Computer Hacking Forensic Investigator CHFI (CHFI) — Questions 76–150

Event ID 7045 is the Windows System log event emitted by the Service Control Manager whenever a new service is installed or registered on the system. It contains the service name, image path, service type, start type, and the account under which the service runs. This is the definitive event for detecting service installations, although on modern Windows versions event 4697 provides similar service-creation auditing in the Security log.

Foremost is a mature file carving tool originally developed by the U.S. Air Force Office of Special Investigations. It scans raw disk images or memory dumps for known file header and footer signatures defined in its configuration file, then extracts contiguous blocks that match those boundaries. This signature-based method allows recovery of files from unallocated clusters without relying on the operating system's file system metadata.

Plaso, also known as log2timeline, is the command-line tool specifically engineered for timeline analysis. It recursively parses numerous artifact types—such as file system metadata, registry hives, and application logs—to create comprehensive 'super timelines' with unified timestamps. Plaso aggregates and normalizes timestamps into a single, queryable event database (often SQLite or Elasticsearch), making it the de facto standard for advanced timeline construction in forensic investigations.

The string 3cscri is a signature of an XSS attempt because 3c is the hexadecimal encoding of the ASCII character '<', and 'scri' is the beginning of the word 'script'. When decoded, this represents the start of an HTML/JavaScript payload such as <script>, which would execute in a victim's browser. IIS logs often capture URL-encoded or hex-encoded characters, so this observed fragment strongly indicates cross-site scripting rather than any other web attack.

The Fourth Amendment prohibits unreasonable searches and seizures and mandates that warrants issue only upon probable cause, describing the place to be searched and items to be seized. In a forensic context, evidence obtained through a warrantless or warrant-invalid search is subject to suppression under the exclusionary rule. Consequently, the Fourth Amendment is the precise constitutional provision that determines whether the defendant's evidence is legally admissible despite potential exceptions such as inevitable discovery.

Process Monitor is the correct choice because it uses kernel-mode registry callbacks, a file-system minifilter, and ETW process/thread/network providers to record real-time operations with full paths, operation types, results, durations, and call stacks. It lets an analyst filter by process name, PID, registry key, file path, or operation, and preserve the event timeline in a PML log for detailed malware-behavior reconstruction. This makes it a true dynamic behavioral monitor rather than a packet capture or state-snapshot utility.

pslist is correct because it enumerates active processes by traversing the doubly linked list of EPROCESS structures anchored at PsActiveProcessHead. This plugin reads each EPROCESS entry directly from kernel memory, extracting the process ID, parent process ID, thread counts, and creation time. It is a fundamental process listing plugin in Volatility, though it can miss processes that have been deliberately unlinked from the list to evade detection.

The GET request to the id parameter with ' UNION SELECT username,password FROM users -- is a textbook UNION-based SQL injection payload. The single quote closes the original SQL string, UNION SELECT appends attacker-controlled columns to the result set, and the '--' comment sequence comments out the remainder of the original WHERE clause so the query executes exactly as the attacker intends. This causes the application's database to return records (e.g., credentials) that should never be exposed, making SQL injection the correct classification.

This is the correct order because volatile data (RAM, running processes, network connections, open files) is lost the instant the system loses power. Using a trusted, write-protected USB tool to capture this data first ensures the most transient evidence is preserved. A graceful shutdown, unlike a hard power-off, allows the OS to flush and close file structures cleanly, reducing the risk of filesystem corruption, and then removing the drive for a forensic imaging workstation yields a defensible disk image without altering the original.

The timestamp in the binary log entry records when the MySQL server executed the DELETE statement, as part of its statement-based or row-based logging. This is the server's authoritative clock at the moment the statement was processed, not when the client sent it or when the file was flushed. MySQL writes this event timestamp into the binary log header for replication and point-in-time recovery, reflecting execution time.

