Computer Hacking Forensic Investigator CHFI CHFI Questions 151–205 | Page 3/3

151

MCQmedium

During a forensic examination of a Linux ext4 file system, an investigator runs the `ls -i` command and sees inode numbers. They need to examine the inode structure. Which command should they use to display detailed inode information?

A.dd if=/dev/sda1 of=output.img

B.debugfs -R 'stat <inode>' /dev/sda1

C.mount -o loop image.img /mnt

D.fsck /dev/sda1

AnswerB

debugfs is the standard ext2/ext3/ext4 filesystem debugger, and the -R option lets you execute a single request in non-interactive mode. The 'stat <inode>' command within debugfs prints the complete inode record, including file mode, UID/GID, size, access/change/modification times, link count, and block allocation data. This makes it the correct choice for directly querying inode information on a live device or an acquired image without mounting or modifying the filesystem.

Why this answer

The `debugfs` command is a native ext2/ext3/ext4 file system debugger that allows direct inode inspection. The `-R 'stat <inode>'` flag runs the `stat` command in debugfs to display the full inode structure, including permissions, timestamps, block pointers, and extended attributes, which is exactly what the investigator needs after seeing inode numbers from `ls -i`.

Exam trap

EC-CHFI often tests the distinction between file system analysis tools (debugfs) and general-purpose disk utilities (dd, mount, fsck), trapping candidates who confuse imaging or mounting with inode-level inspection.

How to eliminate wrong answers

Option A is wrong because `dd` is a low-level block copy tool used for imaging or cloning a partition; it does not parse or display inode metadata. Option C is wrong because `mount -o loop` attaches a disk image to the file system tree for access as a mounted volume, but it does not provide a command to dump raw inode details—it only makes files accessible via standard file operations. Option D is wrong because `fsck` is a file system consistency check and repair tool; it does not display inode structures and is not designed for forensic inode examination.

Full explanation →

152

MCQhard

During a forensic investigation, the analyst needs to verify the integrity of a forensic image. The analyst originally computed MD5 and SHA-1 hashes of the source drive. Which action BEST ensures the image has not been altered?

A.Recompute MD5 and SHA-1 hashes of the image and compare with the original

B.Check that the image was created using a write blocker

C.Compare the file size of the image with the original drive's capacity

D.Open the image in FTK Imager and browse a few files

AnswerA

Cryptographic hash algorithms such as MD5 and SHA-1 generate a fixed-size digest that is computationally infeasible to reverse, so recomputing these hashes over the entire image and matching them against the original acquisition hashes confirms that every bit of the image remains unchanged since capture. Because MD5 and SHA-1 use different mathematical constructions, matching both simultaneously makes an accidental collision astronomically unlikely, and this is the standard integrity verification method accepted in forensic practice.

Why this answer

Recomputing the MD5 and SHA-1 hashes of the forensic image and comparing them to the original values is the definitive method to verify integrity. Hash functions produce a fixed-size digest that changes completely if even a single bit of the image is altered, providing cryptographic assurance that the image is an exact bit-for-bit copy of the source drive. This process directly validates data integrity, which is a core requirement in forensic acquisition.

Exam trap

EC-Council often tests the misconception that using a write blocker or checking file size is sufficient for integrity verification, but the trap is that only cryptographic hash comparison provides the mathematical proof required to detect any alteration.

How to eliminate wrong answers

Option B is wrong because using a write blocker ensures the source drive is not modified during acquisition, but it does not verify that the resulting image file has remained unchanged after creation. Option C is wrong because file size alone is not a reliable integrity check; two different data sets can have the same size, and size does not detect bit-level corruption or intentional tampering. Option D is wrong because browsing a few files in FTK Imager only checks that the image is mountable and some files appear intact, but it does not provide a cryptographic guarantee that every byte of the image matches the original.

Full explanation →

153

MCQeasy

Which mobile forensic tool is commonly used to perform a physical extraction of an iOS device, including bypassing the lock screen on certain models?

A.Magnet AXIOM

B.GrayKey

C.Oxygen Forensic Detective

D.FTK Imager

AnswerB

GrayKey is a hardware-software system developed by Grayshift specifically for law enforcement and forensic use, designed to perform passcode bypass and physical extraction from iOS devices. It exploits bootrom or Secure Enclave vulnerabilities to derive the passcode and decrypt the file system, yielding a full filesystem image, keychain, and app data even from locked devices. This capability makes it the de facto standard for iOS physical extraction in many criminal investigations, distinguishing it from general-purpose mobile forensic platforms.

Why this answer

GrayKey is a specialized hardware tool designed by Grayshift that performs physical extraction of iOS devices, including bypassing the lock screen on certain models (e.g., iPhone 5 through iPhone X) by exploiting bootrom vulnerabilities or using brute-force techniques. It is widely used in law enforcement for forensic acquisition of iOS devices where logical extraction is insufficient.

Exam trap

EC-Council often tests the distinction between logical extraction tools (like Magnet AXIOM or Oxygen Forensic Detective) and hardware-based physical extraction tools (like GrayKey), leading candidates to mistakenly choose a familiar forensic suite that cannot bypass iOS lock screens.

How to eliminate wrong answers

Option A is wrong because Magnet AXIOM is a comprehensive digital forensics platform that supports logical and file system extractions from iOS devices but does not natively perform physical extraction or lock screen bypass; it relies on other tools (like GrayKey or checkra1n) for that capability. Option C is wrong because Oxygen Forensic Detective is a forensic suite that can extract data from iOS devices via logical or advanced logical methods, but it does not include hardware-based physical extraction or lock screen bypass; it depends on third-party tools or jailbreaks for deeper access. Option D is wrong because FTK Imager is a disk imaging tool for creating forensic images of storage media (e.g., hard drives, SD cards) and does not support mobile device extraction, let alone iOS physical extraction or lock screen bypass.

Full explanation →

154

Multi-Selectmedium

A forensic analyst is examining MySQL binary logs to identify a data exfiltration event. Which TWO fields are most critical for reconstructing the stolen data?

Select 2 answers

A.Error code

B.Timestamp

C.Server ID

D.SQL statement

E.Thread ID

AnswersB, E

Binlog event headers include a timestamp (in seconds since epoch) that enables forensic reconstruction of the exact order in which transactions occurred. This chronology is essential for correlating binlog events with other logs (e.g., access logs) to pinpoint when data was accessed and exfiltrated, and for establishing a timeline of an attacker's actions.

Why this answer

Timestamp (B) is critical for reconstructing the stolen data because it establishes the exact sequence of events, allowing correlation with other logs (e.g., general query log) to pinpoint when exfiltration occurred. Thread ID (E) uniquely identifies the database connection; by correlating thread IDs across binary logs and general query logs, the analyst can trace all queries (including SELECTs) executed by the same connection, revealing the exfiltration queries that are not recorded in binary logs. Together, these fields enable chronological and connection-based reconstruction, compensating for the binary log's lack of SELECT logging.

Exam trap

EC-Council often tests the misconception that SQL statements are always present in binary logs. However, binary logs only record data-changing operations (INSERT, UPDATE, DELETE, DDL), not SELECT queries used for typical data exfiltration. The critical fields for reconstructing stolen data from binary logs are timestamp and thread ID, which allow correlation with other logs that capture the actual SELECT statements.

Full explanation →

155

Multi-Selectmedium

Which TWO of the following are considered types of evidence under the rules of evidence?

Select 2 answers

A.Best evidence rule

B.Direct evidence

C.Circumstantial evidence

D.Hearsay evidence

E.Exculpatory evidence

AnswersB, C

Direct evidence directly proves a fact without inference.

Why this answer

Direct evidence (Option B) is a type of evidence under the rules of evidence because it directly proves a fact without requiring any inference or presumption. In computer forensics, this could include a log entry showing an unauthorized login from a specific IP address at a specific time, which directly proves the fact of access. The rules of evidence recognize direct evidence as primary proof that stands on its own.

Exam trap

EC-Council CHFI often tests the distinction between a rule of evidence (like the Best Evidence Rule) and a type of evidence (direct or circumstantial), causing candidates to confuse procedural rules with classification categories.

Full explanation →

156

MCQeasy

You are a forensic investigator responding to an incident on a Windows 10 workstation used by a finance manager. The user reports that a critical spreadsheet containing quarterly budget data was accidentally deleted from the Desktop yesterday at approximately 3:00 PM. The system has been used normally since then, and the user has not emptied the Recycle Bin. You have created a forensic image of the drive using FTK Imager. The Recycle Bin contains a file named 'Quarterly_Budget.xlsx', but it appears to be a shortcut (size 1 KB). The user insists the original file was several megabytes. You need to recover the original file. Which action should you take next?

A.Search the $Recycle.Bin folder on the forensic image to locate the original file data, which may be stored under a different name.

B.Restore a previous version of the Desktop folder from Volume Shadow Copy.

C.Use file carving techniques to recover the file from unallocated space on the Desktop.

D.Check the Recycle Bin on the live system; the file should be there and can be restored.

AnswerA

On the forensic image, the $Recycle.Bin folder contains the original file data in a renamed storage file (typically $R...) while a companion $I... file preserves the original name and metadata; relying on the live Recycle Bin UI is insufficient because it only exposes a virtual view of these entries. Searching this hidden system folder directly is the correct first step because the file is still fully allocated and recoverable without carving or relying on volume snapshots.

Why this answer

When a file is moved to the Recycle Bin on Windows 10, the original file data is not stored in the Recycle Bin itself; instead, a hidden file (with a random name) is created in the `$Recycle.Bin` folder on the volume, and a shortcut (the visible entry) is placed in the Recycle Bin. The shortcut points to the hidden file, which retains the original data. Since the visible entry is only 1 KB, the actual file content must be located in the `$Recycle.Bin` folder under a different name, making option A the correct next step.

Exam trap

The trap is that candidates assume the Recycle Bin contains the actual file data, but the question tests the understanding that the Recycle Bin only stores a shortcut, and the real data is hidden in the `$Recycle.Bin` folder under a different name.

How to eliminate wrong answers

Option B is wrong because restoring a previous version from Volume Shadow Copy would only work if the file was deleted via a system restore point or if the Desktop folder had versioning enabled, which is not guaranteed and is not the primary mechanism for Recycle Bin recovery. Option C is wrong because file carving from unallocated space is a last-resort technique for when the file is not recoverable via the Recycle Bin or file system metadata; here, the file is still logically present in the Recycle Bin structure, so carving is unnecessary and less reliable. Option D is wrong because the user has already created a forensic image, and checking the live system could alter evidence; moreover, the Recycle Bin on the live system would show the same shortcut, not the original data.

Full explanation →

157

MCQeasy

During a mobile device investigation, an examiner needs to acquire the maximum amount of data from a locked iOS device without modifying it. Which acquisition type should be used?

A.Manual acquisition

B.Physical acquisition

C.Logical acquisition

D.File system acquisition

AnswerB

Physical acquisition is the most comprehensive forensic method, creating a bit-for-bit image of the device's raw flash memory. This allows recovery of deleted files, unallocated space, and hidden partitions that logical or file system methods would miss. On locked devices, specialized tools like GrayKey or Cellebrite UFED leverage hardware or bootrom exploits (e.g., checkm8) to bypass the lock screen and extract the full memory image without needing the user's passcode. Because it operates below the operating system layer, physical acquisition is the only method that can fully preserve and recover data from a locked device.

Why this answer

Physical acquisition is the correct choice because it creates a bit-for-bit copy of the entire flash storage, including the operating system, user data, and deleted file remnants, without relying on the iOS operating system to be unlocked or cooperative. This method bypasses the lock screen by exploiting hardware or software vulnerabilities (e.g., checkm8 bootrom exploit) or using advanced forensic tools (e.g., Cellebrite, GrayKey) to read the raw NAND memory, ensuring maximum data extraction while maintaining forensic integrity.

Exam trap

EC-Council often tests the misconception that logical acquisition is sufficient for locked devices because it can extract backups, but the trap is that logical acquisition still requires the device to be unlocked or have a trusted relationship established, whereas physical acquisition is the only method that can bypass the lock screen to capture the entire storage image.

