Computer Hacking Forensic Investigator CHFI (CHFI) — Questions 226–300

Physical acquisition is correct because it creates a bit-for-bit copy of the entire flash storage, including unallocated space, deleted files, and system partitions. This method bypasses the iOS file system abstraction, preserving the highest data integrity and capturing all recoverable data, unlike higher-level acquisitions that only retrieve accessible files.

Option A shows an established connection from the internal host (192.168.1.100) to an external IP (203.0.113.5) on TCP port 4444, which is commonly associated with Metasploit reverse shells and other C2 frameworks. The ESTABLISHED state indicates an active, ongoing session, making it the highest priority for isolation during incident response.

Large numbers of ICMP echo requests (pings) with varying payload sizes are characteristic of a ping sweep or network reconnaissance to identify live hosts.

Analysis (D) is an essential component because it is the phase where the investigator examines the acquired data to identify evidence, reconstruct events, and draw conclusions. Preservation (E) is equally essential as it ensures the integrity of digital evidence from the moment of collection through the entire investigation, typically by creating a bit-for-bit forensic image (e.g., using dd or FTK Imager) and storing it on write-protected media. Without analysis, no actionable findings emerge; without preservation, evidence is inadmissible due to tampering or spoliation.

Hashcat is the correct tool because it is a password recovery utility that leverages GPU acceleration to perform high-speed brute-force attacks on encrypted iTunes backup passwords. It can directly process the password hash extracted from the 'manifest.plist' file, which contains the backup version and encryption state, allowing efficient cracking of the backup password.

Option D is correct because repeated connections to a known malicious IP address on a non-standard port directly match the definition of a beaconing indicator of compromise (IoC). In network traffic analysis, beaconing is characterized by periodic, outbound connections to a command-and-control (C2) server, often using a non-standard port to evade detection. This pattern is a primary IoC in malware forensics and is immediately visible in Wireshark as a series of TCP SYN packets to the same IP and port at regular intervals.

When a disk imaging tool (e.g., dd, FTK Imager, EnCase) encounters an I/O error during acquisition, the most common cause is physical damage or degradation of the source media, specifically bad sectors. Bad sectors prevent the read head from reliably retrieving data, triggering an I/O error at the operating system or device driver level. This is distinct from logical errors like file system corruption, which typically produce different error messages.

Timestomping is confirmed because the Modified timestamp (which tracks file content changes) is earlier than the Creation timestamp, which is logically impossible under normal file system operations—this indicates an attacker deliberately set the Modified timestamp backward to evade timeline analysis. The XOR encryption of the DLL is a form of obfuscation, a technique used to hide the true content of the file from static analysis tools and signature-based detection. Together, these two actions represent the anti-forensic techniques of timestomping and obfuscation.

Unified logging (os_log) is the modern macOS logging system, storing events in a binary format and queried via the 'log' command.

Option C is correct because the chain of custody documentation must record the date, time, and identity of each individual who handles the evidence to ensure a complete, unbroken record of custody. This allows the court to verify that evidence was not tampered with or altered between collection and presentation. Without these timestamps and names, the chain of custody is legally insufficient.

TRIM command allows the SSD to erase data blocks immediately after deletion, making recovery impossible as data is physically erased.

Cron jobs are a common Linux persistence mechanism. Entries in /etc/cron.d/ are system-wide cron jobs that execute at scheduled intervals.

Option D is correct because PACE requires that during a search under warrant, only items specified in the warrant may be seized, and a receipt must be provided to the occupier. This ensures legal compliance, chain of custody, and respect for property rights, which are fundamental to admissible digital evidence.

NTUSER.DAT is the user-specific registry hive loaded under HKCU, containing ShellBags, UserAssist, MostRecentlyUsed (MRU) lists, and other user activity artifacts. SAM stores local account hashes, SYSTEM stores system-wide config, and SOFTWARE stores installed applications info.

Reliability, under rules of evidence such as Federal Rule of Evidence 403, requires that the probative value of evidence is not substantially outweighed by the danger of unfair prejudice, confusing the issues, or misleading the jury. In computer forensics, this means the evidence must be sufficiently trustworthy and accurate to prove a fact without creating a misleading impression. For example, a log file with inconsistent timestamps or incomplete data would fail the reliability test because it could mislead the trier of fact.

