Computer Hacking Forensic Investigator CHFI (CHFI) — Questions 376–450

TRIM commands cause the SSD to erase blocks, preventing recovery.

Physical extraction using a JTAG or chip-off technique is the most comprehensive acquisition method because it reads the raw flash memory chips directly, bypassing the Android operating system and its file system driver. JTAG (Joint Test Action Group) connects to the device's test access port to command the CPU to dump the flash contents, while chip-off involves physically desoldering the NAND/eMMC chip and reading it with a dedicated programmer; both yield a complete bit-for-bit image of the entire flash memory, including deleted files, unallocated space, hidden partitions, and data remnants that software-based methods cannot access. This approach is particularly valuable when the device is damaged, locked, or otherwise unresponsive, though it is invasive, may require breaking the device, and demands deep knowledge of the specific chip datasheet and interface protocols.

Password spraying is a low-and-slow attack in which an adversary chooses a handful of common passwords and tries them individually across many user accounts from a single source IP. In Windows Security logs this manifests as multiple Event ID 4625 failed-logon events with different account names but the same source workstation/IP and a common failure code such as 0xC000006D, often within a short window. Because each account is hit only once or twice, the total event volume stays low, evading threshold-based brute-force detection while still matching the observed pattern of many usernames from the same source.

The general query log is the correct choice because it captures every SQL statement received from clients, including SELECT queries, regardless of whether they modify data or exceed performance thresholds. In a MySQL compromise, attackers often use SELECT statements to exfiltrate sensitive data, and this log provides a complete chronological record of those reads. Unlike the binary or slow query logs, it does not filter by data-change events or execution time, making it the only reliable artifact for detecting and reconstructing data theft via query activity.

Firewall logs are a cornerstone of network forensics because they contain timestamped records of each connection attempt, including source and destination IP addresses, ports, protocol, and the action taken (allow, deny, or drop). These logs enable investigators to reconstruct attack paths, spot port scans, and identify successful or blocked outbound communications. They provide metadata about network transactions, even though they do not capture payloads.

Searching for files with recent creation or modification timestamps in the web root is a practical initial triage because webshells are usually uploaded shortly before they are used, and the upload leaves a fresh file on disk. In particular, script files such as .php, .jsp, or .aspx that appear in web-accessible directories with timestamps matching the time of a suspected breach are strong candidates for further manual review. While attackers can alter timestamps to hide their tracks, this technique is still appropriate and often the first step in a forensic hunt for malicious web content.

The $LogFile records transactional metadata changes, letting you reconstruct directory entries and cluster allocations before deletion, which supports recovering deleted files on NTFS. It satisfies the Windows 10 NTFS constraint directly, unlike FAT-based artifacts. Paired with $MFT, it exposes the pre-deletion state needed for forensic reconstruction.

This is a classic Living-off-the-Land (LOLBin) technique: rundll32.exe, a signed Windows binary, can be abused to execute JavaScript via its exported functions, allowing malware to run under a legitimate process name. The .lnk file acts as a persistence mechanism, typically placed in the Startup folder or run key, and launches the JavaScript payload at logon to download and execute additional malware. This matches MITRE ATT&CK T1218.011, using a trusted binary to evade detection and achieve persistence.

Event ID 4625 records failed logon attempts, and repeated occurrences against one account from a single remote IP within a short window indicate an attacker systematically guessing credentials. This satisfies the stem's brute-force pattern, distinguishing it from isolated mistyped passwords or lockout events (4740), which Microsoft Entra ID or local policy would log separately.

Alternate Data Streams (ADS) is an NTFS feature that allows a single file to contain multiple data streams, so additional data can be attached to a file without altering its primary content or visibly increasing its size. An attacker can hide data by writing to a stream such as 'legit.exe:hidden.exe', and this data is not shown in standard directory listings or Explorer's size calculations. This makes ADS the classic NTFS data-hiding technique, and forensic examiners must explicitly enumerate streams to detect such hidden payloads.

The URL and domain are classic network-based IoCs because they represent communication channels between the infected host and the attacker's command-and-control (C2) infrastructure. In Cuckoo's analysis, these are extracted from captured DNS queries, HTTP requests, or IRC/HTTPS sessions, making them directly associated with network traffic rather than host state or file content.