The TRIM command is an ATA interface primitive that informs the SSD which Logical Block Addresses are no longer in use, allowing the controller to erase the corresponding NAND flash blocks in the background, permanently destroying the data they contain. When an ext4 filesystem is mounted with the discard option or when fstrim is run, all freed blocks are trimmed, including those formerly occupied by deleted files. Additionally, the SSD's wear-leveling algorithm continuously remaps logical to physical blocks, so even if a forensic tool reads the logical LBA, the physical block that originally stored the data may have been relocated during garbage collection. This combination of block erasure and physical address remapping makes traditional file recovery impossible on such systems.

The presence of an external email address in the principal field of the Cloud Audit Log entry indicates that an IAM policy binding grants permissions to an identity outside the organization. This often happens when a bucket has been made public or when a resource-level IAM policy accidentally includes an external user or allUsers/allAuthenticatedUsers. The analyst should examine the bucket's IAM policy using `gcloud iam policies get` or the Cloud Console to identify the exact binding.

TRIM permanently erases deleted data at the block level by having the OS issue ATA DATASET MANAGEMENT or NVMe Deallocate commands that unmap the blocks containing the deleted file. Once unmapped, the SSD controller no longer preserves the old data and may zero or reuse those physical blocks during garbage collection, so conventional recovery tools cannot locate the file. This is why TRIM-implementing SSDs present a much greater forensic recovery challenge than HDDs or TRIM-disabled SSDs.

Multi-tenancy and data comingling are a primary challenge because cloud infrastructure pools resources across many customers on shared physical hardware. When an investigator acquires a forensic image from a virtual disk or memory, the underlying storage may contain remnants or interleaved blocks from other tenants, making it difficult to isolate the target's data without cross-contamination. This threatens chain of custody, requires careful logical isolation verification, and raises significant privacy and legal issues because collecting other tenants' data may violate statutes or service agreements. The shared responsibility model complicates attribution further, as the investigator must prove that the evidence belongs solely to the suspected tenant.

The repeated '../' sequences, often encoded as '%2e%2e%5c' or '%2e%2e/', are classic indicators of directory traversal in IIS logs. An attacker sends these sequences to escape the web root and access sensitive files outside it, such as Windows system files or configuration stores. The log entries show a deliberate attempt to navigate the server's directory hierarchy, which is the defining characteristic of a directory traversal attack.

A hardware write blocker sits between the suspect drive and the forensic workstation, intercepting every ATA/SCSI/NVMe command and allowing only read-only commands (e.g., READ SECTOR, IDENTIFY) to pass through while suppressing destructive commands like WRITE and DELETE. This preserves the bit-for-bit original state, so hash values calculated on the source remain valid and the evidence is admissible in court.

The File Allocation Table is the core metadata structure of FAT32, storing a linked list of cluster numbers (cluster chains) for every file. When a file is deleted, its directory entry is marked with byte 0xE5 but the associated FAT cluster chain is often left intact until those clusters are reused, and the directory entry still contains the starting cluster and file size. By reading the starting cluster and following the FAT chain to the end-of-chain marker, forensic tools can reassemble the deleted file's data clusters back into a contiguous stream for recovery.

Export Objects > HTTP is the correct method: Wireshark parses the HTTP conversations in the capture, reassembles the response bodies, handles chunked transfer-encoding and content-encoding, and then presents each recovered object as an individual file ready to be saved. This directly recovers binaries, documents, images, or any other file that was transferred over HTTP, providing the actual artifact for forensic analysis and hash comparison.

Creating a bit-for-bit forensic image of the encrypted drive before any decryption preserves the original evidence in its native state, capturing the full encrypted volume, partition table, free space, and deleted data remnants. The analyst can then decrypt that image on a write-protected or isolated forensic workstation using the known recovery key or extracted keys, leaving the original exhibit untouched and maintaining chain of custody. This workflow is the accepted standard for full-disk-encrypted evidence because it separates acquisition from decryption and permits multiple independent analyses.

A hardware write blocker intercepts and blocks write commands at the interface level, so the drive remains unaltered while the analyst images it. This preserves evidential integrity, satisfying the forensic requirement that acquisition never modify the suspect drive's original content.

