specific delivery vector.

Why this answer

Code injection is the correct answer because the scenario describes a process injecting arbitrary code into a legitimate system process like explorer.exe. This is the generic term for techniques where malicious code is written into the address space of another process and executed, often via Windows API calls such as WriteProcessMemory and CreateRemoteThread. The question explicitly states 'injecting code,' which directly maps to the broad category of code injection, not a specific subtype.

Exam trap

The CHFI exam often tests the distinction between generic code injection and its specific subtypes (like DLL injection or process hollowing), trapping candidates who choose a narrower term when the question uses the broad phrase 'injecting code' without specifying the delivery mechanism.

How to eliminate wrong answers

Option A is wrong because API hooking intercepts and modifies function calls within a process (e.g., using SetWindowsHookEx or Detours), but it does not involve injecting new code into a separate process's memory space; it redirects existing calls. Option B is wrong because process hollowing replaces the legitimate code of a process (e.g., suspending explorer.exe, unmapping its original code, and writing malicious code into the same process) rather than injecting code into an already-running legitimate process; it creates a hollowed process from the start. Option D is wrong because DLL injection is a specific subtype of code injection that loads a DLL into a target process (using LoadLibrary or reflective loading), but the question does not specify that a DLL is involved—it only mentions 'injecting code,' which could be shellcode or other executable code, making the broader term 'code injection' more accurate.

148
MCQmedium

You are a forensic analyst investigating a suspected malware infection on a Windows 10 workstation. The user reports that the system has been slow and that unexpected pop-ups appear. You have acquired a memory dump and a disk image. During analysis, you find a suspicious process named 'svch0st.exe' running with PID 4567. The process has loaded several DLLs, including 'wininet.dll' and 'ws2_32.dll'. You also find that the process has an active TCP connection to an external IP address 203.0.113.5 on port 4444. In the disk image, you find an executable file at C:\Users\Public\svch0st.exe with a creation date that matches the start of symptoms. The file's hash is not in any known malware database. You decide to perform dynamic analysis by running the file in a sandbox. However, the sandbox environment has no network connectivity. The executable runs but does not exhibit any malicious behavior. What should you do next to determine if the file is malicious?

A.Conduct a thorough static analysis using a disassembler and debugger to understand the code
B.Delete the suspicious file and run a full antivirus scan on the system
C.Re-run the sample in a sandbox with simulated network connectivity or a controlled network to observe C2 communication
D.Perform a forensic imaging of the system again and compare with the original image
AnswerC

Re-running the sample in a sandbox with simulated network connectivity or a controlled network is the correct approach because many malware families remain dormant until they establish C2 communication, at which point they download additional payloads, exfiltrate data, or execute commands. A network-enabled sandbox provides a safe, but realistic environment where the analyst can observe DNS queries, HTTP/S connections, beaconing intervals, and the exact data exchanged with the C2 server. This dynamic analysis yields actionable indicators of compromise (IoCs) and reveals the malware's full functionality without risking real network infection.

Why this answer

The sandbox lacked network connectivity, which prevented the malware from reaching its command-and-control (C2) server. Many malware samples, especially those using HTTP or raw TCP for C2, will remain dormant or exhibit no malicious behavior when they cannot connect to the external IP. By providing simulated or controlled network connectivity, you can trigger the malicious payload and observe the actual C2 communication, confirming the file's intent.

Exam trap

The CHFI exam often tests the misconception that static analysis is always sufficient to determine maliciousness, but the trap here is that malware can be conditionally dormant and only activate when network connectivity is present, making dynamic analysis with network simulation essential.

How to eliminate wrong answers

Option A is wrong because static analysis alone cannot reliably determine if the file is malicious when it has no known hash and the sample is designed to only activate upon network connectivity; static analysis may miss obfuscated or conditionally executed code. Option B is wrong because deleting the file and running an antivirus scan is a reactive, non-analytical step that destroys evidence and does not answer whether the file is malicious; the file's hash is unknown, so antivirus may not detect it. Option D is wrong because performing another forensic imaging and comparing it to the original image would only show changes on disk, not reveal the runtime behavior or network-dependent activation of the malware; it is a redundant step that does not address the core question of whether the file is malicious.

149
MCQmedium

An examiner is analyzing an NTFS volume and suspects that a suspect hid data using Alternate Data Streams (ADS). Which tool or method is MOST appropriate to list all ADS on the volume?