Locard's exchange principle, originally formulated for physical crime scenes, states that every contact, however slight, leaves a trace, and in digital forensics this means an attacker's activities will invariably generate residual data on the compromised system, such as log entries, altered timestamps, prefetch files, or memory remnants. This transferred principle underlies the entire discipline of digital evidence identification because it gives examiners a theoretical basis for expecting to find attacker artifacts even when the intruder attempts to clean up. It is the only option that directly names the exchange principle rather than a forensic procedure, legal rule, or collection ordering strategy.

HTTP file transfers are visible in the packet payload because HTTP is an unencrypted application-layer protocol. During a network forensic investigation, an analyst can reconstruct the entire file by reassembling TCP segments and extracting the HTTP message body (e.g., using Wireshark's 'Follow TCP Stream' or NetworkMiner). As long as the capture contains complete traffic, the transferred file's content is directly recoverable from the PCAP data, making this the correct answer.

NetFlow analysis is a network forensic technique that parses flow records—aggregated summaries of communication sessions containing source/destination IP addresses, ports, protocol, timestamps, and byte counts—exported by routers or switches. These records allow investigators to reconstruct traffic patterns and detect anomalies (e.g., exfiltration, beaconing) without inspecting packet payloads. Its strength lies in scalability and historical visibility, making it the correct technique for analyzing flow.

Event ID 7045 indicates that a new service was installed on the Windows system. When an attacker exploits a web shell, they often escalate privileges or establish persistence by installing a malicious service that executes a payload at system startup. Therefore, a 7045 event appearing alongside web shell traffic is a strong indicator of post-exploitation activity, making it the most relevant option.

This is a classic ASP.NET webshell: it reads a command from the HTTP query string (often "cmd"), starts cmd.exe through Process.Start, and returns the command output in the HTTP response. This gives a remote attacker an unauthenticated command shell on the web server, making it a direct indicator of compromise. During a forensic investigation, such code should be preserved as malicious evidence and traced back to the upload or exploitation vector.

Email spoofing is the forgery of email header fields, typically the From/Reply-To address, to make a message appear to originate from a trusted source while it actually came from an unrelated or attacker-controlled server. Here, the originating Received server and HELO/EHLO identity do not align with the claimed From domain, which is exactly the signature of a spoofed message. SMTP lacks built-in sender authentication, so unlike a MITM that alters traffic in transit, this anomaly is the result of direct manipulation of the message headers during composition.

Each mail server that processes the email prepends its own Received header, creating a chronological chain from the origin to the destination. The bottommost Received header, added first, typically reveals the originating IP address of the sender's mail server or client, which is why it is the primary evidence for tracing. While the last Received header is added by the receiving server, the chain can be partially forged if the sending server is malicious, so analysts corroborate the first Received header with server logs.

The USBSTOR subkey in HKLM\SYSTEM\CurrentControlSet\Enum is populated when Windows enumerates a USB mass-storage device, such as a flash drive, external HDD, or card reader. It creates a subkey named like Disk&Ven_<vid>&Prod_<pid>&Rev_<rev>, and the key's LastWrite time can be used as forensic timeline evidence of the device's most recent connection to the system. This is why this key points directly to a USB storage device.

LiME is a loadable kernel module built specifically for Linux memory acquisition, capturing RAM to a file or over the network with minimal footprint. Generic imaging tools copy disk, not volatile memory, so they cannot satisfy this requirement.

Physical acquisition via JTAG or chip-off is the gold standard for mobile forensic imaging because it accesses the raw NAND/eMMC storage controller directly, independent of the device's operating system. JTAG exploits the Joint Test Action Group debug port to force the CPU to dump memory, while chip-off removes the memory chip and reads it with a programmer; both produce a complete bit-for-bit forensic image, including deleted data, unallocated clusters, and partially overwritten file remnants that would be unavailable through any logical method. This approach preserves the entire chip's contents and allows advanced data recovery, though it requires skill, may destroy the device during chip removal, and must be performed with proper anti-static and bitstream-level hashing procedures.