How to eliminate wrong answers

Option A is wrong because manual acquisition requires the device to be unlocked and interactive, which is impossible with a locked iOS device and only captures visible data on the screen, not the full storage. Option C is wrong because logical acquisition only extracts files and databases accessible through the iOS operating system’s APIs (e.g., via iTunes backup or libimobiledevice), which requires the device to be unlocked and does not capture deleted data or system partitions. Option D is wrong because file system acquisition, while more detailed than logical, still requires the device to be unlocked (e.g., via jailbreak or trusted connection) and only retrieves the file system hierarchy, not the raw blocks of the storage, missing unallocated space and hidden partitions.

Full explanation →

158

MCQmedium

An expert witness is preparing to testify in a computer forensics case. Which of the following is a key requirement for the expert's testimony to be admissible under the Daubert standard?

A.The expert's methods must be generally accepted in the scientific community

B.The expert's techniques must be based on reliable principles and methods

C.The expert must have personally examined all evidence

D.The expert must have a law degree

AnswerB

Under Federal Rule of Evidence 702 and the Supreme Court’s Daubert ruling, an expert’s testimony must be grounded in reliable principles and methods, which are then applied reliably to the facts of the case. The court evaluates reliability through factors such as whether the technique has been empirically tested, subjected to peer review, has a known or potential error rate, and is governed by standards controlling its operation. This gatekeeping role ensures that the jury receives only scientifically valid and relevant expert testimony, making this statement the correct standard for admissibility.

Why this answer

Under the Daubert standard, the admissibility of expert testimony hinges on whether the expert's techniques are based on reliable principles and methods, not merely on general acceptance. This standard, established in Daubert v. Merrell Dow Pharmaceuticals, requires the trial judge to act as a gatekeeper, evaluating the scientific validity and reliability of the methodology used.

In computer forensics, this means the expert must demonstrate that their acquisition, preservation, and analysis methods (e.g., using write-blockers, cryptographic hashing like SHA-256, and chain-of-custody documentation) are scientifically sound and consistently applied.

Exam trap

The CHFI exam often tests the distinction between the Daubert and Frye standards, and the trap here is that candidates mistakenly choose 'general acceptance' (Option A) because it was the historical standard, but Daubert requires a more rigorous focus on the reliability and scientific validity of the methodology itself.

How to eliminate wrong answers

Option A is wrong because while general acceptance (the Frye standard) is a factor under Daubert, it is not the sole or key requirement; Daubert emphasizes reliability and relevance over mere acceptance. Option C is wrong because the expert witness does not need to personally examine all evidence; they can rely on reports, logs, and data provided by other qualified personnel, as long as the underlying methodology is reliable. Option D is wrong because a law degree is not a requirement for expert testimony in computer forensics; the expert's qualification comes from technical expertise, certifications (e.g., CHFI, EnCE), and practical experience, not legal credentials.

Full explanation →

159

MCQmedium

During a forensic examination of a Windows system, an analyst finds a file that appears to be zero bytes in size when viewed in Windows Explorer, but the file's properties show a size on disk of 4 KB. What is the most likely explanation?

A.The file contains only slack space

B.The file is compressed using NTFS compression

C.The file is stored in an alternate data stream (ADS)

D.The file is a sparse file

AnswerC

NTFS supports alternate data streams (ADS), which are named data streams attached to a file in addition to the default unnamed stream. The file's logical size, as displayed in Explorer or via standard APIs, reflects only the unnamed main stream, so a file with an empty main stream but data written into a named ADS will show 0 bytes while still consuming allocated clusters on disk for the ADS content. Forensic examiners must enumerate all data streams (e.g., using `dir /R` or specialized tools) to detect hidden data.

Why this answer

An alternate data stream (ADS) allows additional data to be stored with a file in NTFS. Windows Explorer typically displays only the size of the main file stream, not the ADS. Therefore, a file with a zero-byte main stream but an ADS containing data will show a logical size of 0 bytes, while the 'size on disk' reflects the allocated clusters for the ADS data (e.g., 4 KB).

This is a common technique used to hide data.

Exam trap

Candidates often confuse the discrepancy between logical size and size on disk. They may attribute it to sparse files or compression, but the key clue is a zero-byte logical size with non-zero disk allocation, which is a classic indicator of an alternate data stream.

How to eliminate wrong answers

Option A is wrong because slack space is unused space in a cluster after the end of a file's data, not a file itself; a file cannot 'contain only slack space' as a file type. Option B is wrong because NTFS compression reduces the physical size on disk below the logical size, but the logical size in Explorer would still show the uncompressed size, not zero bytes. Option C is wrong because an alternate data stream (ADS) is a hidden data stream attached to a file; the main file's size would still be visible in Explorer, and ADS does not cause the main file to appear as zero bytes with a 4 KB size on disk.

Full explanation →

160

Multi-Selectmedium

Which TWO of the following are considered forms of evidence under the rules of evidence? (Select two.)

Select 2 answers

A.Illegally obtained evidence

B.Hearsay evidence

C.Circumstantial evidence

D.Opinion evidence

E.Direct evidence

AnswersC, E

Circumstantial evidence requires inference but is still valid.

Why this answer

Circumstantial evidence is a recognized form of evidence under the rules of evidence because it allows a fact-finder to infer a fact from other established facts, even without direct witness testimony. In digital forensics, this is critical when reconstructing user activity from log files, file metadata, or network traffic patterns that indirectly prove an action occurred.

Exam trap

EC-Council often tests the distinction between admissibility and form of evidence, leading candidates to mistakenly select 'illegally obtained evidence' as a valid form because they confuse the concept of 'evidence' with 'admissible evidence'.

Full explanation →

161

MCQmedium

A security analyst reviewing Windows Security Event Logs sees multiple Event ID 4625 entries for a single user account, followed by a successful Event ID 4624. The account is a domain administrator. What is the MOST likely explanation?

A.The user typed their password incorrectly several times before succeeding

B.The system experienced a denial of service attack

C.An attacker performed a brute-force password attack and succeeded

D.A misconfigured application caused repeated logon attempts

AnswerC

Multiple failed logon attempts followed by a successful logon, especially on a privileged account, strongly suggests a brute-force attack.

Why this answer

Event ID 4625 indicates a failed logon attempt, while Event ID 4624 indicates a successful logon. A sequence of multiple 4625 events for the same domain administrator account followed by a single 4624 event is the classic signature of a successful brute-force password attack, where an attacker systematically tries passwords until one works. The fact that the account is a domain administrator makes it a high-value target, and the pattern of failures then success is inconsistent with simple user error or misconfiguration.

Exam trap

The trap here is that candidates confuse a brute-force attack (multiple failures from a single account) with a user simply mistyping their password, but the key differentiator is the volume of failures and the targeted nature of a domain administrator account, which is a high-value target for attackers.

How to eliminate wrong answers

Option A is wrong because a user typing their password incorrectly several times before succeeding would typically show a small number of 4625 events (e.g., 3–5) with no specific pattern, but the question implies multiple failures, and a domain administrator is unlikely to repeatedly mistype their password without triggering account lockout policies. Option B is wrong because a denial of service attack would generate a high volume of logon failures from many different accounts or IPs, not a single account followed by a success, and Event ID 4625 alone does not indicate DoS; DoS attacks target service availability, not authentication. Option D is wrong because a misconfigured application would typically produce consistent, periodic 4625 events (e.g., every few minutes) from the same service account or system account, not a single user account followed by a successful logon, and it would not target a domain administrator account specifically.

Full explanation →

162

MCQhard

An investigator seizes a computer that was involved in a crime. The suspect claims that the evidence was planted. Which forensic principle best helps to refute this claim by demonstrating that the evidence could only have been left by the suspect?

A.Locard's exchange principle

B.Hearsay rule

C.Best evidence rule

D.Chain of custody

AnswerA

Locard's principle asserts that every contact leaves a trace, supporting that the suspect's interaction with the evidence is inevitable.

Why this answer

Locard's exchange principle states that every contact leaves a trace. In digital forensics, this means the suspect's interaction with the computer—such as typing, accessing files, or connecting peripherals—will leave unique digital artifacts (e.g., registry keys, prefetch files, USB device serial numbers, or browser history). By demonstrating that these artifacts could only have been created by the suspect's specific actions or device, the investigator refutes the claim of planting.

Exam trap

EC-Council often tests whether candidates confuse chain of custody (a procedural safeguard) with Locard's principle (a scientific concept about trace evidence), leading them to pick chain of custody when the question asks about how evidence was left by the suspect.

How to eliminate wrong answers

Option B (Hearsay rule) is wrong because it is a legal rule governing the admissibility of out-of-court statements as evidence, not a forensic principle about physical or digital trace transfer. Option C (Best evidence rule) is wrong because it requires the original document or recording as evidence, not a principle explaining how evidence is left by a suspect. Option D (Chain of custody) is wrong because it documents the handling and integrity of evidence from seizure to court, but does not itself demonstrate that the evidence was left by the suspect.

Full explanation →

163

MCQhard

In a UK-based investigation, law enforcement officers seize a computer without a warrant. The suspect argues the seizure violated his rights under the Police and Criminal Evidence Act 1984 (PACE). Which of the following is a key consideration under PACE regarding the admissibility of the seized evidence?

A.The evidence is automatically admissible because it was seized during an investigation.

B.The evidence is admissible because it is circumstantial.

C.The evidence is admissible only if the suspect signed a consent form.

D.The court may exclude the evidence if its admission would be unfair to the suspect.

AnswerD

Section 78 of PACE gives the court discretion to exclude evidence obtained improperly.

Why this answer

Under Section 78 of PACE, the court has discretion to exclude prosecution evidence if its admission would have such an adverse effect on the fairness of the proceedings that it ought not to be admitted. Since the computer was seized without a warrant, the court must weigh the potential breach of PACE safeguards against the probative value of the digital evidence. This is not automatic exclusion, but a judicial balancing test specific to the circumstances of the seizure.

Exam trap

EC-Council often tests the misconception that any procedural violation automatically excludes evidence, whereas PACE Section 78 gives the court discretion to admit evidence if the breach does not render the trial unfair.

How to eliminate wrong answers

Option A is wrong because PACE does not provide automatic admissibility for evidence seized without a warrant; the court retains discretion under Section 78 to exclude evidence obtained in breach of PACE codes. Option B is wrong because the classification of evidence as circumstantial or direct has no bearing on admissibility under PACE; the key factor is the fairness of the proceedings, not the type of evidence. Option C is wrong because PACE does not require a suspect's signed consent for admissibility; consent relates to lawful search and seizure under PACE Code B, but even without consent, evidence may still be admissible if the court deems it fair to admit.

Full explanation →

164

Multi-Selecthard

During a forensic analysis of a compromised web server, an investigator identifies the following log entries. Which THREE entries are the strongest indicators of a successful web shell upload? (Choose three.)

Select 3 answers

A.POST /upload.php HTTP/1.1 200 0

B.POST /uploads/shell.aspx HTTP/1.1 200 - -

C.GET /uploads/shell.aspx?cmd=dir HTTP/1.1 200 - -

D.GET /../../windows/system32/cmd.exe HTTP/1.1 404 - -

E.GET /images/logo.png HTTP/1.1 304 - -

AnswersA, B, C

A POST request to /upload.php that returns HTTP 200 with a zero-byte response body indicates the server accepted a client upload even though the reply was empty. In Apache access logs, the trailing '0' is the response size in bytes, so this record is consistent with a PHP upload handler completing successfully and not returning content. Combined with the known purpose of upload.php, this is a strong forensic foothold for a web shell planted through the application's file-upload feature.

Why this answer

Successful uploads of aspx or php files that contain web shell code (e.g., with cmd parameter) and subsequent access to those files are strong indicators. The 404 for cmd.exe indicates a path traversal attempt, not a web shell.

Full explanation →

165

Multi-Selecthard

During the initial response to a suspected data exfiltration, which THREE pieces of volatile data should be collected first? (Choose three.)

Select 3 answers

A.Current network connections.

B.List of running processes.

C.Contents of system memory (RAM).

D.Windows registry hives.

E.Forensic image of the hard drive.

AnswersA, B, C

Network connections are transient and may disappear.