The topmost writable container layer, also called the 'container layer' or 'upperdir' in overlayfs terms, is where all runtime modifications are recorded. When a container creates, deletes, or alters files, those changes are written here using copy-on-write, making it the primary location for malicious scripts planted during execution. This layer is ephemeral and typically destroyed with the container unless it is explicitly preserved via docker commit or docker export, so forensic collection must target this layer for runtime tampering.

HKCU\Software\Microsoft\Windows\CurrentVersion\Run is a standard per-user autostart location. When a user signs in, the Winlogon/userinit process reads every value under this key and executes the associated command line. Malware writes a value pointing to its executable in AppData so the payload is relaunched automatically on every successful login, establishing persistence.

With `hashwindow=10M`, dcfldd computes an independent hash value for every 10 MB block of input, allowing the analyst to verify each segment individually rather than relying solely on a single whole-file digest. This block-wise hashing is crucial for large forensic images because it pinpoints exactly which 10 MB region has changed or become corrupted, enabling targeted re-acquisition or analysis. It does not alter the total data processed, and the root hash over the entire stream may still be generated simultaneously if requested.

Analyzing the uploaded shell.aspx file is the most direct and probative step because it's an active web shell that confirms a successful exploitation and defines the attacker's capabilities. Static analysis (e.g., extracting strings, decoding obfuscated payloads) and dynamic analysis in a sandbox reveal command-and-control channels, file exfiltration methods, and any additional backdoors the shell installs. This knowledge is essential for both attribution and full remediation.

File slack, also known as cluster slack, is exactly the unused portion of the last cluster assigned to a file. When a file's logical size is not an exact multiple of the cluster size, the file system allocates a full cluster but only writes data up to the end of the file, leaving the remaining bytes in that cluster uninitialized. This residual space is significant in digital forensics because it may contain remnants of previously deleted files or other data that were not overwritten by the current file's content.

EmailTracker is a purpose-built utility for parsing email message headers and reconstructing the delivery path from sender to recipient. It extracts each Received: header, maps the originating IP address, identifies intermediary mail servers and time zones, and surfaces anomalies such as forged headers or mismatches among SPF, DKIM, and DMARC results. This automated route visualization is exactly what 'analyzing email headers' means in an investigative context.

Acquiring a memory dump and analyzing it with Volatility is the correct approach because it preserves the volatile state where fileless malware resides, capturing the actual code, injected processes, and hooked kernel structures. Memory forensics allows investigators to enumerate running processes, inspect process memory and VAD trees, and extract indicators that would be lost on reboot, providing the most direct evidence of the infection.

RAID 5 forensic analysis requires rebuilding the logical volume from the member disk images; `mdadm` can assemble the array by reading on-disk superblocks, while tools like RAID Reconstructor automate the cross-drive stripe and parity calculation. Simply imaging each disk separately leaves the filesystem fragmented across all three drives, so the examiner must first combine the disks into a coherent logical device before mounting or parsing the filesystem for evidence.

SeDebugPrivilege is a high-impact privilege that permits a process to obtain full access to other processes, including those running at higher integrity levels. Attackers commonly use it to enable process injection: with this privilege, they can call OpenProcess(PROCESS_ALL_ACCESS) on a victim process, then use WriteProcessMemory and CreateRemoteThread to inject and execute malicious code. The privilege is often present in admin or SYSTEM token but disabled by default, meaning the attacker must call AdjustTokenPrivileges to enable it before injection. This requirement directly explains why a security analyst would observe SeDebugPrivilege being manipulated in conjunction with process injection.

When a file is deleted in a FAT file system, the first character of its 8.3 directory entry is overwritten with 0xE5, which is the standard deletion marker. This byte serves as a tombstone so the operating system knows the entry is free for new file allocation while the remaining cluster chain and directory fields stay intact until reused. Forensic analysts rely on this marker to identify deleted files and recover data by parsing the rest of the entry, including the starting cluster value and file size, making 0xE5 a direct indicator of prior deletion.