To be admissible, digital evidence must be authenticated — the proponent must show it is what it claims to be — and its integrity must be verifiable through a demonstrable chain of custody and cryptographic hash values. Courts require these to ensure the evidence has not been altered or corrupted from the time of acquisition to presentation, as a failure to prove authenticity or integrity undermines its reliability and relevance.

adb shell dd if=/dev/block/mmcblk0 of=/sdcard/physical.img invokes the dd utility on the device to read the raw block device /dev/block/mmcblk0, which typically represents the entire internal storage or eMMC chip. This creates a bit-for-bit physical image that includes all data, including deleted files and unallocated sectors, making it ideal for forensic analysis; in practice, you would often redirect output via adb exec-out to a host rather than write to /sdcard to avoid altering evidence.

This is correct. Every GPT partition is assigned a Globally Unique Identifier (GUID) that serves as the partition's unique identity, in addition to a separate GUID for the partition type. These GUIDs are randomly generated and statistically unique, enabling robust identification that does not rely on disk order or numbering. The GPT header itself also has a GUID for the disk, making the entire layout disklabel-oriented rather than sector-offset-oriented.

In digital forensics, Locard's exchange principle translates to the fact that any user or system action modifies the state of the device: opening a file updates access timestamps, running a program creates process artifacts, and network activity generates logs. These traces can reside in filesystem metadata, application history, event logs, unallocated space, or even slack space. Anti-forensic tools themselves leave traces—such as installation footprints, modified timestamps, or leftover logs—so a determined actor cannot act without leaving some recoverable evidence.

In ext4 (and other Unix-like file systems), file names are not stored in the inode. Instead, directory entries map names to inode numbers. When a file is deleted, the directory entry is removed, but the inode may retain metadata until it is reused. Thus, debugfs lsdel can list deleted inodes but cannot recover original file names from the inode alone. This is why file names are missing from the output.

ListObjects is the S3 API call that returns a list of object keys, sizes, and metadata for a bucket, optionally filtered by a prefix or delimiter, and in CloudTrail it is recorded as eventName 'ListObjects' (or 'ListObjectsV2' for the paginated version). This operation enables an actor to enumerate bucket contents without knowing specific keys in advance, which is exactly what a forensic investigator would look for to establish reconnaissance or unauthorized enumeration. As the correct answer, ListObjects indicates that someone accessed the bucket's inventory, unlike Get, Put, and Delete operations that target a single known object.

When you delete a file, its data blocks are merely marked as available, leaving the underlying bytes on the physical disk. The cipher /w command systematically overwrites these free-space regions with a sequence of patterns (e.g., 0x00, 0xFF, and random data) to ensure that remnants of deleted files are no longer recoverable through forensic tools. This process directly impedes recovery by destroying the residual data that would otherwise remain on the drive, which is why this is the correct description of the command's purpose.

The inode is a per-file data structure containing all metadata for a file or directory, including mode/permissions, owner and group, size, access/modification/change timestamps, link count, and pointers to data blocks (direct, indirect, or extents). In ext4, the inode number, together with a generation counter, uniquely identifies a file, and directory entries map names to inode numbers. When a file is deleted, the inode may be cleared but often remains recoverable until the inode is reused, making it the central artifact for reconstructing file metadata and content.

The presence of ../ (dot-dot-slash) sequences is a classic indicator of directory traversal, where an attacker manipulates file paths to escape the web root and access arbitrary files. In this IIS log entry, the request appears to target a system executable such as cmd.exe outside the website's home directory. Even though the response is 404, the attack pattern—traversing upward with ../ and requesting a sensitive Windows binary—clearly identifies a path traversal attempt rather than another vulnerability class.

The request in the Apache log uses multiple '../' sequences to traverse upward from the web root directory, aiming to access sensitive files such as ../../../../etc/passwd. This is a textbook directory traversal (path traversal) attack, categorized as CWE-22, where the application fails to validate or sanitize file path inputs. The repeated '..' segments allow the attacker to escape the intended document root and read files elsewhere on the filesystem, like password hashes or configuration secrets. Because the log shows a direct path traversal payload rather than code execution or URL inclusion, Path Traversal is the correct answer.