Why this answer

Current network connections (A) are volatile because they show active communication channels that could indicate data exfiltration in progress. If the system is shut down or disconnected, this evidence is lost immediately, making it a top priority for collection during initial response.

Exam trap

EC-Council often tests the Order of Volatility principle, and the trap here is that candidates mistakenly prioritize persistent data like registry hives or disk images over transient evidence that disappears immediately upon shutdown.

Full explanation →

166

MCQmedium

An investigator is analyzing a Windows 10 system suspected of malware persistence. Which registry key is commonly used by malware to achieve persistence by running a program at every user logon?

A.HKLM\SAM\SAM

B.HKLM\SYSTEM\CurrentControlSet\Services

C.HKCU\Software\Microsoft\Windows\CurrentVersion\Run

D.HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall

AnswerC

This is the canonical per-user Autorun key: when the user logs in, Winlogon/Explorer enumerates values under HKCU\Software\Microsoft\Windows\CurrentVersion\Run and launches each command line, making it the exact location an investigator should inspect for a user-specific startup program. The HKCU hive is loaded from the user's NTUSER.DAT, so findings here are tied to a single profile. Because the question asks about a Windows 10 user logon startup, this key is the correct answer.

Why this answer

The HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key is a standard autostart location that Windows checks at every user logon. Malware commonly writes a value here pointing to its executable path, ensuring it runs automatically each time the user logs into their account. This is a well-documented persistence mechanism in Windows forensics.

Exam trap

The trap here is that candidates confuse the Run key with the Services key (Option B), thinking that any service can achieve per-user logon persistence, but services run under the SYSTEM account and are not triggered by user logon unless specifically configured with a trigger-start service or by setting the service to 'Automatic' and relying on delayed start, which is not the standard per-user logon mechanism.

How to eliminate wrong answers

Option A is wrong because HKLM\SAM\SAM stores the Security Account Manager database containing user password hashes and local account information, not autostart locations; it is unrelated to program persistence at logon. Option B is wrong because HKLM\SYSTEM\CurrentControlSet\Services is used to register Windows services that start automatically with the system (e.g., at boot), not specifically at every user logon; while services can be configured for delayed start or automatic start, the Run key is the direct per-user logon mechanism. Option D is wrong because HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall stores uninstallation metadata for installed applications, not autostart entries; malware would not use this key to achieve persistence.

Full explanation →

167

MCQmedium

A forensic analyst receives a mobile device that has been factory reset. Which of the following types of data is MOST likely to be recoverable using advanced forensic techniques?

A.Deleted text messages and call logs, but not app data

B.All user data, as factory reset only deletes file pointers

C.Google account tokens and cached credentials

D.No data is recoverable after a factory reset on modern devices

AnswerC

Google account tokens and cached credentials can remain recoverable because they are not always stored solely in the encrypted userdata partition. Some authentication tokens are cached in reserved flash areas, NVRAM, or the TrustZone secure world, which the factory reset routine may not fully overwrite. Advanced physical forensics, such as chip-off imaging and JTAG extraction, can recover these residual token blobs, and if combined with a known or brute-forced key, they may allow account access even though normal app and media data is destroyed.

Why this answer

A factory reset typically does not overwrite the flash memory where Google account tokens and cached credentials are stored. Advanced forensic techniques, such as chip-off or JTAG, can recover these remnants from the NAND flash memory, as the reset only marks the storage blocks as available for reuse without physically erasing the data.

Exam trap

EC-Council often tests the misconception that a factory reset is equivalent to a secure wipe, but in reality, it only deletes file pointers and leaves residual data in unallocated flash memory, which advanced forensic techniques can recover.

How to eliminate wrong answers

Option A is wrong because deleted text messages and call logs are also stored in unallocated flash memory and can be recovered alongside app data using advanced techniques, not exclusively excluded. Option B is wrong because a factory reset does not preserve all user data; it clears user data partitions and file pointers, but some residual data may remain in unallocated space, not the entire dataset. Option D is wrong because modern devices still leave recoverable data in unallocated NAND flash blocks after a factory reset, especially tokens and credentials, due to the lack of secure erase commands like eMMC sanitize being executed.

Full explanation →

168

MCQhard

During a forensic investigation, you encounter a RAID 5 array consisting of three 1 TB disks. The array is failed, and you need to reconstruct the original data. Which of the following approaches is MOST appropriate for data recovery?

A.Mount each disk individually and copy files

B.Run `mdadm --assemble --scan` on the images

C.Use `dd` to image each disk and then XOR the three images together

D.Use EnCase to perform a RAID rebuild with known parameters

AnswerD

EnCase (and similar forensic tools like X-Ways or FTK Imager) can reconstruct a logical RAID 5 volume from disk images by letting you specify the disk order, stripe size, and parity rotation scheme. Once the parameters are set, the tool virtually reassembles the array in memory or as a new image, making the filesystem visible for standard forensic analysis. This is the correct approach when the original RAID metadata is unavailable or partially damaged, as the tool can also parse controller metadata or accept manual input to recover the array.

Why this answer

EnCase Forensic has a built-in RAID reconstruction feature that can automatically rebuild a RAID 5 array from disk images when the RAID parameters (stripe size, parity rotation, disk order) are known or can be detected. This is the most appropriate approach for a failed RAID 5 array, as it handles the parity-based striping and reassembles the logical volume without requiring manual XOR operations or risking data corruption.

Exam trap

The CHFI exam often tests the misconception that a simple XOR of all disk images (Option C) is sufficient for RAID 5 recovery, but this fails because the parity is distributed and not a simple XOR of the entire disk; the correct approach requires knowing the RAID geometry and using a tool that handles stripe-level reconstruction.

How to eliminate wrong answers

Option A is wrong because mounting each disk individually in a RAID 5 array will only show partial, fragmented data (stripes and parity), not the complete logical volume; files are striped across all disks, so individual mounts yield unusable data. Option B is wrong because `mdadm --assemble --scan` is a Linux software RAID command that works only if the array metadata is intact and the disks are still part of a functional RAID set; in a failed array with corrupted metadata, this command cannot reconstruct the data. Option C is wrong because XORing three raw disk images together without knowing the exact stripe size, parity layout, and disk order will produce garbage; RAID 5 uses distributed parity, so a simple XOR of all three images does not account for stripe boundaries or parity rotation.

Full explanation →

169

Multi-Selecteasy

During a Windows forensic investigation, an analyst finds prefetch files with the .pf extension. Which TWO pieces of information can the analyst obtain from analyzing prefetch files?

Select 2 answers

A.The number of times the application has been executed

B.The exact date and time of each execution

C.The username that executed the application

D.The command-line arguments used to launch the program

E.The IP addresses the application connected to

AnswersA, B

Prefetch stores a run counter.

Why this answer

Prefetch files in Windows store execution count and timestamps of application launches. The .pf file header contains a run count field that increments each time the application is executed, and the file also records up to eight previous execution timestamps. This allows the analyst to determine how many times the application was run and the exact date and time of each execution, making A and B correct.

Exam trap

A common misconception is that prefetch files contain user-specific data or command-line arguments, but they only store execution count and timestamps, not user identity or process invocation details.

Full explanation →

170

MCQeasy

Which of the following tools is designed specifically for dynamic analysis of malware by executing it in a controlled, isolated environment?

A.PEiD

B.Ghidra

C.Cuckoo Sandbox

D.IDA Pro

AnswerC

Cuckoo Sandbox is a dynamic analysis tool that runs malware in an isolated environment and monitors behavior.

Why this answer

Cuckoo Sandbox is an open-source automated malware analysis system designed specifically for dynamic analysis. It executes suspicious files in a controlled, isolated environment (a virtual machine) and monitors their behavior, including system calls, file system changes, registry modifications, and network traffic, to produce a comprehensive report without risking the host system.

Exam trap

EC-Council often tests the distinction between static analysis tools (like PEiD, Ghidra, IDA Pro) and dynamic analysis sandboxes (like Cuckoo), so the trap is that candidates may confuse a debugger or disassembler (which can execute code step-by-step) with a fully automated, isolated sandbox environment.

How to eliminate wrong answers

Option A (PEiD) is wrong because it is a static analysis tool that detects packers, cryptors, and compilers in PE files by scanning signatures; it does not execute malware. Option B (Ghidra) is wrong because it is a reverse-engineering framework focused on static analysis and disassembly/decompilation of binaries, not on executing malware in an isolated environment. Option D (IDA Pro) is wrong because it is an interactive disassembler and debugger used for static and limited dynamic analysis (via its debugger), but it is not designed as a sandbox for automated, isolated execution of malware.

Full explanation →

171

MCQeasy

A forensic analyst is performing timeline analysis on a compromised system. Which tool is specifically designed to parse multiple log sources and create a super timeline?

A.Sleuth Kit

B.log2timeline

C.Volatility

D.Wireshark

AnswerB

log2timeline (part of Plaso) is designed to create super timelines from multiple sources.

Why this answer

log2timeline (now part of the plaso framework) is specifically designed to parse multiple log sources—such as Windows Event Logs, syslog, web server logs, and file system metadata—and aggregate them into a single super timeline. This enables forensic analysts to correlate events across disparate logs for timeline analysis, which is exactly the requirement in the question.

Exam trap

EC-Council often tests the distinction between disk forensics tools (Sleuth Kit), memory forensics tools (Volatility), network forensics tools (Wireshark), and timeline/log analysis tools (log2timeline), so candidates mistakenly choose a tool they recognize from other forensics domains without reading the specific requirement for parsing multiple log sources.

How to eliminate wrong answers

Option A is wrong because Sleuth Kit is a collection of command-line tools for analyzing disk images and file system structures (e.g., extracting deleted files, viewing MFT entries), not for parsing multiple log sources to create a super timeline. Option C is wrong because Volatility is a memory forensics framework used to analyze RAM dumps (e.g., processes, network connections, registry hives in memory), not for parsing log files from disk. Option D is wrong because Wireshark is a network protocol analyzer that captures and inspects live or recorded packet captures (pcap files), not for parsing system or application logs into a timeline.

Full explanation →

172

MCQhard

Refer to the exhibit. An investigator is examining a disk image using TSK. The output from 'fls' shows the directory structure. What is the significance of the entry 'V/V 113-128-1: $OrphanFiles'?

A.It is a sign that a rootkit has hidden files in the image

B.It indicates the location of the Master File Table (MFT) mirror

C.It is a virtual directory that contains files with no parent directory, often from deleted files

D.It is a standard NTFS metadata file that stores file permissions

AnswerC

In tools like The Sleuth Kit (tsk) and Autopsy, the virtual directory named $OrphanFiles (or displayed as 'V/V') is not a literal directory stored on the disk. It is dynamically generated to represent files whose MFT entries exist but whose parent directory references were lost, typically because the directory entry was deleted, overwritten, or corrupted while the file record itself remains in the MFT. This commonly occurs after a file is deleted, when the directory index entry is removed but the file's MFT record is not yet reused, or after a malformed directory entry prevents normal linkage in the tree.

Why this answer

In The Sleuth Kit (TSK), the 'fls' command lists files and directories within a disk image. The entry 'V/V 113-128-1: $OrphanFiles' is a virtual directory that contains files that have no parent directory in the file system, typically because their directory entries were deleted or corrupted. This is a common artifact when recovering deleted files from NTFS volumes, as TSK collects such orphaned MFT entries into this virtual container.

Exam trap

The CHFI exam often tests the distinction between native NTFS metadata files (like $MFT, $Bitmap) and TSK virtual artifacts (like $OrphanFiles), so candidates mistakenly treat $OrphanFiles as a real NTFS system file rather than a forensic tool's reconstruction.

How to eliminate wrong answers

Option A is wrong because a rootkit hiding files would not manifest as a standard TSK virtual directory; rootkits typically use techniques like DKOM or hooking to conceal files, and $OrphanFiles is a normal TSK artifact for orphaned entries, not a sign of rootkit activity. Option B is wrong because the Master File Table (MFT) mirror is stored at the end of the NTFS volume (usually the last few clusters) and is not represented by a 'V/V' virtual directory in TSK; the MFT mirror is a metadata file ($MFTMirr), not a virtual directory. Option D is wrong because $OrphanFiles is not a standard NTFS metadata file; NTFS metadata files include $MFT, $LogFile, $Volume, etc., and $OrphanFiles is a TSK construct for forensic analysis, not a native NTFS file.