This log entry records a SELECT ... INTO OUTFILE statement that exports the customers table to a CSV file. This is a common technique for data exfiltration, as it writes data to a file that can be accessed by the attacker.

Time drift between the system and the SIEM causes logs to be timestamped incorrectly, leading to apparent gaps when the SIEM queries by time range. Even if logs are delivered, they may fall outside the incident timeframe in the SIEM's index, creating the illusion of missing data. This is a common issue in cloud-based SIEMs where NTP synchronization is not enforced across all sources.

NTUSER.DAT is the registry hive that contains user-specific settings, including MRU lists and application preferences.

Data jurisdiction refers to the legal and regulatory issues that arise when data is stored or processed across different geographic locations with varying laws.

In Linux, an inode number of 0 typically indicates a file that has been deleted but is still open by a process. The directory entry may be removed but the inode remains until the file is closed.

Option A is correct because photographing the entire scene, including the computer screen and connections, preserves a visual record of the state of the evidence before any changes are made. This documentation is critical for establishing the chain of custody and proving that the evidence was not tampered with. It also captures the exact configuration of cables and peripherals, which can be vital for later analysis.

The chain of custody documentation must record the date and time of each evidence transfer to establish a clear chronological timeline of custody. This ensures that the evidence can be tracked from collection through analysis to presentation in court, preventing claims of tampering or mishandling.

A is correct because in a live system with active network connections, the most volatile evidence is in RAM (e.g., running processes, network connections, encryption keys). Using a memory acquisition tool (like FTK Imager or WinPmem) captures this volatile data before any other action, preserving evidence that would be lost on shutdown or disconnection. This aligns with the order of volatility (RFC 3227), which prioritizes memory over disk.

The log shows an unauthorized user launched an EC2 instance. The immediate action is to isolate the instance by stopping it or applying a security group to block traffic, preventing further malicious activity while preserving the instance for forensic analysis.

ShellBags store folder view settings and paths, while LNK files are shortcuts that record the target file path and timestamps. Both can indicate accessed locations.

This is the standard three-way handshake (SYN, SYN-ACK, ACK) followed by data (HTTP GET), indicating a successful TCP connection establishment.

Creating a scheduled task is a common persistence technique because it allows malware to execute at predefined times or system events, such as user logon or system startup. The Windows Task Scheduler can run arbitrary executables with SYSTEM privileges, making it a reliable method for maintaining access even after a reboot.

ADS can be detected by using tools that list streams (like streams.exe or dir /r), checking the $MFT for $DATA attributes with a non-empty name, or scanning for known malicious ADS names with forensic tools.

C is correct because Advanced Logical Extraction (ALE) on Cellebrite UFED leverages a combination of file system parsing, agent-based extraction, and exploit techniques to retrieve the device passcode, call logs, SMS messages, and application data from a locked iOS device without requiring a full physical dump. This method bypasses the logical extraction limitations by using a custom agent or AFC (Apple File Conduit) to access protected data, making it the most likely method for the described successful extraction.

extundelete is a utility that can recover deleted files on ext3/4 by parsing the journal and inode information. It works best if the inode is still intact.

First responders should not power off the system (to preserve volatile data) and should photograph the scene to document the state.

Option A is correct because WhatsApp stores media files (images, videos, voice notes) in the external app-specific directory `/data/media/0/Android/data/com.whatsapp/`. Even after a message is deleted from the chat, the media file may remain in this directory if it was not explicitly removed, allowing recovery. Option C is correct because the primary SQLite database `msgstore.db` in `/data/data/com.whatsapp/databases/` contains the chat messages, including deleted entries that are often only marked as deleted but not physically removed until a vacuum operation.

The primary reason for using a hardware write blocker is to physically intercept the SATA/IDE bus between the suspect drive and the forensic workstation, ensuring that only read commands (e.g., ATA READ DMA) are passed through while blocking any write commands (e.g., ATA WRITE DMA). This prevents the operating system from mounting the drive as writable, which would otherwise cause automatic writes (e.g., timestamp updates, journaling, or prefetch creation) that alter evidence and break the chain of custody.