RAID 5 requires all member disks to have identical usable capacity, and the controller maps data across disks based on that fixed geometry. If the replacement disk is physically or logically smaller than the original, the controller cannot reconstruct the missing disk's full block range, causing rebuild I/O errors that may corrupt the logical drive or abort the rebuild entirely. This is a classic cause of apparent data corruption after a disk replacement, because the array's own metadata and data layout become inconsistent with the replacement disk's reduced sector count.

A TCP SYN scan, also known as a stealth scan or half-open scan, works by sending an SYN packet to a port and observing the response: if SYN-ACK is received, the port is open, and the scanner immediately sends an RST to tear down the connection. This avoids completing the three-way handshake, so the target service never sees a full connection and may not write it to application logs. The captured sequence — SYN, SYN-ACK, RST — exactly matches this behavior. This is why it is correctly identified as a TCP SYN scan, as the RST after SYN-ACK is the signature of an active port-scanning tool like Nmap.

Timestomping is an anti-forensic technique that deliberately alters a file's timestamps—such as creation, modification, and access times—typically on NTFS by modifying $STANDARD_INFORMATION or $FILE_NAME attributes. Attackers use it to make malicious files appear old, legitimate, or to match expected system activity, thereby evading investigative timelines. Detection often relies on inconsistencies between MFT attributes, USN journal entries, or comparing timestamps against volume shadow copies and prefetch data.

Cloud Audit Logs are the correct source because they provide a comprehensive, immutable log of administrative and authentication activities across Google Cloud, including the identity of the caller, the action performed, the resource affected, and the timestamp. Admin Activity logs are enabled by default, and when data access is enabled, they capture read/write operations as well, making them the definitive auditable trail for forensic reconstruction of who did what, where, and when.

When a file is deleted in ext4, the inode is unlinked and its block pointers are cleared from the directory structure, but the physical blocks themselves are only marked as free in the block bitmap. They remain intact until a subsequent file allocation reuses those same blocks and overwrites them with new data. Once this happens, the original file content is irrecoverably lost unless remnants survive in unallocated slack space. Thus, overwriting by new files is the definitive event that destroys deleted file data.

In a FAT32 file system, each cluster is represented by a 32-bit entry in the File Allocation Table, and the value 0x0FFFFFFF (along with 0x0FFFFFF8–0x0FFFFFFF) marks the last cluster of a file's cluster chain. This end-of-cluster-chain marker tells the operating system that no further clusters follow, so the file's data ends at that cluster. It is not a byte offset or a physical sector location, but a logical FAT entry indicating chain termination.

A hardware write-blocker prevents the workstation from writing to the suspect drive, preserving the original media during imaging. This is a core lab practice to avoid evidence contamination and to ensure the source hash matches the image. Without it, the workstation could modify file system metadata and invalidate the acquisition.

Get-CimInstance Win32_Process retrieves process information including the CommandLine property, which shows the full command used to start each process. Selecting Name, ProcessId, and CommandLine provides a clear, concise list. This is essential for identifying malicious processes with suspicious arguments. It is a reliable method on Windows 10 with PowerShell v5.1.

The Sleuth Kit's mactime tool parses the body file format produced by fls and other TSK tools to generate chronological timelines from disk images. It specifically correlates MACB times (modification, access, change, birth) for filesystem objects, enabling investigators to reconstruct file activity across a timeline. As a focused command-line utility within a broader forensic toolkit, mactime is a primary and canonical tool for timeline analysis, which is why this option is correct.

Run keys under HKCU and HKLM execute specified programs at user logon or system start, giving malware automatic re-execution across reboots. This satisfies the persistence requirement by surviving restarts without further user action, unlike one-off execution or volatile artefacts.

A web shell is a malicious script placed on a web server that accepts commands via HTTP parameters—often using names like 'cmd'—to execute system processes, upload/download files, or create reverse shells. It provides persistent remote command execution and is the precise classification for a file that appears to be a command execution handler on an infected web server. This matches the forensic finding exactly.

Imaging each physical drive individually with a write blocker is the correct forensic method because it guarantees that no write operations reach the source disks, allowing a true bit-for-bit copy of every member, including unallocated space, deleted metadata, and RAID configuration data. With complete images of all drives, the array can be reconstructed offline in a controlled environment using tools like mdadm or specialist RAID recovery software, preserving the original order and stripe parameters. This maintains chain of custody and enables repeatable analysis without modifying evidence.