Full explanation →

173

MCQmedium

During an iOS forensic examination, an analyst extracts an iTunes backup and finds a file named 'SMS.db'. Which of the following tools is BEST suited to parse and analyze this SQLite database for SMS and iMessage content?

A.GrayKey

B.Oxygen Forensic Detective

C.Cellebrite UFED

D.SQLite Browser

AnswerD

SQLite Browser is a free, open-source graphical tool that opens SQLite databases directly, allowing the examiner to browse table structures, execute SQL queries, and export results. For an iOS SMS.db file, it lets the analyst immediately inspect messages, timestamps, and associated metadata by running SELECT statements across the relevant tables. This makes it ideal for targeted database examination rather than relying on extraction hardware or a full analysis suite.

Why this answer

SQLite Browser is the best tool for parsing and analyzing the 'SMS.db' file because it is a free, open-source SQLite database viewer that allows direct querying and inspection of the database schema, tables, and records. Since 'SMS.db' is a standard SQLite database containing SMS and iMessage data in iOS backups, SQLite Browser provides the most straightforward and cost-effective method for manual forensic analysis without relying on proprietary extraction tools.

Exam trap

EC-Council often tests the misconception that commercial forensic suites like Cellebrite or GrayKey are always the best tools for every forensic task, when in fact a simple, free database browser is more appropriate for analyzing a standard SQLite file after extraction.

How to eliminate wrong answers

Option A is wrong because GrayKey is a specialized hardware tool for bypassing iOS passcodes and extracting full file system images, not for parsing individual SQLite databases like 'SMS.db' after extraction. Option B is wrong because Oxygen Forensic Detective is a comprehensive forensic suite that can parse SMS.db, but it is overkill for simply analyzing a single extracted database file and is not the 'best suited' tool for this specific task due to its cost and complexity. Option C is wrong because Cellebrite UFED is primarily a physical extraction and decoding tool for mobile devices, not a dedicated SQLite database browser; while it can parse SMS data from extractions, it is not the optimal choice for directly opening and querying an already extracted 'SMS.db' file.

Full explanation →

174

MCQmedium

During a database forensic investigation, you need to review Microsoft SQL Server transaction logs to identify unauthorized data modifications. Which of the following SQL Server functions or commands is used to read the transaction log?

A.SELECT * FROM sys.dm_tran_database_transactions

B.DBCC LOG

C.fn_dblog

D.BACKUP LOG

AnswerC

fn_dblog is a table-valued function that accepts a starting and ending LSN and returns every transaction log record in that range, with columns such as Current LSN, Operation, Context, Transaction ID, Description, AllocUnitName, Page ID, and decoded row data. It allows an investigator to filter by operation type, transaction ID, or database object to reconstruct insert/update/delete activity, page allocations, and schema changes directly from the log. This makes it the standard, structured method for reviewing the actual log records during a database forensic investigation.

Why this answer

The fn_dblog function is the correct choice because it is the undocumented but widely used SQL Server function that reads the transaction log (LDF file) directly, allowing forensic examiners to view every logged operation including data modifications, schema changes, and transaction details. Unlike other DMVs or commands, fn_dblog provides a row-by-row dump of the log records, making it essential for identifying unauthorized changes at the transaction level.

Exam trap

EC-Council often tests the distinction between deprecated commands (DBCC LOG) and their modern replacements (fn_dblog), leading candidates to choose the familiar but outdated option B instead of the correct function C.

How to eliminate wrong answers

Option A is wrong because sys.dm_tran_database_transactions is a dynamic management view that shows metadata about currently active transactions (e.g., transaction ID, state, log space usage), but it does not read the actual transaction log records or provide historical log content. Option B is wrong because DBCC LOG is an undocumented command that was used in older SQL Server versions (prior to 2005) to read the transaction log, but it has been deprecated and replaced by fn_dblog; in modern SQL Server, DBCC LOG is no longer available or functional. Option D is wrong because BACKUP LOG is a command used to back up the transaction log to a file for point-in-time recovery, not to read or inspect the log contents for forensic analysis.

Full explanation →

175

MCQmedium

During a forensic investigation, the analyst runs netstat -ano on a compromised workstation. Based on the exhibit, which connection is MOST suspicious and should be investigated further?

A.The established HTTPS connection to 203.0.113.5:443 (PID 5678).

B.The DNS query to 192.168.1.1:53 in TIME_WAIT state.

C.The UDP listener on port 5353 (mDNS) with PID 910.

D.The listening RDP service on port 3389 (PID 1234).

AnswerA

An established HTTPS connection to 203.0.113.5:443 is the clearest anomaly because 203.0.113.0/24 is TEST-NET-3, a documentation-only range that real internet services never legitimately use. An outbound connection to that test address over the standard TLS port strongly suggests C2 traffic, data exfiltration, or a covert tunnel masquerading as HTTPS. PID 5678 enables triage to the responsible process, but the destination alone warrants immediate isolation and memory capture.

Why this answer

The established HTTPS connection to 203.0.113.5:443 (PID 5678) is most suspicious because it is an external IP address (not in the private RFC 1918 range) with an established TCP connection, indicating active data transfer. In a forensic context, an outbound HTTPS connection to an unknown external IP is a common indicator of command-and-control (C2) communication or data exfiltration, especially when the PID can be traced to an unknown or malicious process.

Exam trap

EC-Council often tests the misconception that any listening service (like RDP or mDNS) is inherently suspicious, when in fact established external connections to unknown IPs are far more indicative of active compromise.

How to eliminate wrong answers

Option B is wrong because a DNS query to 192.168.1.1:53 in TIME_WAIT state is normal internal network traffic; DNS queries are expected to resolve names, and TIME_WAIT indicates the connection has ended, not active malicious activity. Option C is wrong because a UDP listener on port 5353 (mDNS) with PID 910 is a standard service for local network discovery (RFC 6762) and is not inherently suspicious unless the PID is known to be malicious. Option D is wrong because the listening RDP service on port 3389 (PID 1234) is a common administrative service; while RDP can be exploited, a listening state alone does not indicate compromise without evidence of unauthorized access or unusual source IPs.

Full explanation →

176

MCQmedium

A forensic analyst is preparing to acquire an image from a suspect's hard drive. The analyst connects the drive to a write blocker, then uses FTK Imager to create a forensic image. Which hashing algorithm is commonly used by FTK Imager to verify image integrity?

A.AES

B.RSA

C.Blowfish

D.MD5

AnswerD

MD5 is a hash function commonly used by FTK Imager to verify that the image is identical to the source.

Why this answer

FTK Imager uses MD5 (Message Digest 5) as its default hashing algorithm to verify the integrity of forensic images. MD5 produces a 128-bit hash value that uniquely represents the data, allowing the analyst to confirm that the acquired image is an exact bit-for-bit copy of the original drive. While SHA-1 is also supported, MD5 is the algorithm most commonly associated with FTK Imager's verification process.

Exam trap

The trap here is that candidates confuse encryption algorithms (AES, RSA, Blowfish) with hashing algorithms, because both are used in cryptography, but only hashing algorithms like MD5 or SHA-1 are employed for integrity verification in forensic imaging tools like FTK Imager.

How to eliminate wrong answers

Option A is wrong because AES (Advanced Encryption Standard) is a symmetric encryption algorithm used to protect data confidentiality, not a hashing algorithm for integrity verification. Option B is wrong because RSA is an asymmetric cryptographic algorithm used for encryption and digital signatures, not for generating fixed-length hash values to verify image integrity. Option C is wrong because Blowfish is a symmetric block cipher designed for encryption, not a hashing algorithm; it cannot produce a digest for integrity checks.

Full explanation →

177

MCQeasy

During a forensic investigation, an analyst needs to preserve the integrity of evidence on a hard drive. Which of the following is the best practice for acquiring an image of the drive?

A.Use the 'dd' command to create a raw image without a write blocker.

B.Connect the drive to a forensic workstation and use the operating system's copy command.

C.Use a hardware write blocker and create a bit-stream image.

D.Format the drive before imaging to ensure no hidden data is missed.

AnswerC

A hardware write blocker is the definitive forensic safeguard: it sits between the drive and the workstation and physically intercepts any write command at the ATA/SATA/USB interface, allowing only read operations. Creating a bit-stream image (e.g., using 'dd' or FTK Imager) then captures a sector-by-sector, bit-identical copy of the entire drive, including partition tables, unused sectors, slack space, and deleted files, ensuring the original evidence remains pristine and admissible in court.

Why this answer

Using a hardware write blocker ensures that no write commands from the forensic workstation reach the suspect drive, preserving its integrity at the physical level. Creating a bit-stream image (sector-by-sector copy) captures all data, including slack space and unallocated clusters, which is essential for thorough forensic analysis. This combination is the gold standard in digital forensics, as mandated by best practices like those from NIST and the ACPO principles.

Exam trap

The CHFI exam often tests the misconception that a software-based approach (like dd) is sufficient for imaging, but the trap is that without a hardware write blocker, the forensic workstation's OS may inadvertently write to the suspect drive (e.g., via automount or journaling), compromising evidence integrity.

How to eliminate wrong answers

Option A is wrong because using the 'dd' command without a write blocker risks modifying the evidence drive (e.g., by the OS mounting it or writing temporary files), which breaks chain of custody and can render evidence inadmissible. Option B is wrong because the operating system's copy command (e.g., cp or copy) only copies visible files and does not capture deleted data, slack space, or file system metadata; it also does not prevent write operations to the source drive. Option D is wrong because formatting the drive destroys all existing data, including evidence, and is the antithesis of preservation; it would permanently eliminate any chance of recovering hidden or deleted information.

Full explanation →

178

MCQhard

An analyst is examining a USB drive that appears to have a smaller capacity than expected. The drive is detected as 8 GB but only 7 GB is accessible. Which of the following is the most likely cause?

A.The file system uses a cluster size that wastes space

B.The drive is formatted with FAT32 which has a 4 GB file size limit

C.The drive has a Host Protected Area (HPA) hiding 1 GB

D.The drive contains a hidden partition

AnswerC

A Host Protected Area (HPA) is a region at the end of a hard drive defined via the ATA SET MAX ADDRESS command that reduces the reported LBA count, making the disk appear smaller to the operating system. If an 8 GB drive reports only 7 GB, an HPA can hide exactly 1 GB of sectors, which remain inaccessible to the OS and typical file system tools. This precisely matches the observed discrepancy, and forensic examiners can detect it using ATA commands (e.g., hdparm -N) or specialized tools that compare the reported and actual maximum addresses.

Why this answer

The difference between detected capacity (8 GB) and accessible space (7 GB) is most likely due to a Host Protected Area (HPA). HPA uses the ATA SET MAX ADDRESS command to reduce the total capacity reported by the drive, effectively hiding 1 GB from the operating system. A hidden partition does not change the total reported capacity; it only makes a portion of the space inaccessible by not assigning a drive letter.

Therefore, only HPA directly reduces the total capacity, making option C the most likely cause.

Exam trap

The CHFI exam often tests the distinction between HPA (reduces total reported capacity) and hidden partitions (allocate space but do not change total reported capacity). Candidates may mistakenly think both apply, but the key is that only HPA causes a discrepancy in total detected capacity.

How to eliminate wrong answers

Option A is wrong because cluster size waste (slack space) reduces usable space for file storage but does not change the total accessible capacity reported by the operating system; the drive would still show as 8 GB total. Option B is wrong because FAT32's 4 GB file size limit affects individual file storage, not the total volume capacity; an 8 GB drive formatted with FAT32 can still show its full 8 GB capacity. Option D is wrong because a hidden partition would still be counted in the total capacity reported by the OS (e.g., Disk Management would show the partition as hidden but the drive's total size would remain 8 GB); the question states the drive is detected as 8 GB but only 7 GB is accessible, meaning the OS sees 8 GB total but cannot access 1 GB, which matches HPA behavior.

