Computer Hacking Forensic Investigator CHFI (CHFI) — Questions 376–450

Computer forensics aims to preserve evidence in its most original form, identify the root cause of an incident, and document the investigation for legal proceedings.

The Received header chain shows the path the email took. The last Received header (from the originating server) is the most reliable for identifying the original sender's IP.

The SMS database on Android devices is stored by the telephony provider, which manages SMS/MMS messages. On non-rooted devices, the database is located at /data/data/com.android.providers.telephony/databases/mmssms.db, as the package com.android.providers.telephony is the system application responsible for handling SMS and MMS operations.

LaunchDaemons are used for system-wide daemons that start at boot. A plist in /Library/LaunchDaemons/ with ProgramArguments indicates a launch daemon persistence mechanism.

ADS allows hiding data in streams attached to files, and slack space can hide data in unused bytes at the end of file clusters.

The first step is to investigate the server to determine if it's compromised, as outbound connections could indicate C2 communication.

Prefetch files contain metadata including last run time and run count. Tools like PECmd (from Eric Zimmerman's tools) are designed to parse .pf files forensically.

FastBloc (Option B) is a hardware write blocker produced by Guidance Software that operates at the physical layer, intercepting ATA/ATAPI commands to prevent any write operations from reaching the suspect drive. It ensures bit-for-bit forensic acquisition without altering the source data, which is essential for maintaining evidentiary integrity.

Locard's exchange principle is the foundational forensic concept stating that whenever two objects come into contact, there is a transfer of material between them. In computer forensics, this means that digital activity—such as accessing a file, sending a packet, or connecting to a network—inevitably leaves traces in logs, memory, registry entries, or file metadata. This principle underpins the entire discipline of digital evidence recovery.

Webshells are malicious scripts uploaded to a web server. Indicators include anomalous file modifications in web directories, unexpected processes from web server user accounts, and outbound connections from the web server to unknown IPs. CPU spikes can occur but are less specific.

The Run key under HKLM\Software\Microsoft\Windows\CurrentVersion\Run is a common location for programs to execute at startup. Similar keys exist in HKCU.

The network C2 IP address is direct and actionable for blocklisting. Registry keys and mutex names can be used for detection but are less definitive for network defense.

The USBSTOR registry key under HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR contains subkeys for each USB device, with properties like serial number and first install date.

Option A is correct because the `hashwindow=10M` parameter in dcfldd instructs the tool to compute a SHA-256 hash for every 10 MB segment (window) of the input data as it is being copied, and then log each segment's hash to the specified hashlog file. This allows the investigator to verify the integrity of individual chunks of the forensic image, which is useful for detecting corruption or tampering in specific regions of the image without rehashing the entire file.

USB device history is stored in USBSTOR and MountPoints2 keys.

These techniques recover files without filesystem metadata.

Securing the scene and documenting everything is the first priority to preserve evidence and ensure chain of custody. Powering off or accessing the system without proper documentation can lead to evidence spoliation.

Multi-tenancy (multiple customers sharing the same physical infrastructure) is a key challenge in cloud forensics because isolating evidence and maintaining data privacy across tenants is difficult.

DumpIt is a lightweight memory acquisition tool designed specifically for capturing the contents of volatile memory (RAM) on a running Windows system. It minimizes interaction with the system to avoid altering the memory state, making it ideal for forensic collection of live evidence.

FAT32 stores directory entries that are marked as deleted but still contain file metadata; carving based on remnants of directory entries is effective.

Azure Activity Logs record all control-plane events (create, update, delete) for Azure resources, including user actions.

File slack, volume slack, and RAM slack are types of slack space. HPA and DCO are hidden areas, not slack space.

LiME (Linux Memory Extractor) is a kernel module that allows acquisition of volatile memory from Linux systems. It loads into the kernel and dumps RAM to a file or over the network.

Port 4444 is commonly associated with reverse shells (e.g., Metasploit default). A web server making outbound connections to an external server on port 4444 strongly suggests a reverse shell from the web server to a command-and-control (C2) server.

Option B is correct because Post-Incident Activity is one of the four core phases in the NIST SP 800-61 incident response lifecycle. This phase includes lessons learned, evidence retention, and report generation to improve future response efforts. Without this step, the organization cannot close the loop on security incidents or refine their detection and response capabilities.