Because UPX modifies the PE structure and replaces the original entry point with an unpacking stub, the file must first be unpacked to recover the original code for static analysis. If the sample retains a standard UPX header, running `upx -d` can restore it; otherwise, manual unpacking (e.g., OEP tracing via the pushad/popad pair, memory dump, and import reconstruction with Scylla or ImportREC) is required. Only then can strings, imports, and code logic be truly analyzed.

EnCase is a full forensic suite that acquires bit-for-bit images and exposes the underlying NTFS structures, including the Master File Table ($MFT), $LogFile, and $UsnJrnl, so an examiner can recover active and deleted files along with their timestamps, sizes, and parent paths. It performs file carving and signature analysis to reconstruct data from unallocated clusters, and it parses $MFT resident and non-resident data attributes to reassemble fragmented or partially overwritten records. This makes EnCase the appropriate choice when the goal is to examine and recover deleted artifacts from a Windows 10 system.

Unpacking is the correct next step because UPX is a reversible packer: the `upx -d` command can usually reconstruct the original executable, exposing the real code, import table, and resources for static analysis. Even if the UPX header is intentionally malformed or modified to resist automatic unpacking, a manual unpacking approach—using memory dumps, Scylla or ImpRec for import reconstruction—can recover the original logic. Analyzing the unpacked binary allows the investigator to identify malicious behavior without executing it, which is critical for understanding the threat and preserving integrity. This approach directly addresses the core investigative need to analyze the true payload, not just the packing stub.

This is the accurate reading of kSecAttrAccessibleWhenUnlockedThisDeviceOnly: it couples a time-based access gate (only after device unlock) with a device-scoped protection boundary (no iCloud backup and no restoration to another device). Keychain items with this attribute are available to apps only while the user has unlocked the device, and they do not appear in encrypted backups. A forensic examiner needs the unlocked device or the passcode to obtain the item.

Forensic carving scans the raw PST byte stream for known message property tags, signature patterns, and header structures that remain in unallocated blocks after logical deletion. Because deleting an item typically only marks its B-tree entries as free rather than scrubbing the underlying data, tools can reassemble deleted emails directly from the PST's free space and slack. This bypasses the file's logical index, which is exactly why it is the only listed option capable of recovering permanently deleted items.

The correct forensic step is to query the DNS TXT record for the selector and signing domain using tools like dig or nslookup, then use that public key to cryptographically verify the DKIM signature in the email headers. If the key is missing, expired, or does not match, this confirms the failure is due to a real spoofing attempt or misconfiguration. This validation is objective and reproducible, unlike replying or deleting evidence.

Files containing obfuscated code, such as base64-encoded strings wrapped in eval(), gzinflate(), or str_rot13(), are a strong indicator of a web shell because legitimate web applications rarely need to obscure their logic. Obfuscation is deliberately used to hide malicious payloads from static signature-based scanners and to complicate manual inspection. The presence of such encoding in an unexpected file under a web-accessible directory—especially in upload folders—strongly suggests an attacker is trying to evade detection and maintain remote access.

Event 7045 is the correct event because it is the Service Control Manager (SCM) event logged in the System event log whenever a new service is installed on the system. This event captures critical persistence indicators, including the service name, image file path, service type, and start type, making it a primary focus for forensic analysts investigating malware that establishes persistence by registering itself as a service. Unlike the Security log events in the other options, 7045 directly maps to the act of creating a service and appears during both legitimate software installs and malicious service creation.

Each user profile has a NTUSER.DAT file that is loaded into the registry's HKEY_CURRENT_USER hive upon user logon. It stores registry keys and values specific to that user, such as desktop settings, environment variables, application preferences, and many forensic artifacts like recently used files, typed URLs, and application-specific data. This is exactly the per-user configuration store.

Documenting the scene through photographs and establishing a secure perimeter is the mandatory first step in digital forensics, as it creates a verifiable record of the original state of the computer, cables, and peripherals before any interaction. Securing the area prevents unauthorized personnel from touching the machine, which could alter timestamps, memory contents, or other volatile evidence. This step also grounds the chain of custody by showing exactly what was present when first responders arrived, and it should precede any hardware or software actions on the system.