Full explanation →

179

MCQhard

An analyst recovers a disk image from a Linux server that used ext4. The image shows a superblock backup at multiple offsets. Which dd command would correctly extract the backup superblock located at offset 32768 bytes?

A.dd if=image.dd of=superblock.bin bs=4096 skip=8 count=1

B.dd if=image.dd of=superblock.bin bs=512 skip=64 count=2

C.dd if=image.dd of=superblock.bin bs=1024 skip=32 count=1

D.dd if=image.dd of=superblock.bin bs=32768 skip=1 count=1

AnswerB, C

Using bs=512 with skip=64 also lands at 64 * 512 = 32,768 bytes, the same superblock offset, but count=2 reads two 512-byte sectors for a total of 1,024 bytes. This approach is explicitly correct because it compensates for the smaller block size by incrementing the count, thereby extracting exactly the superblock without including adjacent sectors. It demonstrates that dd can achieve the same forensic extraction using any divisor of the superblock size, as long as the offset and byte count equal 32,768 and 1,024 respectively.

Why this answer

Both options B and C correctly extract the backup superblock from the disk image. The ext4 superblock is 1024 bytes and starts at offset 32768 bytes. With bs=512, skip=64 gives offset 32768 (64*512=32768), and count=2 reads 1024 bytes (2*512=1024).

With bs=1024, skip=32 gives offset 32768 (32*1024=32768), and count=1 reads 1024 bytes. Both commands extract exactly the superblock. Option A uses bs=4096 and count=1, reading 4096 bytes, which is too much and may include adjacent data.

Option D uses bs=32768 and count=1, reading 32768 bytes, far exceeding the superblock size.

Exam trap

Candidates may incorrectly assume that only one command is correct, or they may miscalculate skip values for different block sizes. Both B and C produce the same result; the key is to correctly compute skip and count to read exactly the superblock size (1024 bytes) at the given offset.

How to eliminate wrong answers

Option A is wrong because bs=4096 with skip=8 gives an offset of 32768 bytes (4096 × 8 = 32768), but count=1 reads only 4096 bytes, which is too large and would include data beyond the 1024-byte superblock, potentially corrupting the extracted data. Option C is wrong because bs=1024 with skip=32 gives an offset of 32768 bytes (1024 × 32 = 32768), but count=1 reads only 1024 bytes, which is correct for the superblock size; however, the skip value is incorrect because the superblock backup at offset 32768 is the first backup, but the primary superblock is at offset 1024, and the backup at 32768 is the second superblock; the skip=32 is actually correct for the offset, but the command would extract the superblock correctly; the issue is that the question asks for the backup superblock at offset 32768, and this option would work, but it is not listed as correct because the exam expects the bs=512 approach; however, the trap is that bs=1024 skip=32 count=1 is technically valid but not the intended answer because the CHFI exam often tests the standard dd syntax with bs=512 for disk images. Option D is wrong because bs=32768 with skip=1 gives an offset of 32768 bytes (32768 × 1 = 32768), but count=1 reads 32768 bytes, which is far larger than the 1024-byte superblock and would extract a huge chunk of data, not just the superblock.

Full explanation →

180

MCQhard

During an incident response, a first responder needs to collect evidence from a Linux server that is still running. The server has sensitive data and cannot be shut down. Which technique is BEST for acquiring a forensic image of the hard disk?

A.Use dd if=/dev/sda of=/mnt/evidence/image.dd conv=noerror,sync

B.Use dd if=/dev/sda of=/mnt/evidence/image.dd bs=4M

C.Use dd if=/dev/mapper/root of=/mnt/evidence/image.dd

D.Use dd if=/dev/sda1 of=/mnt/evidence/image.dd

AnswerB

Imaging the entire block device /dev/sda with bs=4M captures the complete physical disk, including the master boot record, partition tables, each partition, and unallocated space. The bs=4M argument is only a performance optimization that increases the read/write buffer size; it does not change the output data, so the result is still a bit-for-bit forensically sound copy. This is the correct first-responder action because it preserves all potential evidence on the drive.

Why this answer

It uses dd with a 4M block size, which improves acquisition speed while still producing a bit-for-bit forensic image of the entire disk (/dev/sda). The conv=noerror,sync option in A is unnecessary for a live acquisition from a healthy disk and can mask read errors, while B's larger block size is more efficient for imaging a running system without shutdown.

Exam trap

EC-Council often tests the misconception that conv=noerror,sync is always required for forensic imaging, but in a live, healthy server scenario, it can introduce artifacts and is not the best practice.

How to eliminate wrong answers

Option A is wrong because conv=noerror,sync pads bad blocks with zeros, which can hide read errors and corrupt the forensic integrity of the image; it is typically used for failing disks, not for a live, healthy server. Option C is wrong because /dev/mapper/root targets a logical volume (LVM) rather than the physical disk, missing partition tables, boot sectors, and unallocated space essential for a complete forensic image. Option D is wrong because /dev/sda1 is only the first partition, not the entire disk, so it omits other partitions, MBR/GPT, and unallocated areas.

Full explanation →

181

MCQeasy

Which cloud service log is most appropriate for tracking API calls and resource changes in an AWS environment?

A.AWS VPC Flow Logs

B.AWS Config

C.AWS CloudTrail

D.AWS CloudWatch Logs

AnswerC

CloudTrail records all API calls and resource changes for auditing.

Why this answer

AWS CloudTrail is the service that records API activity and resource changes.

Full explanation →

182

MCQmedium

Which type of evidence is a witness's statement that they saw someone log into a computer?

A.Hearsay evidence

B.Best evidence

C.Circumstantial evidence

D.Direct evidence

AnswerD

Correct. The witness directly observed the act.

Why this answer

Direct evidence is testimony or other proof that directly proves a fact without requiring any inference. A witness's statement that they saw someone log into a computer is direct evidence because it is based on the witness's firsthand observation of the act itself, not on any deduction or assumption. In digital forensics, direct evidence can include eyewitness accounts of specific actions on a system, such as entering credentials or accessing files.

Exam trap

EC-Council often tests the distinction between direct and circumstantial evidence by presenting a scenario where a witness sees a result (e.g., a screen displaying a file) and candidates mistakenly classify it as direct evidence of the action (e.g., file access) when it is actually circumstantial evidence requiring an inference.

How to eliminate wrong answers

Option A is wrong because hearsay evidence is an out-of-court statement offered to prove the truth of the matter asserted, and a witness's firsthand observation of a login is not hearsay—it is a statement based on personal knowledge, not a secondhand report. Option B is wrong because best evidence refers to the original document or recording (e.g., the actual log file) rather than a witness's testimony; the best evidence rule typically applies to writings, recordings, or photographs, not to live testimony about an observed event. Option C is wrong because circumstantial evidence requires an inference to connect it to a fact (e.g., finding a log entry at a certain time implies someone logged in), whereas the witness directly observed the login, so no inference is needed.

Full explanation →

183

MCQeasy

Which tool is specifically designed for file carving and can recover files based on headers and footers without relying on file system metadata?

A.FTK Imager

B.Foremost

C.Autopsy

D.Volatility

AnswerB

Foremost is a dedicated command-line file carver that recovers files by scanning raw disk images and matching known binary signatures for file headers, footers, and internal data structures. It was originally developed from the Air Force Office of Special Investigations' carving tool and is configured via a customizable configuration file (foremost.conf), allowing investigators to add custom signatures. Its sole purpose is to extract data based on file structure, making it the classic, focused file-carving utility rather than a general forensic suite.

Why this answer

Foremost is a file carving tool that recovers files by scanning raw data for known header and footer signatures, such as JPEG headers (0xFFD8) and footers (0xFFD9), without relying on file system metadata like MFT entries or inodes. This makes it ideal for data recovery from damaged or formatted volumes where the file system structure is unavailable.

Exam trap

The CHFI exam often tests the distinction between file carving tools (like Foremost) and forensic analysis suites (like Autopsy or FTK Imager), expecting candidates to know that carving operates at the raw data level without file system metadata.

How to eliminate wrong answers

Option A (FTK Imager) is wrong because it is primarily a forensic imaging and preview tool that acquires disk images and mounts them for analysis, not a dedicated file carver; while it can export files, it relies on file system metadata for logical file extraction. Option C (Autopsy) is wrong because it is a digital forensics platform that provides a GUI for analyzing disk images and file systems, but its file carving capabilities are limited and typically rely on external tools like Foremost or Scalpel; it is not specifically designed for header/footer-based carving. Option D (Volatility) is wrong because it is a memory forensics framework for analyzing RAM dumps (e.g., processes, network connections), not a tool for file carving from disk images.

Full explanation →

184

MCQeasy

What is the primary purpose of the Host Protected Area (HPA) on a hard disk drive?

A.To provide a write-cache for improved performance

B.To store diagnostic data or allow vendors to hide data from the OS

C.To store the partition table when using GPT

D.To store the operating system boot loader

AnswerB

The HPA is defined by the ATA/ATAPI specification as a reserved region beyond the normal maximum address reported to the host, created and modified with the SET MAX ADDRESS and DEVICE CONFIGURATION OVERLAY commands. Because operating systems enumerate only the accessible LBA range, the HPA is invisible to the OS, allowing vendors to store diagnostic firmware, crash dumps, or recovery utilities without consuming ordinary user-visible space. In forensic practice, the HPA must be checked and disabled to see the true full capacity of the drive and recover hidden data.

Why this answer

HPA is a reserved area on the disk that is not visible to the operating system, intended for vendor-specific data. It can be used to hide data from forensic acquisition.

Full explanation →

185

MCQmedium

A forensic examiner needs to create a bit-for-bit copy of a suspect's hard drive for analysis. Which tool is specifically designed for this purpose and can also verify integrity using hashing?

A.Wireshark

B.Metasploit

C.Nmap

D.dd

AnswerD

dd is the standard Unix/Linux utility for low-level data replication, and it creates a bit-for-bit image by reading every sector of the source device and writing it verbatim to an output destination. For example, `dd if=/dev/sda of=/evidence/disk.img bs=4K conv=noerror,sync` copies all blocks including slack space and deleted files, which is essential for forensic preservation. Combined with hashing tools like sha256sum, dd allows the examiner to verify the integrity of the copy, making it the correct choice for this task.

Why this answer

The `dd` command is a Unix/Linux utility that performs low-level bit-for-bit copying of storage devices, creating an exact forensic image (e.g., raw .dd or .img format). It can verify integrity by piping the output through a hashing tool like `md5sum` or `sha256sum`, or by using `dd` with `conv=noerror,sync` and later comparing hash values of the source and destination.

Exam trap

EC-Council CHFI often tests the distinction between general-purpose tools (like `dd`) and specialized forensic tools (like FTK Imager), but here the trap is that candidates may confuse network or exploitation tools (Wireshark, Metasploit, Nmap) with disk imaging utilities, assuming any 'analysis' tool can create a bit-for-bit copy.

How to eliminate wrong answers

Option A is wrong because Wireshark is a network protocol analyzer used for capturing and inspecting packets, not for creating disk images. Option B is wrong because Metasploit is a penetration testing framework for developing and executing exploit code, not a disk imaging tool. Option C is wrong because Nmap is a network scanning utility used for host discovery and port enumeration, not for bit-for-bit disk duplication.

Full explanation →

186

Multi-Selectmedium

Which TWO Windows Event IDs are associated with successful logon or explicit credential usage? (Choose TWO.)

Select 2 answers

A.4648

B.4720

C.4624

D.4625

E.7045

AnswersA, C

Event ID 4648 records a logon attempt using explicit credentials, such as when a user runs a process with `runas` or supplies alternate domain credentials for a network connection. This satisfies the stem’s constraint of “explicit credential usage” because the event logs the target account and the source process, distinguishing it from interactive logon events like 4624.

Why this answer

Event ID 4648 is logged when a user attempts to log on using explicit credentials, such as running a program as a different user or using the 'runas' command. Event ID 4624 is logged for every successful local or remote logon session, including interactive, network, and service logons. Both are standard Windows Security log events used in forensic analysis to track authentication activity.

Exam trap

The trap here is that candidates often confuse Event ID 4625 (failed logon) with 4624 (successful logon), or mistakenly associate 4720 (account creation) with logon activity, while overlooking the specific purpose of 4648 for explicit credential usage.

