Computer Hacking Forensic Investigator CHFI (CHFI) — Questions 151–225

Option B is correct because it prioritizes capturing volatile data (RAM and network connections) first, which would be lost on shutdown, then creates a logical image of the unlocked BitLocker SSD while the server remains online to minimize downtime. This approach preserves the integrity of volatile evidence and allows critical business applications to continue running, aligning with the IT manager's request to minimize downtime.

DKIM failure indicates the email may be forged or tampered with. Checking the domain's DKIM DNS record and examining the email headers for other spoofing indicators are appropriate steps.

The 'psxview' plugin in Volatility compares process lists from various sources to detect hidden processes.

Web shells often contain obfuscated code, are placed in web-accessible directories, and may be accessed via unusual HTTP methods like POST with encoded payloads.

Event ID 7045 logs the installation of a new service, including service name, image path, and start type. Malware often creates services to achieve persistence.

NTUSER.DAT is the registry hive that contains user-specific settings and is loaded into HKEY_CURRENT_USER upon logon. It includes UserAssist, MRU lists, and other user activity artifacts.

Option A is correct because the first priority at a live crime scene is to preserve the integrity of the scene and all potential evidence. Standard forensic procedure (e.g., from NIST SP 800-86 and ACPO guidelines) mandates that the first responder must photograph the scene to document the state of the computer (including screen contents, cables, and peripherals) and secure the area to prevent unauthorized access or tampering. Only after this documentation and scene stabilization can the responder proceed to handle the live system, such as capturing volatile data or creating a forensic image.

Option C is correct because the first step in a forensically sound investigation is to create a forensic copy (bit-for-bit) of the EBS snapshot before any analysis. This preserves the original evidence integrity, as required by the order of volatility and chain of custody. Attaching the copy to a separate analysis EC2 instance in a different AWS account prevents accidental modification of the original snapshot and isolates the forensic environment from the compromised production account.

Sending SYN packets to many ports without receiving SYN-ACKs indicates a port scan, likely a TCP SYN scan, to discover open ports.

Firewall logs record allowed and denied traffic, including source/destination IP and port, ideal for tracking outbound connections.

The Received header is added by each SMTP server that relays the message, showing the IP of the previous hop. The last entry often contains the original sender's IP.

The primary purpose of maintaining an unbroken chain of custody is to establish the integrity and authenticity of digital evidence by documenting every person who handled it, every transfer, and every access event. This documentation allows the court to verify that the evidence has not been altered, tampered with, or corrupted from the moment of seizure through analysis and presentation. Without a provable chain of custody, the evidence may be deemed inadmissible under rules like Federal Rule of Evidence 901 or similar standards in other jurisdictions.

Autopsy is an open-source digital forensics platform that runs on Windows, Linux, and macOS. It provides timeline analysis, keyword search, and file system browsing.

LNK files can be used for persistence or lateral movement. A shortcut to a remote script could indicate the system is configured to run a malicious script from another machine, potentially for propagation.

The log shows acceptance of a public key. To determine if the key was unauthorized, you must examine the authorized_keys file for root (~/.ssh/authorized_keys) to see if the key was added maliciously.

Option D is correct because the AWS CLI `sync` command with the `--checksum-mode` flag automatically computes and compares checksums (e.g., SHA256) during the transfer, ensuring data integrity without manual intervention. This method also preserves metadata and timestamps, which is critical for maintaining a forensically sound copy and chain of custody in cloud forensics.

The bottommost 'Received' header contains the IP of the first receiving server, which is often the sender's MTA or the client IP. 'X-Originating-IP' is a non-standard header that may contain the original client IP if included by the outbound server.

In dynamic analysis with Cuckoo Sandbox, DNS queries to a domain that resolves to a known malicious IP are a classic indicator of C2 communication because the malware must resolve its command server's address before establishing a channel. Similarly, HTTP POST requests to a very recently registered domain (e.g., 2 days old) are suspicious, as attackers often use fresh domains to evade reputation-based blocklists, and POST is commonly used to exfiltrate data or receive commands.

Option A is correct because static analysis of a PE file involves examining the file without executing it. Embedded strings, such as IP addresses, can be extracted using tools like `strings` or `binwalk` and serve as IoCs indicating command-and-control servers or other network destinations. These strings are stored in the PE file's data sections and are directly observable in the binary.

D is correct because `pg_waldump` is the PostgreSQL utility specifically designed to parse Write-Ahead Log (WAL) files and display their contents in a human-readable format, including the exact timestamps and operation types (e.g., DELETE). Since the database uses WAL archiving, the archived WAL segments will contain a record of every data modification, allowing the analyst to pinpoint when the deletions occurred.

B is correct because `call_history.db` is a SQLite database on iOS devices that stores call logs, including incoming, outgoing, and missed calls with timestamps and durations. Forensic examiners analyze this database to reconstruct communication patterns and timelines during investigations.

Creating a custom RBAC role with high permissions (like Owner) and assigning it to a user can grant elevated privileges. Adding a user to a privileged role (like Global Administrator) directly escalates privileges.