Packing or obfuscating the malicious code (Option B) is a classic anti-forensic technique used to hinder static analysis. Packers compress or encrypt the original PE file's code and data, making it unreadable to disassemblers and signature-based scanners until the unpacking stub executes at runtime. This forces the analyst to perform dynamic analysis or manual unpacking, significantly increasing the time and complexity of the investigation.

In iOS forensics, call history records are stored in the SQLite database file named 'call_history.db' (or 'CallHistory.storedata' in newer iOS versions). This database contains tables such as 'call' and 'ZCALLRECORD' that log incoming, outgoing, and missed calls along with timestamps and durations. Examining this file directly from an iTunes backup or device extraction provides the examiner with the complete call log.

TRIM is a command that allows the operating system to inform the SSD which data blocks are no longer in use. When TRIM is enabled, the SSD internally erases those blocks, making file carving ineffective for deleted files.

A track is a circular division of data on a platter, and each track is divided into sectors. The number of sectors per track is a characteristic of the track itself.

A litigation hold is a legal directive to prevent spoliation of evidence by suspending normal data retention and deletion policies.

The primary goal of computer forensics is to preserve and analyze digital evidence in a manner that is legally admissible in court.

The USBSTOR key under HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR contains a list of all USB storage devices that have been connected, including their serial numbers.

The 'noerror' option tells dd to continue reading after errors, and 'sync' pads the bad sectors with zeros to maintain the correct size.

Option D is correct because static analysis involves examining the malware's code (e.g., disassembly, string extraction, hash analysis) without executing it, while dynamic analysis runs the malware in a controlled sandbox environment to observe its runtime behavior, such as file system changes, registry modifications, and network connections. This fundamental distinction is critical in malware forensics to safely understand the threat without risking infection.

AccessDenied indicates the user lacks permissions; check IAM policies to see if the user should have access or if it's an unauthorized attempt.

The listener.log is the correct source because Oracle's listener records all client connections and SQL*Net traffic, including the raw SQL statements sent to the database. When SQL injection is performed, the injected payload is transmitted as part of the SQL query over the network, and the listener log captures these exact statements, providing direct evidence of the attack.

StegExpose, StegDetect, or tools like `stegsolve` can detect steganography. Among the options, `stegdetect` is a known tool for detecting steganography in JPEG images.

Azure Activity Log captures all write operations (PUT, POST, DELETE) on Azure resources, including role assignments, making it the primary source for investigating privilege escalation.

SPF check passed for the domain example.com, meaning the sending server (203.0.113.5) is authorized. This suggests the email is not spoofed from that domain, at least from SPF perspective.

AWS CloudTrail logs all API calls, including the source IP address of the request. By analyzing CloudTrail events for the RunInstances API, the analyst can see the IP address.

The Run key is a standard location for programs to auto-start when a user logs on. A malicious entry here indicates persistence via registry run keys.

The primary purpose of maintaining a chain of custody is to create a documented, unbroken record of every person who handled the evidence, from the moment it is collected until it is presented in court. This documentation is critical to establish the authenticity and integrity of the evidence, ensuring it has not been tampered with or altered, which is a foundational requirement for admissibility under legal standards like the Federal Rules of Evidence (FRE) 901. Without a proper chain of custody, the evidence can be challenged as inadmissible due to lack of trustworthiness.

EmailTrackerPro is specifically designed to analyze email headers and trace the path of an email.

Event ID 4624 indicates successful logon; 4648 indicates a logon using explicit credentials (also successful).

Option B is correct because physical acquisition via ADB with an appropriate exploit allows the examiner to obtain a complete bit-for-bit copy of the device's flash memory, including deleted data and unallocated space, without physically modifying the device. Since Android 12 has USB debugging enabled, ADB can be used to push an exploit that bypasses security restrictions to perform a physical dump, which is the most comprehensive method available for this scenario.

This privilege escalation allows the service account to impersonate other accounts and potentially access resources across projects.

The Frye standard requires that scientific evidence be based on principles and methods that are generally accepted by the relevant scientific community.

The Host Protected Area (HPA) is an area on the hard drive that is not accessible through standard ATA commands. It can be used to hide data.

In Windows, only the Idle process (PID 0) and System process (PID 4) typically have PPID 0. A user-mode process like svchost.exe with PPID 0 suggests the process list has been tampered with, often by rootkit techniques such as DKOM.