Full explanation →

187

MCQhard

A forensic analyst is preparing to testify as an expert witness in court. Which of the following characteristics is MOST essential for the court to accept the analyst's testimony?

A.The analyst's methods are generally accepted in the forensic community

B.The analyst has direct knowledge of the case

C.The analyst has a certification in computer forensics

D.The analyst is employed by the prosecution

AnswerA

Daubert standard requires reliable methods generally accepted.

Why this answer

The court's acceptance of expert testimony hinges on the reliability and validity of the methods used, not the analyst's personal involvement or credentials. Under the Daubert standard (or Frye standard in some jurisdictions), the key factor is whether the forensic methods have been subjected to peer review, are generally accepted within the relevant scientific community, and have a known error rate. This ensures the testimony is based on sound scientific principles, not just the analyst's qualifications or role in the case.

Exam trap

EC-Council often tests the distinction between an expert witness and a fact witness, trapping candidates who think direct knowledge or employment status is the primary criterion for expert testimony admissibility.

How to eliminate wrong answers

Option B is wrong because direct knowledge of the case is a requirement for a fact witness, not an expert witness; an expert witness can testify based on hypotheticals or analysis of evidence provided by others, and their testimony is evaluated on methodology, not firsthand involvement. Option C is wrong because while a certification (e.g., CHFI, EnCE) can bolster credibility, it is not a legal prerequisite for admissibility; the court focuses on the reliability of the methods and the analyst's demonstrated expertise, which can be established through experience, training, or education without a specific certification. Option D is wrong because employment by the prosecution does not automatically qualify an analyst as an expert; in fact, it may raise concerns about bias, and the court must independently assess the methodology's acceptance in the forensic community regardless of which party retains the analyst.

Full explanation →

188

MCQhard

During a forensic examination, an analyst uses the command 'dcfldd if=/dev/sda of=image.dd hash=sha256 hashlog=hash.txt'. What is the primary purpose of including 'hash=sha256' in this command?

A.To split the image into multiple files named with SHA-256 checksums

B.To compute a SHA-256 hash of the input drive and log it to a file for integrity verification

C.To encrypt the output image file using SHA-256

D.To compress the image using SHA-256 compression algorithm

AnswerB

dcfldd computes a SHA-256 hash of the acquired data stream in real time while performing the forensic bit-for-bit image copy, and the `hashlog=` option records that digest to a text file for later verification. This is an integrity control that proves the image matches the source drive at the moment of acquisition. Once the hash is recorded, an examiner can rerun SHA-256 on the image file and compare the outputs to ensure the exhibit has not been modified, which is a core requirement in forensic soundness.

Why this answer

The `hash=sha256` parameter in `dcfldd` instructs the tool to compute a SHA-256 hash of the input device (`/dev/sda`) during the acquisition process. This hash is then logged to the file specified by `hashlog=hash.txt`, providing a verifiable integrity check that the forensic image matches the original source. This is a standard forensic practice to ensure the image has not been altered or corrupted.

Exam trap

The trap here is that candidates confuse hashing with encryption or compression, assuming that `hash=sha256` might secure or shrink the output, when in fact it only generates a fixed-length digest for integrity verification.

How to eliminate wrong answers

Option A is wrong because `dcfldd` uses the `split=` parameter (e.g., `split=2G`) to split an image into multiple files, not the `hash=` parameter, which is solely for hash computation. Option C is wrong because SHA-256 is a cryptographic hash function, not an encryption algorithm; it produces a fixed-size digest, not ciphertext, and cannot encrypt files. Option D is wrong because SHA-256 is a hash function, not a compression algorithm; compression in `dcfldd` is not supported natively, and SHA-256 does not reduce file size.

Full explanation →

189

MCQmedium

An analyst is recovering deleted files from a FAT32 file system. The file system uses a cluster size of 4096 bytes. The first cluster of a deleted file is cluster 100. Which structure contains the chain of clusters for this file?

A.Volume boot record

B.Directory entry

C.File Allocation Table (FAT)

D.Boot sector

AnswerC

The File Allocation Table (FAT) is the core structure for recovering deleted files on a FAT32 filesystem. It contains an array of entries that map each cluster to the next cluster in a file's chain, effectively recording how clusters are linked to form files. When a file is deleted, the directory entry is flagged as deleted, but the FAT entries for the file's clusters are often not immediately cleared, leaving the chain intact and recoverable. An analyst can scan the FAT for orphaned clusters and reconstruct the original file by traversing the cluster linkage, making this option the correct choice.

Why this answer

The File Allocation Table (FAT) is the core structure that stores the chain of clusters for files in FAT32 file systems. When a file is deleted, its directory entry is marked as available, but the FAT entries for its clusters (starting at cluster 100) remain intact until overwritten, allowing recovery by following the cluster chain in the FAT.

Exam trap

EC-CHFI often tests the misconception that the directory entry stores the entire cluster chain, when in fact it only stores the starting cluster number, and the FAT holds the linked list of subsequent clusters.

How to eliminate wrong answers

Option A is wrong because the Volume Boot Record (VBR) contains metadata about the file system (e.g., cluster size, total sectors) and the boot code, but does not store cluster chains for individual files. Option B is wrong because a directory entry holds the file name, attributes, timestamps, and starting cluster number (e.g., cluster 100), but not the chain of subsequent clusters; the chain is stored in the FAT. Option D is wrong because the boot sector is synonymous with the VBR and serves the same purpose—it does not contain cluster allocation information for files.

Full explanation →

190

MCQhard

During a forensic examination of an NTFS drive, an analyst runs 'fsutil usn readjournal C:' and observes a large number of USN journal entries for a specific file after a certain date. The file's $MFT record shows a last modified timestamp far earlier than the journal entries. What does this discrepancy suggest?

A.The file's metadata was modified without changing its content, possibly using timestomping or ADS manipulation

B.The file is a system file that is excluded from USN journaling

C.The file system is corrupted and the MFT is not updating correctly

D.The file was accessed via a mounted volume shadow copy, which does not update MFT

AnswerA

A recorded USN journal entry that does not correspond to an observable MFT timestamp change indicates that metadata was altered without updating the file's content. Attackers commonly use timestomping to directly modify $STANDARD_INFORMATION or $FILE_NAME timestamps in the MFT, bypassing the normal NTFS APIs that would trigger a journaled update; alternatively, ADS manipulation can change attribute-level metadata while leaving the main file data untouched. The consistency of the journal and MFT in this case makes accidental or corrupted behavior unlikely, pointing to deliberate anti-forensic action.

Why this answer

The USN journal records all changes to files and directories on an NTFS volume, including metadata modifications. When the USN journal shows numerous entries after a date but the $MFT record's last modified timestamp is earlier, it indicates that the file's metadata (e.g., timestamps, ADS) was altered without updating the $MFT's last modified field—a classic sign of timestomping or ADS manipulation. This discrepancy arises because timestomping tools can directly modify $MFT attributes while the USN journal still logs the change event.

Exam trap

The trap here is that candidates assume the USN journal only tracks data content changes, not metadata changes, leading them to incorrectly attribute the discrepancy to corruption or shadow copies instead of recognizing it as evidence of timestomping.

How to eliminate wrong answers

Option B is wrong because system files are not excluded from USN journaling; the USN journal records changes for all files on an NTFS volume, including system files, unless specifically filtered by the analyst. Option C is wrong because file system corruption would typically cause inconsistent or missing entries across both the USN journal and $MFT, not a clean discrepancy where the journal is updated but the $MFT timestamp is not. Option D is wrong because accessing a file via a mounted volume shadow copy does not update the live $MFT record at all, but the USN journal entries in this scenario are on the live volume, not the shadow copy; shadow copies have their own separate $MFT and USN journal.

Full explanation →

191

MCQmedium

You are a first responder for a medium-sized enterprise. The Help Desk received multiple reports that users cannot access the company's internal web application (app.example.com) hosted on a Windows Server 2019 VM. The server is also running a MySQL database and an FTP service for file transfers. You remote into the server and find that the web server (IIS) is still running, but the application pool is stopped. The event logs show multiple failed logon attempts from an external IP address (198.51.100.23) for the local administrator account around the time the issues started. The FTP service log shows successful anonymous logins from the same IP minutes before the web app failure. The MySQL log shows a query 'DROP TABLE users;' executed at 03:15 AM. The current time is 04:00 AM. What immediate action should you take?

A.Capture a memory dump of the server, then disconnect the network cable, and then image the hard drive.

B.Disconnect the server from the network and then restore the database from the last clean backup.

C.Immediately shut down the server to prevent further damage and then create a forensic image of the hard drive.

D.Run a full antivirus scan, then try to restart the application pool to restore service quickly.

AnswerA

Capture a memory dump first because RAM holds the most volatile evidence—running processes, open network sockets, loaded kernel modules, and decrypted data—all of which vanish on power loss. Disconnecting the network cable immediately after memory acquisition cuts off remote attacker access and prevents further tampering with disk evidence. Finally, imaging the hard drive preserves the static data in a forensically sound, bit-for-bit copy for later analysis. The strict ordering follows the volatility hierarchy, ensuring no evidence layer is destroyed before it is captured.

Why this answer

The server is actively compromised — the attacker gained access via anonymous FTP, executed a destructive SQL query, and performed lateral movement. Capturing a memory dump preserves volatile evidence (e.g., running processes, network connections, and in-memory malware), disconnecting the network cable prevents further data exfiltration or remote control, and imaging the hard drive captures persistent evidence. This follows the CHFI first responder priority: preserve volatile data first, then isolate, then acquire non-volatile evidence.

Exam trap

EC-Council often tests the first responder's priority order — candidates mistakenly choose to shut down or restore services first, forgetting that volatile evidence (memory, network connections) is lost on power-off and that isolation must precede any remediation.

How to eliminate wrong answers

Option B is wrong because restoring the database from backup destroys volatile evidence (e.g., memory-resident malware, active network connections) and may re-infect the system if the backup is compromised; isolation must precede restoration. Option C is wrong because shutting down the server destroys volatile data (e.g., running processes, network connections, encryption keys in memory) and may trigger anti-forensic mechanisms; the correct order is memory capture before power-off. Option D is wrong because running an antivirus scan modifies the system state (e.g., file access times, quarantine actions) and may alert the attacker if they have remote access; service restoration is premature before forensic preservation.

Full explanation →

192

MCQeasy

Which Linux log file is the PRIMARY source for authentication-related events such as user logins, sudo usage, and failed authentication attempts?

A./var/log/kern.log

B./var/log/syslog

C./var/log/boot.log

D./var/log/auth.log

AnswerD

auth.log records authentication events.

Why this answer

/var/log/auth.log is the primary log file on Linux systems (especially Debian/Ubuntu) that records authentication-related events, including user logins (via sshd, login, su), sudo command executions, and failed authentication attempts. This log is generated by the authpriv facility in syslog and is specifically designed to capture security and authentication messages, making it the go-to source for forensic analysis of user access and privilege escalation.

Exam trap

In EC-CHFI, candidates often confuse /var/log/syslog with /var/log/auth.log, thinking syslog captures all system events. However, authentication events are specifically routed to a separate file (auth.log or secure) for security isolation and forensic analysis of user access.

How to eliminate wrong answers

Option A is wrong because /var/log/kern.log contains kernel messages (e.g., driver errors, hardware events) and does not log user authentication or sudo usage. Option B is wrong because /var/log/syslog captures general system messages (e.g., daemon logs, cron jobs) but not the authpriv facility by default; authentication events are typically excluded from syslog to separate security-relevant data. Option C is wrong because /var/log/boot.log records boot-time messages from the init system (e.g., systemd or SysV) and has no relation to runtime authentication events like logins or sudo.

Full explanation →

193

MCQhard

An investigator notes that a file on an NTFS volume has a resident data size of 900 bytes, but the $DATA attribute lists an allocated size of 1024 bytes. What does this indicate?