A.Execute 'dir /r' in a Windows command prompt on the mounted image
B.Run 'ls -la' from a Linux forensic environment
C.Use 'icacls' to view security descriptors and detect ADS
D.Mount the image in Autopsy and run the 'Find File' module
AnswerA

The 'dir /r' command is a built-in Windows utility that enumerates alternate data streams (ADS) on NTFS volumes. When run against a mounted forensic image or drive, it displays each file accompanied by any named streams in the format 'file.txt:streamname:$DATA'. This directly queries the NTFS $ATTRIBUTE_LIST and $DATA attributes through the Windows filesystem driver, making it the simplest standard technique to confirm the presence and names of hidden ADS.

Why this answer

The 'dir /r' command in Windows Command Prompt is specifically designed to display alternate data streams (ADS) on NTFS volumes. It lists all files and directories, including any hidden streams attached to them, making it the most direct and appropriate method for an examiner to enumerate all ADS on a mounted NTFS volume.

Exam trap

The CHFI exam often tests the misconception that Linux tools like 'ls -la' can universally detect NTFS-specific features, but candidates must remember that ADS are a Windows/NTFS construct requiring native Windows commands or specialized forensic tools.

How to eliminate wrong answers

Option B is wrong because 'ls -la' in a Linux forensic environment does not natively display NTFS alternate data streams; it requires additional tools like 'ntfs-3g' or 'streams' to detect ADS, and even then it's not the most straightforward method. Option C is wrong because 'icacls' is used to view and modify security descriptors (permissions) on files and folders, not to list alternate data streams; it has no capability to enumerate ADS. Option D is wrong because while Autopsy can detect ADS, the 'Find File' module is a general search tool that does not specifically list all ADS on a volume; the 'File Analysis' or 'ADS' module would be more appropriate, but the question asks for the most appropriate method, and 'dir /r' is simpler and more direct.

150
MCQmedium

An analyst executed the commands shown in the exhibit on a Windows system to prepare a forensic image for analysis. What is the most likely reason for the error message from e2fsck?

A.The analyst failed to properly dismount the source volume before imaging, leading to filesystem inconsistencies.
B.The forensic image was not acquired with a write-blocker, causing data corruption.
C.The image file contains an NTFS filesystem, but e2fsck is designed for ext filesystems.
D.The e2fsck command syntax is incorrect; it should be 'e2fsck -f -n' instead.
AnswerA

The sequence shows `fsutil dismount` being run on C:, but a forensic image taken afterward—especially after Windows remounts the volume or during a live acquisition—will capture the volume in an inconsistent state. When Windows later performs recovery on the dirty volume, metadata updates begin immediately, so e2fsck in the analyst's analysis environment will legitimately report superblock, group descriptor, or inode inconsistencies that were never present in the source. This is the classic 'dirty volume' imaging error, not a problem with the image tool.

Why this answer

The error message from e2fsck indicates that the filesystem has inconsistencies, which typically occur when a volume is imaged while it is still mounted and actively being written to. The analyst likely did not dismount the source volume before acquiring the forensic image, resulting in a snapshot that reflects an inconsistent state (e.g., dirty journal, unflushed writes). This is a common chain-of-custody and acquisition procedure error in forensic imaging.

Exam trap

EC-Council often tests the misconception that a write-blocker alone guarantees a forensically sound image, but the trap here is that even with a write-blocker, imaging a mounted volume can produce an inconsistent filesystem because the OS may have pending writes in cache.

How to eliminate wrong answers

Option B is wrong because a write-blocker prevents writes to the source drive during acquisition, but it does not affect the consistency of the filesystem on the source volume if the volume was mounted and active; the error is about filesystem state, not write-blocker usage. Option C is wrong because the exhibit shows the analyst used 'dd' to create a raw image, and e2fsck is designed for ext2/3/4 filesystems; if the image contained NTFS, e2fsck would produce a different error (e.g., 'bad magic number') rather than a filesystem inconsistency error. Option D is wrong because the syntax 'e2fsck -f -n' is valid (force check and non-interactive), but the error message shown is about filesystem inconsistencies, not a command syntax error; the command executed correctly and detected the issue.

Page 1

Page 2 of 3

Page 3

All pages