The /data/data/ directory on Android contains application private data, which is protected by Linux user permissions (UID/GID) and SELinux policies. USB debugging must be enabled (Option A) to allow the forensic workstation to communicate with the device via ADB (Android Debug Bridge) for command execution. The device must be rooted (Option B) because the /data/data/ directory is owned by the system and individual app UIDs, and only a root user (UID 0) can bypass these permissions to read all application data.

Multi-tenancy complicates data isolation, and data jurisdiction affects legal access to data across regions.

The EDRM includes Information Governance, Identification, Preservation, Collection, Processing, Review, Analysis, and Production. Key steps include Preservation, Collection, and Production.

Option A is correct because the first step in any forensic investigation is to correlate the suspicious activity with known events, such as authorized tasks or vulnerabilities, to avoid false positives. Root access from an unfamiliar IP could be legitimate if tied to a scheduled maintenance window or a known vulnerability exploitation attempt that requires verification. Prematurely changing credentials or contacting law enforcement could destroy evidence or alert an attacker before the scope is understood.

Plaso automates the extraction and correlation of timestamps from multiple artifacts (registry, event logs, file system, etc.) into a unified timeline, saving time and reducing errors compared to manual extraction.

Wireshark is the correct tool because it captures and analyzes network packets at the protocol level, allowing the analyst to inspect the HTTP request to 'http://malicious.com/update', including headers, payload, and any subsequent data exfiltration. Dynamic analysis of malware requires monitoring network traffic to identify command-and-control (C2) communications, and Wireshark provides full packet capture (PCAP) for this purpose.

First responders must secure the scene, document everything, preserve evidence, and avoid altering the system state. Photographing the scene and using a write blocker to image are correct; collecting volatile memory is a specialized task, not a first responder's primary duty, and powering off without capturing RAM is generally avoided.

A known malicious IP address is a classic indicator of compromise (IoC) because it directly identifies a command-and-control (C2) server or a source of malicious traffic. Network monitoring tools can match outbound or inbound connections against threat intelligence feeds of known bad IPs, triggering an alert. This is a network-based IoC that requires no host-level analysis, making it ideal for initial detection.

The 'conv=noerror,sync' option tells dd to continue reading even when it encounters read errors (noerror) and to pad the output with zeros (sync) to maintain the correct offset alignment, ensuring the image remains a bit-for-bit copy of the source drive despite bad sectors. This is critical in forensic imaging to preserve the integrity of the data stream and avoid truncation or corruption of the output file.

PPID 4 is the System process (PID 4) in Windows. Legitimate processes should not have System as parent; this suggests process hollowing or injection. The examiner should investigate the process further with process dump and memory analysis.

Option C is correct because obtaining the backup password from the device owner through a legal process is a standard and valid method to access encrypted iOS backups. The backup password is required to decrypt the backup data, and if the owner provides it voluntarily or through a court order, the forensic analyst can legally access the encrypted backup contents.

A write blocker ensures that no data is written to the original evidence drive during acquisition, maintaining its integrity.

Cloud forensics faces challenges such as data jurisdiction (legal boundaries), volatile evidence (ephemeral resources), and multi-tenancy (data commingling).

The presence of a '.tls' section in a PE file, combined with imports from kernel32.dll and ntdll.dll, indicates the use of Thread Local Storage (TLS) callbacks. These callbacks execute before the entry point, allowing the malware to decrypt the main code at runtime before the main executable logic runs. This is a classic TLS callback-based decryption technique, not a form of code injection or packing.

/var/log/auth.log records authentication attempts, and /var/log/syslog records general system messages. Both are valuable in forensic investigations.

A port scan sends SYN packets to various ports; if no SYN-ACK is received, the ports are likely filtered or closed, characteristic of a scan.

Locard's principle states that every contact leaves a trace. In digital forensics, this translates to the concept that digital devices leave traces of their activities and interactions, such as logs, metadata, and artifacts.

Plaso (log2timeline) is a timeline creation tool that aggregates data from various forensic artifacts into a super timeline.

Option B is correct because performing strings analysis on a packed binary can reveal embedded strings, such as import hints, configuration data, or the original entry point (OEP), which may survive packing. While packing obfuscates many strings, some packers leave remnants that static analysis tools like `strings` can extract, providing initial clues about the malware's functionality without execution.

These logs record different categories of events.