The `message` table in SMS.db stores the actual message content (the `text` field) along with critical metadata such as `date` (Unix timestamp), `is_from_me` (sender/recipient indicator), and `handle_id` (foreign key to the `handle` table). This is the primary table for message body and timestamp data in iOS SMS/MMS forensics.

Aid4Mail and EmailTracker are specialized for email forensics.

The `docker history` command displays the history of a Docker image, showing each layer and the command that created it. This includes the build commands from the Dockerfile, allowing an investigator to see how the container was constructed and what instructions were executed during the build process.

Spoofed emails often fail SPF checks, have no DKIM signature (or a failed one), and may contain mismatched headers like From vs. Return-Path.

The USBSTOR key records all USB storage devices with timestamps. Enum/USB contains device descriptors but not timestamps. SetupAPI logs are in a different location.

Forensic imaging involves selecting source, configuring destination, and verifying integrity with hash.

Container logs, image layers, and host system logs are key sources in Docker forensics.

Writing to the 'Run' registry key (HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run) is a classic persistence mechanism: any executable listed there is automatically launched at user logon. Creating a file named 'svchost.exe' in a public directory is a masquerading attempt to blend in with the legitimate svchost.exe (which resides in System32), but the registry write is the definitive indicator of persistence via an auto-start entry.

In APFS, files and directories are represented by inodes. The inode contains basic metadata. Extended attributes are stored separately in B-tree structures.

Option D is correct because volatile data (e.g., RAM contents, running processes, network connections) is lost when power is removed. The first responder must collect this data before any shutdown or hardware removal, following the order of volatility (RFC 3227). This preserves critical evidence that cannot be recovered later.

/proc/[pid]/exe is a symbolic link to the executable of a running process. The entry indicates a process with PID 12345 is running from a hidden file in /tmp, strongly suggesting malware execution.

A valid POST request with no cookies and a suspicious User-Agent could indicate a webshell attempting to exfiltrate data or execute commands, as the User-Agent is atypical for a browser.

Webshells are indicated by anomalous script files being accessed, POST requests to script files, and high request rates to a single script. These patterns suggest remote access and command execution.

Alternate Data Streams (ADS) allow hiding data within a file's stream. Slack space (file slack) can hide data in unused bytes between the end of file and end of cluster. Both are native NTFS features.

In FAT file systems, a deleted file's directory entry has the first byte of the filename set to 0xE5. The clusters in the FAT may still be allocated or marked as free.

The chain of custody is a documented chronological record that tracks the seizure, custody, control, transfer, analysis, and disposition of digital evidence. Its primary goal is to maintain the integrity and admissibility of evidence by proving that the evidence has not been tampered with or altered from the moment it was collected until it is presented in court. This is critical because any break in the chain can lead to evidence being deemed inadmissible under rules like the Federal Rules of Evidence (FRE) or the Daubert standard.

The log entry shows a SQL injection payload (the UNION SELECT statement) in the query parameter. This is a classic SQL injection attempt.

The presence of an authorized key from an unknown IP suggests an attacker added their public key. Checking ~/.ssh/authorized_keys on the affected account will reveal any unauthorized keys.

Writing to HKCU\Software\Microsoft\Windows\CurrentVersion\Run is a classic persistence mechanism because Windows automatically launches programs listed in this registry key at user logon. Process Monitor capturing a write to this key directly indicates the malware is configuring itself to run on startup, which is the strongest evidence of persistence among the options.

Option A is correct because testing the write blocker on a non-evidence drive verifies that the device is functioning correctly and will not inadvertently allow writes to the suspect drive. This step ensures the integrity of the forensic acquisition by confirming the write blocker's hardware-level protection is operational before it is connected to evidence.

HPA is a region of the disk that is normally hidden from the operating system. Tools like hdparm (Linux) or MBRTool can be used to detect and modify HPA settings. FTK and EnCase can also detect HPA when imaging at the device level.

Event ID 4625 indicates a failed logon attempt. Multiple failures from different IPs in a short period is characteristic of a brute-force password guessing attack.

B is correct because data_ark.db is not a standard iOS SQLite database; it does not exist in typical iOS backups or file systems. The name suggests a fabricated or non-standard artefact, making it least likely to contain forensically relevant communication data. In contrast, databases like SMS.db and call_history.db are well-documented repositories for SMS messages and call logs, respectively.

Host Protected Area (HPA) is a region on ATA drives that can be hidden from the OS by using the SET MAX ADDRESS command. It is commonly used for hiding data.

In Windows Vista and later, the Recycle Bin uses $Recycle.Bin folder with each user having a subfolder named by SID. The file 'Info2' or '$I<filename>' files contain metadata such as original path and deletion time.

DNS exfiltration often uses high query volumes, unusual domain names, and large TXT records.

On FAT32, when a file is deleted, the directory entry is marked as deleted (first byte set to 0xE5) and the FAT clusters are freed. If the clusters have been reallocated and overwritten, carving fails.