Creating a forensic copy of the EBS snapshot and attaching that copy to a separate EC2 instance in a different AWS account is the correct first preservation step because the snapshot is the only durable disk evidence of the compromised instance. Attaching the original snapshot to an analysis instance—even read-only—risks unwitting writes from filesystem journal replay, and operating in the same account risks accidental modification or deletion. A copied snapshot in an isolated account grants a clean, authority-controlled workspace where forensic tools cannot alter the original evidence.

This is a classic TCP SYN (half-open) scan, in which a scanner sends a SYN packet to each port and determines that a port is open if it receives a SYN-ACK response, while a RST indicates closed or filtered. Because the scanner immediately responds with an RST (or simply ignores the SYN-ACK) rather than completing the three-way handshake with an ACK, no full TCP connection is established, making this a quick and stealthy method for mapping open services. The pcap will show many SYN → SYN-ACK → RST sequences, with the scanner never sending the final ACK that would complete a legitimate connection.

An unbroken chain of custody records every transfer, handler and storage location of the evidence from seizure to court. This documentation proves the evidence has not been altered or tampered with, satisfying the requirement to demonstrate its integrity and admissibility throughout the investigation.

This is the correct interpretation: an .lnk file that points to a remote share or contains a UNC path (e.g., \\attacker-server\payload\.scr) is a recognized lateral movement technique. Attackers use LNK shortcuts as bootstrap payloads delivered through PsExec, scheduled tasks, or WMI, where the shortcut is written to a target host and triggers remote execution of a malicious script or binary. The shortcut's TargetPath and Arguments fields are the forensic keys to identifying this behavior.

~/.ssh/authorized_keys is a per-user file that stores the public keys (one key per line) that are permitted to log in as that user via SSH. When an attacker compromises a Linux server, a common persistence technique is to append their own public key to /root/.ssh/authorized_keys or another user's authorized_keys file, enabling silent passwordless access at any time. Checking this file for unrecognized keys — and correlating key hashes or comments with known legitimate admins — is direct evidence of key-based backdoor access, making it the correct file to examine in this scenario.

Fileless malware executes in volatile memory only, using legitimate tools like PowerShell, WMI, or .NET code, and never writes a persistent payload to the hard drive. Therefore a standard disk image, even a forensically sound one, will not contain the malicious code, as it lives entirely in RAM. To identify it, the investigator must capture and analyze memory (RAM) before the system is powered off; the absence of on-disk artifacts is the hallmark of this approach.

The X-Originating-IP header records the IP the sending client supplied at submission, often surviving forwarding that rewrites Received chains. Where present and unspoofed, it exposes the originating host directly, satisfying the stem's need to trace the original sender's IP rather than intermediate relays.

DNS queries to a domain that resolves to a known malicious IP are a classic C2 beaconing signature because the malware must resolve the hostname of its command-and-control server before establishing a session. During dynamic analysis, repeated DNS lookups to a domain tied to a malicious address indicate that the sample is attempting to reach infrastructure controlled by the attacker. The reputation correlation of the resolved IP raises the confidence that this is C2 communication rather than unrelated background traffic.

IP addresses embedded in the binary are static indicators because a strings extraction (e.g., `strings` or `floss`) can reveal them directly from the file bytes without executing the sample. These addresses often point to hardcoded command-and-control servers, and can be correlated with threat-intel feeds or observed network traffic. The malware analyst can triage the sample purely from static artifacts, making this a valid static IoC.

Creating a custom RBAC role with Owner permissions lets an attacker define a bespoke role carrying full control, bypassing detection tuned to built-in role assignments. The Activity Log records the role definition write, revealing deliberate privilege escalation rather than legitimate administrative change.

The 'message' table is the core target because each row represents a single SMS or iMessage, with columns such as 'text' (the message body), 'date' (absolute Unix time), 'is_from_me', and 'handle_id' linking to the sender. Logical forensic extraction typically includes this table to recover the actual words exchanged. Even when attachments or group metadata are involved, the text originates here, making it the correct choice.