A factory reset in Android formats the userdata partition by deleting its ext4 or f2fs metadata and marking blocks as free, but it does not necessarily overwrite the underlying sectors on the flash storage. Forensic examiners can therefore carve files from unallocated space using techniques like file signature carving, and if the device's encryption was disabled or the cryptographic keys can be derived/reset, data like photos and contacts may be reconstructed. This is precisely why the examiner should focus on residual user data in unallocated space after a reset.

This payload is a textbook SQL injection tautology: placing 1' OR '1'='1 inside a WHERE clause, such as WHERE user='admin' AND pass='1' OR '1'='1', makes the entire predicate evaluate to true, allowing authentication bypass or full table extraction. In an Apache access log, the malicious string can appear as part of the request URI or, less commonly, in the request body when access logging includes POST data. The single quote breaks out of the SQL string literal, and the OR condition forces a true result for every row, which is the definitive indicator of SQL injection testing or exploitation. Any defense should focus on parameterized queries, not input filtering alone, because the payload is syntactically valid SQL.

The `docker logs` command is the canonical method for retrieving the console output of a container, as it reads the stdout and stderr streams that were captured by the container runtime. By default, these streams are stored in a JSON-file log on the host under `/var/lib/docker/containers/<container-id>/<container-id>-json.log`, and `docker logs` presents them in a human-readable format. It also supports flags like `--since`, `--tail`, and `--follow` to filter or stream the logs, making it a direct and efficient way to collect a container's standard output without needing to access its filesystem.

This is the correct action because RAM is the most volatile data store and must be captured first per the forensics order of volatility (RFC 3227). A trusted memory acquisition tool — such as FTK Imager, WinPmem, or LiME — creates a bit-for-bit copy of physical memory, which is hashed (e.g., SHA-256) to preserve integrity. After the memory image is securely stored on external media, an administrator-issued shutdown writes only unavoidable OS logs and closes services in a controlled manner, preserving the disk while the critical volatile evidence is already secured.

The diagnostics directory is the on-disk repository for unified logging, introduced in macOS Sierra, where entries are stored in compressed binary tracev3 files. These files capture detailed event-level data with nanosecond timestamps, message metadata, and privacy-scoped redaction, making them a rich source for forensic timelines. Investigators typically query this store with the 'log' command, not with text editors.

The general query log is the only MySQL log that records the complete text of every SQL statement as received from clients, including plain SELECT queries used for data exfiltration. When enabled (general_log=ON), each client connection and statement is written to a file or table, giving an investigator a direct timeline of query activity, timestamps, and the exact data being read. It is the definitive source for detecting and reconstructing unauthorized data retrieval.

The 'http' filter is correct because it selects every packet in which Wireshark's HTTP dissector successfully identifies HTTP protocol data, encompassing requests, responses, status lines, headers, and bodies. Unlike port-based filters, it is application-layer aware and verifies the presence of HTTP semantics, not just a well-known port number. This makes it the precise, protocol-specific filter an SOC analyst should use to capture the complete picture of HTTP traffic on the wire.

The bottommost Received header is chronologically the first hop recorded, inserted by the sender's first SMTP server or mail user agent at the time of submission. It is the deepest part of the routing chain and provides the closest traceable IP/HELO information to the true origin, making it the best evidence for identifying the actual source. Analysts rely on this header because subsequent servers append above it without altering its content in normal operation.

UPX -d is the correct command-line invocation because the -d flag tells the UPX utility to decompress (unpack) an executable that was previously packed with UPX. This restores the original program code and data so a malware analyst can statically inspect the actual malicious logic rather than the small decompression stub. It is the most direct, automated method available in the standard toolset for this exact purpose.

The file is a webshell because it accepts attacker-supplied input through HTTP parameters and passes it directly to a function such as system(), exec(), shell_exec(), or eval(). This provides unauthenticated remote command execution on the web server, allowing an attacker to run arbitrary commands, read sensitive files, or pivot to the internal network. The presence of obfuscated code, a small file size, and a recently modified timestamp in a writable web directory strongly corroborates this conclusion.