In ext4, the journal is stored in a special inode (inode 8) or as a file named .journal. It can also be stored in a separate block group.

A file with .aspx extension that executes commands is a webshell, allowing remote command execution on the server.

The $Recycle.bin contains $I (info) and $R (data) files. The $I file stores metadata including original filename, path, and deletion timestamp.

B is correct because wear leveling is a fundamental SSD technology that spreads write operations evenly across all memory blocks to prevent premature wear. This process scatters file fragments across different physical locations, making it significantly harder to recover specific files using traditional forensic methods that rely on contiguous data storage.

Option A is correct because a dedicated forensic workstation that is not connected to any network prevents the malware from communicating with command-and-control (C2) servers, exfiltrating data, or spreading to other systems. This isolation ensures the integrity of the analysis environment and protects the broader infrastructure from accidental infection or data leakage.

The file '3d0d7e5fb2ce288813306e4d4636395e047a3d28' is the SQLite database (NotesStore.sqlite) that stores Apple's Notes app data in an iOS backup. Its SHA-1 hash name corresponds to the domain 'AppDomain-com.apple.mobilenotes' and contains the notes, attachments, and metadata. This is a well-known artifact in iOS forensics for recovering user-created notes.

GrayKey is correct because it is a dedicated forensic tool that leverages the checkm8 bootrom exploit (CVE-2019-15971) to perform physical extraction on iOS devices. The checkm8 exploit is unpatchable in hardware, allowing GrayKey to bypass the device's security enclave and extract a full file system image, including encrypted data, from iPhones up to the iPhone X.

Option A is correct because isolating the host from the network immediately stops the ongoing C2 communication to 192.168.1.100 on TCP port 4444, which is a common port for reverse shells (e.g., Metasploit). This containment prevents further data exfiltration, lateral movement, or command execution by the attacker, and is a critical first step in dynamic analysis to preserve the integrity of the investigation.

TRIM command causes SSDs to erase deleted blocks immediately, and wear leveling spreads data across cells to extend lifespan, both complicating data recovery.

The SYSTEM hive stores system-wide configuration data, and the key 'CurrentControlSet\Control\Windows\' contains the 'ShutdownTime' value, which records the last system shutdown time. Since the last boot time is effectively the time after the last shutdown, querying this value provides the necessary information. This is a standard forensic artifact for determining system uptime and boot events on Windows 10.

A SYN flood sends many SYN packets without completing the handshake, overwhelming the target. The source IPs may be spoofed.

Event ID 4624 logs successful logons, 4625 logs failed logons, and 4648 logs logon attempts using explicit credentials (e.g., RunAs). These are key for tracking authentication events.

The 'Received' header is added by each SMTP server that handles the email, and the last 'Received' header (or the first after the client) contains the originating IP.

Aid4Mail is a professional email forensic tool that can parse PST files and extract all components including metadata, attachments, and headers.

Prefetch files store execution information for applications, and Jump Lists track recent files opened by applications, indicating usage.

Option A is correct because when an Android device is locked with a PIN and no PIN is known, a logical extraction via ADB backup is the safest first step. ADB backup (adb backup) can capture app data and system settings without requiring root or unlocking the bootloader, and it does not modify the device state, preserving evidence integrity. This method works if USB debugging was previously enabled, which is common in forensic acquisitions, and it avoids the risk of triggering lockout or data wiping that physical methods might cause.

The DKIM-Signature domain (d=legitbank.com) should match the sender domain. However, the Received header shows the email originated from mail.attacker.com, not legitbank.com's mail servers. Additionally, analyzing the DKIM signature might fail if it doesn't match, but the mismatch in origin is a clear spoofing indicator.

Option A is correct because computer forensics is fundamentally the application of investigative and analytical techniques to collect, preserve, and analyze digital evidence in a manner that maintains its integrity and admissibility in a court of law. This definition encompasses the entire forensic process, from acquisition through chain of custody to presentation, aligning with the CHFI framework's emphasis on legal and procedural rigor.

IDA Pro is a leading interactive disassembler and debugger used for static analysis of malware binaries. It allows analysts to examine executable code without executing it, by disassembling machine code into assembly language and providing cross-references, function graphs, and decompilation capabilities. This makes it essential for reverse engineering malicious software to understand its logic, embedded strings, and control flow.