When a PE file imports only LoadLibraryA and GetProcAddress, it indicates that the malware resolves other API functions at runtime. This technique, known as dynamic API resolution, evades static analysis because the actual functions used are not listed in the import table. Analysts must then resort to dynamic analysis or manual unpacking to uncover the full behavior of the sample.

Host system audit logs, such as those from auditd, systemd journal, or syslog, are the strongest artifact because the host kernel records container process activity in a way that survives container removal. These logs commonly capture container-ID-tagged process executions, file access, syscalls, and seccomp/AppArmor denials, allowing an investigator to reconstruct the container's interactions with the host. Unlike in-container logs, an attacker who deletes or overwrites files inside the container cannot easily erase the host-side audit trail.

Volatile data, by definition, vanishes the instant power is lost, so it must be captured first—RAM contents, running processes, active network connections, open files, and logged-on users. A responder should use statically linked, trusted forensic tools from внешней media to dump memory to a forensically sound image, record output, and preserve the system state in a documented chain of custody before any power-down or disk removal.

The /proc/[pid]/exe entry is a symlink to the exact on-disk binary that process 12345 is currently executing. If that link resolves to a deleted or hidden location, such as '/path/to/evil (deleted)', it indicates the process is running malware that was opened and unlinked to evade detection. This is a strong and direct indicator that PID 12345 is executing the malicious code.

winpmem is a Windows memory acquisition tool that captures physical memory to a raw file. Running it first preserves volatile data before any shutdown or further changes. It is specifically designed for forensic imaging of RAM on live Windows systems and is a standard first-responder tool. Capturing memory with winpmem before other actions aligns with order of volatility principles.

The logs indicate a webshell is in use because the HTTP requests contain a cmd parameter whose values are operating-system commands, a classic hallmark of server-side web shells such as China Chopper or b374k. The non-standard User-Agent further suggests a customized or automated attacker tool, and the consistent use of this parameter across requests shows persistent remote access. This behavior is the result of a command injection vulnerability, where the web application fails to sanitize user input before passing it to the system shell, allowing the attacker to execute arbitrary commands directly against the server.

POST requests to a script file with large payloads strongly suggest webshell activity because attackers use the HTTP body to hide command strings, encoded scripts, or file-upload content from URL-based logging and detection. A legitimate script receiving a large POST body is uncommon, and when combined with an executable extension (.php, .aspx, .jsp), it indicates the attacker is sending instructions or data to be processed by the shell. The large payload size also corresponds to obfuscated command blocks or base64-encoded data, making it a crucial behavioral indicator.

File slack is unused space at the end of a cluster that can be filled with data.

In FAT32, a file deletion changes the first byte of its directory entry to 0xE5, signaling that the entry is available for reuse, while the clusters linked in the FAT are marked as free. The actual data bytes remain in the volume until overwritten by new writes, so deleted files can often be recovered using forensic carving or FAT chain analysis. This makes 0xE5 a critical artifact for identifying recoverable evidence.

Documenting every transfer, handler and access point creates an unbroken audit trail proving the evidence was not altered or contaminated. This preserved integrity is what allows the artefact to be admitted as reliable in court or disciplinary proceedings.

The presence of UNION SELECT in a query parameter is a classic, definitive indicator of in-band SQL injection. An attacker appends a UNION-based query to the original SQL statement that the application executes against the backend database; if the attacker correctly matches the number and data types of the original query's columns, the database returns the attacker's chosen rows alongside the legitimate results, enabling data exfiltration. This technique operates entirely within the database engine and does not involve remote file loading, client-side script execution, or filesystem path traversal, making the log evidence fully consistent with an automated SQL injection probe.

The ~/.ssh/authorized_keys file for each user is the authoritative list of public keys allowed to log in as that account via SSH. Attackers commonly append a single base64-encoded line containing their public key, often with command= or from= restrictions to evade detection, enabling silent passwordless access independent of any password change. Comparing every entry against known administrative keys—while verifying file ownership, permissions, and the account's shell—is the direct method to locate such an implanted credential.