The `noerror` flag instructs `dd` to continue copying when it encounters read errors, while the `sync` flag pads each failed read block with zeros so that the output image retains the same block size and overall length as the source. This prevents the process from aborting and produces a complete, though partially zero-filled, image for analysis. Without these flags, `dd` would terminate on the first read error and leave an incomplete image.

A computer may be lawfully seized under the Fourth Amendment based on (1) a warrant issued by a judge upon probable cause and particularly describing the things to be seized; (2) voluntary and intelligent consent given by the owner or a person with apparent authority, which can be limited in scope; or (3) exigent circumstances, such as imminent destruction of evidence or a threat to safety, that justify immediate action before obtaining a warrant. These are well-established exceptions routinely applied in digital forensics, allowing officers to secure a device while awaiting a warrant or to accept a user's consent to search and seize it. Therefore, this option correctly enumerates the primary situations in which computer seizure is lawful.

Most Recently Used (MRU) lists in the registry are exactly the artifact designed for tracking recently opened files. For example, HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU stores PIDLs of files selected through common dialog boxes, while application-specific keys like HKCU\Software\Microsoft\Notepad and HKCU\Software\Microsoft\WordPad record the last file paths opened by those applications. These registry values are maintained by the operating system and applications specifically to store this historical MRU data, making them the canonical answer.

Photographing the scene and the computer screen is the first and most critical step because it creates a permanent, objective record of the system's exact state before any interaction occurs. The display may contain incriminating messages, open files, or system logs that are purely volatile and would be lost if the computer is touched, rebooted, or powered down. This documentation, including cable connections and visible media, solidifies the chain of custody and provides the contextual integrity that later forensic analysis depends on, which is why it takes precedence over any hardware or software intervention.

Collecting RAM with FTK Imager or dd is correct because memory holds volatile, ephemeral data—encryption keys, plaintext credentials, running processes, injected code, and evidence of malware that never touches disk. FTK Imager can create a forensic memory dump while dd, if used with a memory-specific driver, also works; both must be executed carefully to avoid altering the state they are capturing. This action preserves the single most fragile category of evidence before it disappears the moment the system loses power or reboots.

Wireshark is the correct tool because it is a network protocol analyzer that captures live packets and decodes hundreds of protocols, allowing you to inspect individual frames, follow TCP streams, and filter traffic by IP, port, or protocol. In a malware investigation, it reveals command-and-control activity, malicious payloads, and data exfiltration patterns associated with the suspicious process's network communications.

The contents of RAM and active network connections are the most volatile evidence on a live system. RAM loses all data the instant power is cut, wiping out running processes, open network sockets, and any decrypted data or encryption keys; likewise, the current TCP/UDP connection table, ARP cache, and routing state exist only while the operating system is operational. Consequently, these must be captured using live forensic toolkits before shutdown, as any delay or power loss destroys them irrecoverably.

GrayKey, developed by Grayshift, is a dedicated iOS forensic tool engineered specifically for physical extraction and passcode bypass. It exploits hardware and software vulnerabilities to gain full file-system access from locked iPhones/iPads, bypassing the Secure Enclave's retry limits. Law enforcement agencies use GrayKey for targeted deep extraction of iOS devices, making it the only option in this list uniquely designed for this purpose.

When the OS deletes a file on an SSD with TRIM enabled, it sends an ATA DATA SET MANAGEMENT command that instructs the controller to physically erase the involved NAND blocks right away, rather than simply marking the space as reusable in the file system. This immediate erasure means that the actual data cells are zeroed or invalidated, eliminating the possibility of recovery with conventional file carving or deep recovery tools, which rely on residual data. From a forensic perspective, TRIM effectively defeats many standard deleted-file recovery workflows on modern SSDs.

RAM contains the most volatile data, including running processes, network connections, and encryption keys. It is lost when the system is powered off. Capturing RAM first aligns with the order of volatility and ensures critical evidence is preserved. This is a fundamental first-responder principle for live systems.

The primary purpose of a write blocker is to guarantee the integrity of the original evidence by creating a read-only interface between the drive and the forensic workstation. It intercepts and blocks all write commands issued by the operating system, including those that might occur from normal mounting, file system metadata updates, or malware, ensuring the source drive remains bit-for-bit unchanged. This preservation is essential for maintaining a legally defensible chain of custody and allowing a subsequent hash verification to prove evidence authenticity.