A.The file is compressed using NTFS compression

B.The file has slack space that may contain remnants of previously deleted data

C.The file's data is stored in the MFT as a resident attribute

D.The file is stored in an alternate data stream

AnswerB

File slack occurs because NTFS allocates disk space in fixed-size clusters, while a file's logical size is measured in bytes. If the final cluster is only partially used, the remaining bytes from the end of the file to the end of that cluster are not initialized by the filesystem, so they may still contain data from a previously deleted file or from an earlier, larger version of the current file. This residual data is a common forensic target because it survives normal file deletion and can be carved during analysis. The observed discrepancy between allocated size and logical size directly indicates that such slack space exists.

Why this answer

On an NTFS volume, when a file's data is stored as a resident attribute within the MFT, the $DATA attribute's allocated size is typically 0 because the data occupies space only within the MFT record itself. Here, the allocated size is 1024 bytes, which is larger than the resident data size of 900 bytes. This indicates that the file is stored non-resident (i.e., in clusters outside the MFT), and the allocated size reflects the cluster size (e.g., 1024 bytes per cluster).

The difference between the allocated size (1024 bytes) and the actual data size (900 bytes) is slack space, which may contain remnants of previously deleted data.

Exam trap

A common misconception is that a resident data size smaller than allocated size implies the file is resident in the MFT, but in reality, resident files have an allocated size of 0, and a non-zero allocated size indicates non-resident storage with potential slack space.

How to eliminate wrong answers

Option A is wrong because NTFS compression would typically result in an allocated size smaller than the uncompressed data size, not larger; compression reduces cluster usage, but here the allocated size (1024 bytes) is larger than the data size (900 bytes), which is inconsistent with compression. Option C is wrong because if the file's data were stored as a resident attribute in the MFT, the allocated size would be 0 (since no clusters are allocated), not 1024 bytes. Option D is wrong because an alternate data stream (ADS) would have its own $DATA attribute with its own allocated size; the scenario describes a single $DATA attribute with a specific allocated size, not the presence of multiple streams.

Full explanation →

194

MCQmedium

An Android device is seized as evidence. The screen is locked with a PIN. Which tool or method is MOST appropriate for acquiring a physical image of the device without bypassing the lock screen, assuming the device is rooted?

A.Boot into recovery mode and use ADB to dd the userdata partition

B.Use Cellebrite UFED with a lock screen bypass exploit

C.Remove the microSD card and image it separately

D.Perform an ADB backup to obtain app data only

AnswerA

Booting into recovery mode bypasses the Android OS and its lock screen, so ADB access does not require user authorization, screen unlock, or USB debugging approval. With a rooted device already granting elevated privileges, issuing dd against the /dev/block/.../userdata path performs a block-level physical acquisition of the entire internal userdata partition, including encrypted blobs or files, which is exactly what the question requires. This method is correct because it captures the full internal storage image without needing to unlock the screen or install any bypass, and it preserves deleted data blocks for forensic analysis.

Why this answer

Booting into recovery mode on a rooted Android device allows you to use ADB to execute the `dd` command, which can create a bit-for-bit physical image of the userdata partition without needing to bypass the lock screen. Since the device is rooted, you have the necessary privileges to read the raw block device, and recovery mode ensures the filesystem is not mounted, preventing data corruption during acquisition.

Exam trap

EC-Council often tests the distinction between physical and logical acquisition methods, and the trap here is that candidates may choose ADB backup (Option D) thinking it is a valid physical acquisition, when in fact it only captures a logical subset of data and cannot recover deleted or system-level artifacts.

How to eliminate wrong answers

Option B is wrong because Cellebrite UFED with a lock screen bypass exploit is designed to bypass the lock screen, which contradicts the question's requirement of not bypassing the lock screen; additionally, such exploits may not be available or reliable for all devices. Option C is wrong because removing the microSD card and imaging it separately only captures external storage, not the internal userdata partition where the majority of forensic evidence (e.g., app data, messages) resides, and it does not acquire a physical image of the device's internal storage. Option D is wrong because an ADB backup only extracts app data via Android's backup mechanism, which is a logical acquisition that does not capture deleted data, system files, or the full physical image of the userdata partition.

Full explanation →

195

MCQeasy

Which tool is specifically designed for performing physical extraction of iOS devices and is widely used by law enforcement for bypassing passcode restrictions on modern iPhones?

A.Cellebrite UFED

B.GrayKey

C.Magnet AXIOM

D.Oxygen Forensic Detective

AnswerB

GrayKey is a purpose-built hardware/software appliance engineered exclusively for iOS forensic physical extraction and passcode bypass. It connects to the device's Lightning port and performs automated brute-force attacks against the passcode, including techniques that leverage the device's secure enclave vulnerabilities to allow full filesystem acquisition. This focused capability, combined with high success rates on passcode-protected iPhones, is precisely why law enforcement agencies deploy GrayKey rather than general-purpose mobile tools for physical extraction.

Why this answer

GrayKey is specifically designed for physical extraction of iOS devices, leveraging advanced techniques to bypass passcode restrictions on modern iPhones, including those with Secure Enclave and full-disk encryption. It is widely adopted by law enforcement for its ability to perform brute-force attacks on the device's passcode without triggering the auto-wipe feature, making it the correct answer.

Exam trap

The CHFI exam often tests the distinction between general-purpose forensic suites (like Cellebrite UFED or Magnet AXIOM) and specialized hardware tools (like GrayKey) that are purpose-built for iOS passcode bypass, leading candidates to choose a familiar name like Cellebrite instead of the correct specialized tool.

How to eliminate wrong answers

Option A is wrong because Cellebrite UFED is a versatile forensic tool that supports both physical and logical extraction across many mobile platforms, but it is not specifically designed for iOS physical extraction and does not specialize in bypassing passcode restrictions on modern iPhones as GrayKey does. Option C is wrong because Magnet AXIOM is a comprehensive digital forensic platform for analyzing data from computers, mobile devices, and cloud sources, but it relies on third-party tools for physical extraction and does not directly perform hardware-level passcode bypass on iOS devices. Option D is wrong because Oxygen Forensic Detective is a mobile forensic tool that supports logical and file system extractions, but it lacks the specialized hardware and software capabilities for brute-forcing iOS passcodes on modern iPhones with Secure Enclave protection.

Full explanation →

196

MCQmedium

Based on the exhibit, what is the most likely indication of malware persistence?

A.services.exe PID 4321 is a known malware process

B.Windows Defender service is stopped, allowing malware to run

C.services.exe is listening on TCP port 4444, indicating possible code injection

D.svchost.exe hosting BFE and MpsSvc indicates a firewall bypass

AnswerC

services.exe is the Windows Service Control Manager and should never expose listening TCP endpoints on its own; its normal IPC is via a named pipe used by subprocesses, not a network socket. Port 4444 is a well-known default payload port for Metasploit's meterpreter and is frequently used by backdoors, so an established listening socket on services.exe is a classic sign of injected shellcode. Because services.exe runs as SYSTEM, attackers often inject code into it to steal its high privileges and evade detection.

Why this answer

Services.exe (the Service Control Manager) should not normally listen on any TCP port. When it is found listening on TCP port 4444—a port commonly associated with Metasploit and reverse shells—it strongly indicates that malware has injected code into the legitimate services.exe process, hijacking it to establish a persistent backdoor listener. This is a classic sign of process hollowing or reflective DLL injection, where the malware hides its network activity under a trusted system process.

Exam trap

EC-Council often tests the misconception that any process named 'services.exe' or 'svchost.exe' is automatically malicious, when in fact the key indicator is abnormal behavior (like listening on a non-standard port) that deviates from the process's legitimate function.

How to eliminate wrong answers

Option A is wrong because services.exe is a legitimate Windows system process (the Service Control Manager), and PID 4321 alone does not indicate malware; malware often uses process names like svchost.exe or services.exe to blend in, so the PID itself is not a known malware identifier. Option B is wrong because while a stopped Windows Defender service could allow malware to run, the exhibit shows no evidence that Defender is stopped; the question asks for the most likely indication of persistence based on the exhibit, and a stopped service is a condition, not a direct indicator of persistence. Option D is wrong because svchost.exe hosting BFE (Base Filtering Engine) and MpsSvc (Windows Firewall) is normal behavior; these services are part of the Windows Firewall and do not indicate a bypass—in fact, they are the firewall itself, and their presence in svchost.exe is expected.

Full explanation →

197

MCQeasy

Which tool is commonly used in timeline analysis for digital forensics to parse various artifacts and create a super timeline?

A.Volatility

B.Wireshark

C.Sleuth Kit

D.log2timeline / Plaso

AnswerD

log2timeline (now evolved into Plaso) is the definitive open-source tool for digital forensics timeline analysis. It recursively parses a disk image or collection of files, using numerous parsers to extract timestamps from file system metadata, operating system logs, application traces, browser history, registry keys, and many other artifact types. All parsed timestamps are normalized into a unified SQLite database, enabling the investigator to generate a 'super timeline' that correlates events across multiple sources for temporal reconstruction. This comprehensive multi-source approach is exactly what timeline analysis demands, making it the correct answer.

Why this answer

log2timeline (now part of the Plaso framework) is specifically designed to parse a wide variety of digital forensic artifacts—such as Windows Event Logs, Prefetch files, registry hives, and browser history—and aggregate them into a single, unified super timeline. This super timeline allows investigators to correlate events across different data sources and identify sequences of activity with precise timestamps, which is essential for timeline analysis in OS and network forensics.

Exam trap

EC-Council often tests the distinction between low-level filesystem tools (like Sleuth Kit) and high-level artifact parsing tools (like log2timeline/Plaso), leading candidates to mistakenly choose Sleuth Kit because they associate 'timeline analysis' with file timestamps (MAC times) rather than the comprehensive super timeline that aggregates multiple artifact types.

How to eliminate wrong answers

Option A is wrong because Volatility is a memory forensics framework used for analyzing RAM dumps (e.g., processes, network connections, registry hives in memory), not for parsing filesystem artifacts to build a super timeline. Option B is wrong because Wireshark is a network packet analyzer that captures and inspects live or recorded network traffic (e.g., TCP/IP packets), not a tool for parsing local OS artifacts or generating timelines. Option C is wrong because Sleuth Kit (TSK) provides low-level filesystem analysis tools (e.g., fls, icat, mmls) and can extract file metadata and recover deleted files, but it does not natively parse high-level application artifacts or produce a unified super timeline; that requires additional scripting or integration with tools like log2timeline.

Full explanation →

198

MCQhard

A forensic analyst is investigating a Docker container that was used to launch a network attack. The container has been stopped but not removed. Which action should the analyst take FIRST to preserve volatile evidence?

A.Restart the container and use 'docker exec' to collect evidence

B.Use 'docker inspect' to view container metadata only

C.Use 'docker save' to export the container as a tar file

D.Use 'docker commit' to create an image of the container

AnswerD

'docker commit' captures the container's current writable layer into a new image, preserving the filesystem state at a defined moment without modifying the original container's content. By default, Docker pauses the container during the commit, giving a point-in-time consistent snapshot that can be exported with 'docker save' and analyzed in a sandbox. This method is the best option listed because it preserves the container's filesystem evidence in a non-destructive way, although it does not capture live memory or active network connections.

Why this answer

Preserving the container's file system and logs is key. 'docker commit' creates an image from the container's current state. 'docker export' exports the filesystem as a tar archive. 'docker logs' retrieves logs. 'docker inspect' shows metadata. The container is stopped, so 'docker exec' won't work without starting it, which alters state. 'docker save' saves images, not containers. The best first step is to create an image or export the filesystem.

Full explanation →

199

MCQhard

An investigator acquires an SSD from a laptop that has been turned off for 24 hours. The suspect recently deleted several incriminating files. Using a forensic imager, the investigator creates a bit-for-bit copy. However, when analyzing the image, the deleted files' data appears to be zeros. What is the MOST likely cause?

A.The files were stored in the paging file, which is volatile

B.The SSD controller performed wear leveling, moving data to unallocated blocks

C.The imaging tool incorrectly interpreted the data due to encryption

D.The TRIM command was issued, causing the SSD to erase the freed blocks

AnswerD

Correct. TRIM can cause permanent loss of deleted data on SSDs.