Writing to HKCU\Software\Microsoft\Windows\CurrentVersion\Run is a classic persistence technique because entries under this key are executed automatically each time the logged-in user starts a Windows session. This location is attractive to malware since it requires no elevated privileges to modify and survives reboots, allowing the malicious payload to re-launch on every user logon. Removing the registry value eliminates the persistence, which is why it is monitored by tools like Sysinternals Autoruns.

hdparm -N /dev/sda shows the user-accessible capacity vs. native capacity, revealing HPA.

A brute-force password attack is characterized by a high volume of Event ID 4625 (failed logon) entries, often from multiple source IPs or workstations, as the attacker cycles through password dictionaries or guesses. The systematic nature of these failures—repeated attempts against one or more accounts—is the definitive signature, which aligns with the observed 'multiple failed logons from different sources' in the security log.

Not a standard iOS backup database; likely not present or relevant.

Host Protected Area (HPA) is an ATA feature that uses the SET MAX ADDRESS command to lower the drive's reported maximum address, causing all sectors beyond that boundary to become inaccessible to the operating system and BIOS. This effectively hides data in the protected area at the end of the physical disk, which is exactly the kind of capacity mismatch that forensic acquisition tools detect by comparing the native maximum address against the current maximum. HPA is the correct answer because it directly addresses the hardware-level capacity reduction described.

In Windows 10, deleted files are stored under C:\$Recycle.Bin\<UserSID> as a pair of files with a shared random suffix: the $I file contains a binary structure—8-byte header, original file size, 64-bit FILETIME deletion timestamp, UTF-16 original path length, and the original absolute path—while the $R file retains the raw contents of the deleted object. Because the visible $R filename is a generated suffix, parsing the $I metadata is the only way to recover the original name and location; both files together allow full forensic reconstruction of the deletion.

In normal operation, DNS TXT records are used for verifiable text like SPF policies or domain ownership tokens and are rarely larger than a few hundred bytes; an attacker exfiltrating data will pad or encode payloads into TXT answers, causing response sizes to exceed typical benign traffic. Since a standard UDP DNS response without EDNS0 is limited to 512 bytes, responses that push against or exceed that limit (and require TCP fallback) are a solid anomaly. These oversized TXT responses, combined with a queried domain that also receives many random subdomain queries, are a hallmark of DNS tunneling.

File carving succeeds only when the original data content still physically exists on the media, typically in unallocated space. If the drive continued to be used after the file was deleted, the clusters that once held the file may have been reallocated and overwritten with new data. Overwriting destroys the original byte pattern, so there is nothing left for carving algorithms to recover. This is the correct reason a file may be un-carveable even though carving itself remains possible.

Property list files on macOS are structured XML or binary files that store per-app preferences, recent item lists, window states, and other persistent configuration data. In forensic examinations, they are critical for attributing user activity because they often contain timestamps and device-specific identifiers, and can be decoded with `plutil` or `strings`. They serve as the macOS counterpart to the Windows Registry for configuration and usage artifacts.

Capturing a full memory dump with FTK Imager (Memory Capture) or DumpIt preserves the entire contents of RAM, including running processes, loaded drivers, active network sockets, decrypted data, and injected code that exist only in volatile memory at that instant. This adheres to the order of volatility and allows analysis of the live system state without altering or destroying it. Memory imaging is the highest-priority step because many advanced threats operate solely in memory and leave minimal traces on disk.

X-Originating-IP is a non-standard header inserted by certain email clients, such as Microsoft Outlook/Exchange, when a message is composed and sent; it contains the raw IP address of the client machine that actually sent the message before it reached a mail server. This header is a direct, valuable starting point in an investigation because it points to the sender's own network connection. However, its presence is client-dependent and it can be absent or forged if the client or a malicious user chooses to omit or modify it.

Webshell activity spawns unexpected processes under the web server's user context, driving sustained CPU consumption from httpd, w3wp, or similar. This resource anomaly reflects attacker commands executing through the shell, distinguishing it from normal request-driven load spikes.