Factory reset on Android typically wipes user data partitions (e.g., /data) but does not securely overwrite the entire flash storage. Google account authentication tokens (e.g., OAuth 2.0 tokens) and cached account data (e.g., account names, sync settings) are often stored in system-level databases or encrypted key stores that may persist in unallocated or residual flash blocks, especially if TRIM or secure erase was not executed. These artefacts can be recovered via forensic imaging and carving of the raw NAND or eMMC.

Chain of custody is a documented record that tracks the seizure, custody, control, transfer, analysis, and disposition of evidence, ensuring its integrity and admissibility.

The process 'svch0st.exe' writes to the registry key 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run', which is a classic Run key used for automatic program execution at user logon. This is the most common malware persistence mechanism, as any executable referenced there will start each time the user logs in. The creation of a mutex named 'Global\Mutex_1234' is a common anti-reinfection technique to ensure only one instance of the malware runs, but the persistence is established via the Run key.

The mutex named 'Global\MyMalwareMutex' is a named synchronization object used by the malware to ensure only one instance of its process runs at a time. This prevents conflicts in operations like file writing or network communication that could occur if multiple copies executed simultaneously. In Cuckoo Sandbox, detecting such a mutex is a common indicator of single-instance malware behavior.

These are standard port numbers assigned by IANA.

Files deleted using Shift+Delete bypass the Recycle Bin and are directly marked for deletion. Additionally, files deleted from command line or external drives may not go to Recycle Bin.

USB device history is stored in the SYSTEM registry hive under USBSTOR, which records device class, serial number, and timestamps.

Option B is correct because disconnecting the network cable immediately stops the active C2 communication, preventing further data exfiltration and command injection while preserving the current state of memory and disk. This action maintains the integrity of volatile evidence (e.g., network connections, running processes) and avoids the data loss that would occur with a shutdown or the evidence contamination that would result from running a scan.

File slack is the space between the end of the logical file and the end of the last cluster allocated to it.

Event ID 4648 records when explicit credentials are used to logon, typically for RunAs or scheduled tasks. Logon type 3 indicates network logon. This means admin used backupadmin credentials to access FS01.

debugfs is a tool for ext2/3/4 filesystem debugging. The `lsdel` command lists inodes of deleted files that still have allocated blocks, enabling recovery.

The first priority is to preserve volatile data (e.g., memory, running processes) which may be lost if the system is powered off. Photographing the scene and documenting are important but come after securing volatile data.

Foremost and Scalpel are dedicated file carving tools that recover files based on headers/footers. fdisk is a partition tool, Autopsy is a forensic suite that can use carving but is not primarily a carver, and LiME is for memory acquisition.

These methods differ in scope and when they are performed.

Prefetch files contain the number of times the application was run, last run time, and a list of files loaded during execution. They do not store network connections or user-specific data.

RAID 5 uses parity distributed across disks. Given two data disks, the third can be reconstructed by XORing the parity with the remaining data. However, the investigator must know the stripe size and parity layout.

The cron job runs every 5 minutes as root, downloading and executing a script from a remote server. This is a typical persistence mechanism for a backdoor or command‑and‑control.

Option A is correct because chain of custody documentation must record every individual who handled the evidence, along with their signature and the date/time of transfer, to establish an unbroken custody trail. This ensures the evidence's integrity and admissibility in court by demonstrating who had access at each stage.

The chain of custody document is the foundational record that ensures evidence integrity and admissibility in court. Its primary purpose is to create a chronological, unbroken log of every person who handled the evidence, the exact time and date of each transfer, and the reason for the transfer. This directly supports the legal requirement to prove that the evidence has not been tampered with or altered from the moment of seizure to its presentation in court.

SAM stores user account hashes, NTUSER.DAT contains user-specific settings, SYSTEM stores system configuration, SOFTWARE stores installed software info.

macOS unified logging provides detailed system activity including application launches. FSEvents records file system changes but not process launches. .plist files may store settings, not execution history.

Cron jobs are a common persistence mechanism on Linux. Attackers often use frequent cron jobs to maintain access.

The DKIM-Signature header contains a cryptographic signature that allows the receiver to verify that the email was not modified and is from the claimed domain, helping prevent spoofing.