Why this answer

The TRIM command is an ATA command that allows an operating system to inform an SSD which data blocks are no longer in use and can be wiped internally. When the suspect deleted the files, the OS likely issued a TRIM command to the SSD, causing the controller to erase the freed physical blocks. Since the laptop was off for 24 hours, the SSD had ample time to complete the garbage collection process, resulting in the deleted files' data appearing as zeros in the forensic image.

Exam trap

The EC-CHFI exam often tests the misconception that wear leveling (Option B) causes data loss, but wear leveling only relocates data to balance write cycles; it does not erase the original data—TRIM and garbage collection are the mechanisms that actively zero out freed blocks on SSDs.

How to eliminate wrong answers

Option A is wrong because the paging file (pagefile.sys) is stored on the SSD, not in volatile memory, and while it can contain remnants of data, it is not inherently volatile; the issue here is that the deleted files' data is zeros, not that it was never written to disk. Option B is wrong because wear leveling moves data to different physical blocks to extend the SSD's lifespan, but it does not erase the original data; the data would still exist in the moved location unless explicitly erased by TRIM or garbage collection. Option C is wrong because encryption would make the data appear as ciphertext, not zeros; the imaging tool would still capture the encrypted data, and the question states the data appears as zeros, not as unreadable encrypted content.

Full explanation →

200

MCQmedium

A security analyst detects a sudden spike in failed logon events with Event ID 4625 on a Windows domain controller. The source IP addresses are random and from various external subnets. Which type of attack is MOST likely occurring?

A.Pass‑the‑hash attack

B.Kerberos ticket forgery (Golden Ticket)

C.Insider threat with compromised credentials

D.Brute‑force attack

AnswerD

Each 4625 event explicitly records an authentication failure with logon type, source IP, and username, so a sudden spike from many different source addresses targeting the same accounts is the hallmark of a distributed password-guessing attack. The attacker submits candidate passwords over RDP, SMB, or VPN until one succeeds, which is exactly why the failed-logon count spikes before eventual access. The varied external IPs and volume distinguish this from credential misuse or ticket-forging attacks.

Why this answer

Event ID 4625 indicates a failed logon attempt. A sudden spike from random, external source IPs is characteristic of a brute-force attack, where an attacker systematically tries many username/password combinations against the domain controller. This pattern does not match the stealthier or more targeted nature of the other attack types.

Exam trap

EC-Council often tests the distinction between a brute-force attack (many failed logons from varied IPs) and a pass-the-hash attack (which uses a valid hash and does not generate failed logon events), leading candidates to confuse the two when they see Event ID 4625.

How to eliminate wrong answers

Option A is wrong because a pass-the-hash attack uses captured NTLM hashes to authenticate without needing the plaintext password, and it typically originates from a compromised internal host, not from random external IPs. Option B is wrong because Kerberos ticket forgery (Golden Ticket) involves forging a Kerberos TGT using the KRBTGT hash, which does not generate a spike in failed logon events (Event ID 4625) from external sources. Option C is wrong because an insider threat with compromised credentials would likely show successful logons or a targeted pattern, not a high volume of failed attempts from many random external subnets.

Full explanation →

201

MCQhard

A forensic analyst is reviewing the syslog from a compromised Linux server. Based on the exhibit, what does the 'orphan inode deleted' message indicate?

A.A hidden file was permanently removed from the filesystem.

B.A file was deleted while still open, and the filesystem has cleaned up the orphan inode.

C.A rootkit has attempted to hide files by marking them as orphan inodes.

D.A critical system file has been deleted, and the filesystem is warning the administrator.

AnswerB

When a file is unlinked but a process still holds its file descriptor, the inode remains allocated until the descriptor closes, resulting in an orphan inode. On a journaling filesystem such as ext4, that inode is recorded in the orphan list during the transaction, and after an unclean shutdown or during mount, the filesystem deletes it to reclaim space and logs 'orphan inode' messages. This is expected lifecycle behavior, not a sign of an attack or corruption.

Why this answer

The 'orphan inode deleted' message in syslog indicates that a file was deleted while it was still open by a process. The kernel's inode cleanup mechanism (part of the VFS layer) detected the orphaned inode—an inode with no directory entry but still referenced by an open file descriptor—and removed it after the last file descriptor was closed. This is standard behavior in Linux filesystems (e.g., ext4) and is not indicative of hidden files, rootkits, or critical system file alerts.

Exam trap

EC-Council often tests the misconception that 'orphan inode deleted' is a security alert or sign of malicious activity, when in fact it is a normal filesystem housekeeping message that occurs whenever a file is deleted while still open by a process.

How to eliminate wrong answers

Option A is wrong because 'orphan inode deleted' does not imply a hidden file; hidden files (dot files) are simply files with names starting with a period and are not related to orphan inodes. Option C is wrong because rootkits may hide files by manipulating directory entries or using kernel modules, but they do not mark files as orphan inodes—orphan inodes are a natural consequence of deleting an open file, not a hiding technique. Option D is wrong because the message is a routine informational log from the filesystem cleanup process, not a warning about critical system file deletion; it does not indicate administrator action is required.

Full explanation →

202

MCQeasy

Which of the following email authentication protocols uses a digital signature to verify the sender's domain and that the email has not been tampered with?

A.DMARC

B.DKIM

C.SPF

D.STARTTLS

AnswerB

DKIM (DomainKeys Identified Mail) is the protocol that adds a digital signature to email headers, specifically a DKIM-Signature header containing a base64-encoded signature. The signing domain uses its private key to sign selected header fields and the message body, while the receiving MTA retrieves the public key via a TXT record in DNS (e.g., selector._domainkey.example.com) and verifies the signature. This cryptographically ties the message to the domain and ensures the signed content was not altered in transit.

Why this answer

DKIM (DomainKeys Identified Mail) is the correct answer because it uses a digital signature (an encrypted hash) added to the email header, which is verified against a public key published in the sender's DNS TXT record. This cryptographic process confirms that the email originated from the claimed domain and that the message body and key headers have not been altered in transit, ensuring integrity and authenticity.

Exam trap

A common trap in the EC-CHFI exam is that candidates confuse STARTTLS's transport-layer encryption with message-level authentication, leading them to pick D instead of the correct digital signature protocol.

How to eliminate wrong answers

Option A (DMARC) is wrong because DMARC is a policy framework that uses SPF and DKIM results to instruct receivers on how to handle unauthenticated mail (e.g., quarantine or reject); it does not itself create or verify digital signatures. Option C (SPF) is wrong because SPF only checks the envelope sender (Return-Path) against a list of authorized IP addresses in DNS; it provides no cryptographic integrity or tamper detection. Option D (STARTTLS) is wrong because STARTTLS is a protocol command (defined in RFC 3207) that upgrades an existing plaintext SMTP connection to an encrypted TLS session; it protects the channel but does not authenticate the sender's domain or verify message integrity after delivery.

Full explanation →

203

MCQmedium

Which Azure log source should an investigator query to identify who deleted a virtual machine and when?

A.Azure Activity Log

B.Azure Active Directory sign-in logs

C.Azure Diagnostic Settings for the VM

D.Network Security Group flow logs

AnswerA

Activity Log records resource management operations (create, update, delete).

Why this answer

The Azure Activity Log (formerly known as Audit Logs) is the subscription-level log that records all control-plane operations on Azure resources, including virtual machine creation, deletion, and modification. When a VM is deleted, the Activity Log captures the operation name (e.g., 'Microsoft.Compute/virtualMachines/delete'), the caller's identity (user or service principal), the timestamp, and the status of the operation. This makes it the authoritative source for answering 'who deleted a VM and when'.

Exam trap

Candidates often confuse authentication logs (such as sign-in logs) with resource operation logs (such as activity logs). Authentication logs only show login events, not the actions performed after login. To determine who deleted a VM, you need the activity log that records control-plane operations.

How to eliminate wrong answers

Option B is wrong because Azure AD sign-in logs track authentication events (user logins, MFA challenges, token issuance) but do not record resource-level operations like VM deletion; they are identity-focused, not resource-focused. Option C is wrong because Azure Diagnostic Settings for a VM collect guest OS-level logs (e.g., event logs, performance counters, IIS logs) and are not aware of control-plane operations such as VM deletion, which occur at the Azure Resource Manager layer. Option D is wrong because Network Security Group flow logs capture IP traffic flows (source/destination IP, port, protocol) through NSGs and are used for network forensics, not for tracking who performed a resource management action like deleting a VM.

Full explanation →

204

MCQhard

A forensic analyst is examining a RAID 5 array consisting of three disks. One disk has failed and has been replaced. The array is rebuilt automatically. However, the analyst needs to recover deleted files that existed before the rebuild. What is the MOST significant challenge in this scenario?

A.File carving techniques do not work on RAID volumes

B.The rebuild process may overwrite data in slack space and previously unallocated clusters

C.The file system becomes corrupted after rebuild

D.The RAID controller encrypts data, preventing direct disk access

AnswerB

Rebuilding RAID 5 writes new parity and data, overwriting free space and slack.

Why this answer

When a RAID 5 array with a failed disk is rebuilt, the controller reconstructs data using parity information and writes it to the replacement disk. This rebuild process writes to all previously unallocated clusters and slack space across the array, potentially overwriting the very data the analyst hopes to recover. Deleted files that existed before the rebuild are at high risk of being overwritten during this automatic reconstruction, making recovery extremely difficult or impossible.

Exam trap

The trap here is that candidates may think the rebuild only affects the failed disk's data, but in reality, the rebuild process writes to all disks in the array, overwriting unallocated space and slack space across the entire volume.

How to eliminate wrong answers

Option A is wrong because file carving techniques can work on RAID volumes; they search for file signatures in raw data and are not inherently blocked by RAID structures, though they may need to account for striping. Option C is wrong because a properly executed RAID 5 rebuild does not corrupt the file system; the array remains logically consistent after reconstruction, though data in previously unallocated areas may be lost. Option D is wrong because RAID controllers do not encrypt data by default; encryption is a separate feature (e.g., self-encrypting drives or software encryption) and is not an inherent property of RAID 5.

Full explanation →

205

MCQhard

Refer to the exhibit. A database administrator finds the above error log entries when attempting to start the MySQL service. The server was working fine yesterday. What is the most likely cause of this issue?

A.The MySQL user does not have write permissions to the data directory.

B.The binary log is full and cannot be rotated.

C.The server ran out of memory due to high innodb_buffer_pool_size.

D.The InnoDB system tablespace file (ibdata1) is corrupted.

AnswerD

The InnoDB system tablespace file (ibdata1) holds the data dictionary, rollback segments, and undo tablespaces; its first page contains a header that InnoDB validates at startup. If that header or any critical internal page is corrupted, InnoDB cannot initialize its storage engine and aborts with errors such as 'Database page corruption' or 'Cannot open datafile'. This matches the administrator's exhibit, making corruption of ibdata1 the correct explanation; recovery requires restoring the tablespace from backup or rebuilding it with new setup.

Why this answer

The error log entries indicate that InnoDB is unable to open or read the system tablespace file (ibdata1), which is the core file storing the InnoDB data dictionary, undo logs, and doublewrite buffer. A corrupted ibdata1 prevents MySQL from starting because the storage engine cannot initialize its internal structures, even if the server was operational the previous day. This matches the symptom of a sudden failure without prior configuration changes.

Exam trap

EC-Council often tests the distinction between permission errors, disk-full errors, memory errors, and corruption errors, so the trap here is that candidates may confuse a 'cannot start' error with a permission issue or memory exhaustion, rather than recognizing the specific InnoDB corruption signature in the log.

How to eliminate wrong answers

Option A is wrong because if the MySQL user lacked write permissions to the data directory, the error would typically be 'Permission denied' or 'Can't create/write to file', not a corruption-related InnoDB error about ibdata1. Option B is wrong because a full binary log that cannot be rotated would cause a 'Binary log disk full' or 'Could not write to binlog' error, not an InnoDB system tablespace corruption error. Option C is wrong because running out of memory due to high innodb_buffer_pool_size would manifest as an out-of-memory (OOM) kill or allocation failure, not a specific corruption error for ibdata1.

Full explanation →

Computer Hacking Forensic Investigator CHFI (CHFI) — Questions 151–205