Packing is a legitimate software distribution technique that malicious actors repurpose for anti-forensic effect. A packer compresses and often encrypts the original executable payload, embedding it within a decompressor stub, so the on-disk byte sequence no longer matches known malware signatures. At runtime, the stub unpacks the payload in memory, defeating static signature-based scans and complicating file-level triage by forensic investigators.

A hardware write-blocker physically intercepts write commands on the interface, so the suspect drive cannot be modified during imaging. This is the standard lab practice for preserving evidence integrity and is expected by CHFI when acquiring suspect media. Using it before imaging ensures the original drive remains unaltered and the hash of the source matches the image.

Regshot is a lightweight open-source utility that captures a baseline snapshot of the Windows registry and, optionally, the file system, then produces a second snapshot after the malware is executed. It compares the two snapshots and generates a detailed diff report, making it ideal for quickly identifying persistence locations, new files, and altered keys. Because it is not a real-time logger, it does not overwhelm the analyst with noise; instead, it gives a clean before-and-after view of system changes.

ext4 is a journaling file system that logs pending metadata and sometimes data changes to a journal area on disk before committing them to their final location, enabling rapid recovery and consistency after a crash or power failure. It supports journaling modes such as ordered, writeback, and journal, each balancing performance against consistency guarantees. This journaling mechanism is a definitive characteristic of ext4.

MBR (Master Boot Record) is a legacy partition table that uses 32-bit entries in its partition table, limiting the maximum addressable partition size to 2 TB (or 2.2 TB with 512-byte sectors). It resides in the first 512 bytes of the disk and contains boot code plus four primary partition entries. This 2 TB ceiling is the exact characteristic indicated in the question, making MBR the correct answer.

Analyzing the IAM policy change that granted the role is the definitive step for identifying the source because it reveals the exact principal, timestamp, and method used to elevate privileges. Check Cloud Admin Activity audit logs for 'google.iam.admin.v1.SetIAMPolicy' events, noting whether the grant came from a compromised user, an OAuth token, or an external session. This forensic root-cause analysis establishes the attack vector and scope, guiding appropriate containment and recovery efforts.

netscan is the correct Volatility plugin for this task because it enumerates active TCP and UDP endpoints by walking the kernel's network structures (e.g., TCP_ENDPOINT and UDP_ENDPOINT lists via the ADDR_OBJ). It is specifically designed to reveal established, listening, and even closed-but-recent connections in a memory dump, making it the direct equivalent of 'netstat -an' for memory forensics. For network connection analysis on modern Windows (Vista+), netscan is the go-to plugin as it uses the tcpip.sys endpoint objects rather than the older, less reliable pool tags.

NetFlow logs are network-level metadata records generated by Cisco and other network devices that summarize traffic flows between hosts. Each flow record contains the source and destination IP addresses, ports, protocol, timestamps, total bytes and packets, and sometimes TCP flags — but critically no payload content. This makes NetFlow valuable for high-level pattern analysis such as detecting command-and-control beacons, anomalous data-transfer volumes, or internal lateral movement, while remaining relatively lightweight to store. As a core source of network telemetry, NetFlow is a mainstream network forensics artifact.

The Received header is inserted by every SMTP server that handles the message, and each line records the IP address of the transmitting host, the receiving server, protocol information, and a timestamp. The bottommost Received line is the first one added, showing the connection from the originating client or its final relay. Therefore, forensically it is the go-to field for discovering the sending IP address.

USBSTOR enumerates storage-class USB devices, recording vendor, product and serial number for each device ever attached. This key sits under the SYSTEM hive's CurrentControlSet, making it the definitive artefact for proving historical USB mass-storage connections on Windows 10.

/data/data/<package_name>/ is the core of an Android app's private internal storage, residing on the /data partition. This sandboxed directory contains the app's databases (e.g., SQLite), shared preferences in XML files, cached web content, and other files the app reads/writes at runtime. Although protected by Linux UID permission barriers, forensic extraction via a full filesystem image or ADB backup (if backed up) can recover valuable user-generated data, cookies, and session tokens critical to an investigation. This is the primary location for evidentiary data produced by an application's own execution.