Unified logging captures detailed system and user activity logs, and .plist files store application preferences and usage data. Both are valuable for reconstructing user actions.

Received headers show the path and each server's IP, while X-Originating-IP may contain the sender's IP. DKIM verifies integrity but not origin IP. Message-ID is just an identifier.

Unusual files in web directories, high CPU usage due to command execution, and unexpected outbound traffic are common signs of a webshell compromise. Log entries with 'cmd' parameter are also typical.

DNS tunneling often uses small DNS queries/responses to exfiltrate data or establish C2. The consistent small packet size and many external destinations are indicators.

The Run key is a common auto-start location used for persistence. Writing to it ensures the process executes at user logon.

The log shows a failed SSH login attempt for root from an external IP. The most effective immediate action is to change the SSH configuration to disable root login and key-based authentication only (PasswordAuthentication no), then restart the service. This blocks password guessing attacks on root.

Biometric access control is the most critical first step because it establishes a foundational layer of physical security that authenticates and authorizes personnel before they can access the lab. Without controlling who enters, other measures like CCTV or fire suppression are less effective, as unauthorized individuals could compromise evidence integrity. This aligns with the principle of defense-in-depth, where access control is the primary barrier against tampering or theft.

Creating a mutex with a hardcoded name is a common anti-analysis technique used by malware to ensure only one instance runs, preventing multiple infections or sandbox detection. In Cuckoo Sandbox, a hardcoded mutex name (e.g., 'Global\MyMalwareMutex') can indicate a known malware family or a custom implementation, warranting further investigation as it often correlates with persistence or evasion logic.

MySQL's general query log records all SQL queries, including SELECT statements. The binary log records changes (INSERT, UPDATE, DELETE) for replication and recovery, not SELECT queries. Audit logs may be enabled but are not as detailed for SELECT queries by default.

The URI contains ../ patterns attempting to access a system file outside the web root, which is path traversal.

Azure Activity Logs record all control-plane events (e.g., create/delete resources) at the subscription level, including who performed the action.

Cellebrite UFED (Universal Forensic Extraction Device) is a widely used forensic tool that leverages Android Debug Bridge (ADB) to perform logical acquisition of Android devices. ADB allows the tool to communicate with the device's operating system via USB debugging, enabling extraction of call logs, contacts, SMS, and application data without physical chip-off. This makes it the correct choice for logical acquisition over ADB.

The 'message' table with columns 'ROWID', 'text', 'handle_id', and 'date' is the core schema of the SMS.db database on iOS devices. This database stores iMessage and SMS/MMS messages, where 'handle_id' links to the 'handle' table for contact identifiers and 'date' stores the timestamp in Apple's absolute time (seconds since 2001-01-01). The presence of these specific columns confirms it is the SMS/Message database.

Option A is correct because the 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' key is a well-known autostart location that executes the specified program each time the user logs into their account. This is a common persistence mechanism used by malware to re-launch after a reboot, as Windows Explorer reads this key during the user logon process.

If HISTSIZE is set to 0 or the history file is a symlink to /dev/null, commands are not recorded. This is common in forensic evasion.

log2timeline (and its successor Plaso) is the standard tool for timeline analysis, parsing artifacts into a super timeline.

The 'log show' command with --predicate queries the Apple Unified Logging system, which centralizes logs from various subsystems.

Option B is correct because an iTunes backup of an iOS device includes the SQLite database file SMS.db, which stores all text messages (iMessages and SMS). This file is located in the backup's AppDomain group for com.apple.mobileSMS and can be extracted and parsed to recover message content, timestamps, and sender/receiver information.

Option C is correct because the first priority at a live incident scene is to preserve volatile evidence. Photographing the screen captures the current state of the system, including open applications, network connections, and user activity, which can be lost if the system is altered or powered down. This documentation provides a baseline for the investigation and ensures that critical volatile data is recorded before any forensic acquisition begins.

Creating a timeline of network events (Option B) is essential in network forensic investigation because it establishes a sequence of activities, correlating packet captures, logs, and system events to reconstruct the attack path. This chronological mapping is critical for identifying the initial compromise point, lateral movement, and data exfiltration, often using tools like Wireshark or tcpdump with timestamps from NTP-synchronized sources.

Registry analysis requires acquiring hives, running RegRipper with profiles, and correlating results.

The pstree plugin shows processes in tree format with parent-child relationships, while pslist lists processes without parent info. For parent PIDs and command lines, pstree is appropriate.

Alternate Data Streams can be used to hide malicious executables within seemingly innocuous files. The stream 'hidden.exe' suggests an executable is hidden in the file.

The hash mismatch indicates that the data on the original drive and the image file are not identical. A write blocker malfunction that allowed writes to the original drive during the imaging process would alter the source data after the initial hash was computed, causing the final hash of the original drive to differ from the hash of the image file taken at a different point in time. This is the most direct cause of a hash mismatch because the write blocker's primary purpose is to prevent any modification to the evidence.