Computer Hacking Forensic Investigator CHFI (CHFI) — Questions 451–525

Physical acquisition creates a bit-for-bit copy of the entire flash storage, including unallocated space and deleted file remnants. This is the only method that captures the raw NAND memory, allowing recovery of data from unallocated blocks and slack space that logical and file system acquisitions skip.

The correct first action is to capture a full memory dump using a forensic tool like FTK Imager or WinPmem. Since the laptop is powered on and malware is suspected, volatile data (including running processes, network connections, and encryption keys) is at risk of being lost. Preserving RAM is the highest priority in live incident response because it contains evidence of active malware and ongoing exfiltration that would be lost upon shutdown or disconnection.

The log shows a URI parameter containing SQL injection syntax (1' OR '1'='1). The single quote and OR condition are classic indicators of SQL injection attempts.

A hardware write blocker is a device that sits between the source drive and the forensic workstation, intercepting and blocking any write commands from the host operating system. This ensures that the source drive is connected in a read-only state, preventing any accidental modifications to the evidence during acquisition. Option C correctly identifies this core function of preserving the integrity of the source drive.

A memory dump of the EC2 instance captures RAM contents, including running processes, network connections, encryption keys, and other volatile data that is lost when the instance is terminated. This is critical for forensic analysis of live system state. An EBS snapshot preserves the root and data volumes, providing a point-in-time copy of the file system and persistent storage, which is also lost upon termination.

The accounts.db file in /data/system/ is the SQLite database that stores all Google account credentials, including email addresses and authentication tokens used by the Android Account Manager. This is a primary artifact for identifying which Google accounts were configured on the device and their sync status.

RAID 5 uses distributed parity. With one disk failure, data can be reconstructed using the parity information on the remaining two disks.

FSEvents is a macOS logging system that records changes to the file system, including application launches and user logins, providing a timeline of system activity.

The `hash=sha256` parameter instructs dcfldd to compute a SHA-256 hash of the input data as it is read, and `hashlog=hash.txt` writes that hash value to a separate file. This allows the analyst to later verify that the forensic image (`image.dd`) is an exact bit-for-bit copy of the source (`/dev/sda`) by recomputing the hash and comparing it to the stored value, ensuring data integrity and admissibility in court.

GCP Cloud Audit Logs record admin activities like bucket deletion. Cloud Storage logs (access logs) record object-level operations but not bucket deletion by IAM users.

Option A is correct because correlating the database server logs with the web server logs allows you to identify exactly which customer records were queried and then cross-reference that with the outbound HTTP connection (from the web server to 198.51.100.20 on TCP port 80) to determine if the data was exfiltrated. This approach directly addresses both the root cause (SQL injection via the inbound request) and the scope (which records were stolen and how they left the network).

A is correct because a UPS provides temporary power during outages to prevent data loss or corruption during forensic imaging, while surge protectors guard against voltage spikes that could damage sensitive lab equipment. Best practices require both to ensure chain of custody integrity and hardware reliability.

The web server logs (access.log) can show the initial exploit request. auth.log may show authentication events if credentials were used. bash_history can reveal commands executed after compromise. cron jobs are persistence mechanisms but not entry point. /etc/shadow stores password hashes, not attack details.

FSEvents logs file system changes on macOS, recording events like file creation, modification, and deletion in a binary log.

Google account artefacts, such as the Google Services Framework (GSF) ID and the device's Google Account (GAIA) ID, are stored in the /data/system/ partition and are often retained even after a factory reset because the reset does not always wipe the cryptographic keys or the persistent data blocks used by Google's sync services. This allows forensic tools to recover the previously synced account details, providing evidence of prior usage.

Authenticity means evidence is what it purports to be. Matching hashes confirms the image is an exact copy, thus authentic.

Foremost is the correct choice because it performs file carving based on headers and footers, which can recover file content even when the filesystem metadata (such as inodes) is damaged or partially overwritten. Unlike undelete tools that rely on intact filesystem structures, foremost scans the raw disk blocks for known file signatures, making it effective for recovering files from an ext4 filesystem that has experienced partial overwriting.

Wireshark and tcpdump are standard tools for capturing and analyzing network packets. Volatility is for memory forensics, Autopsy is for disk forensics, and dd is for disk imaging.

Chrome stores history in an SQLite database file named 'History' located in the user's default profile directory under %LOCALAPPDATA%\Google\Chrome\User Data\Default\.

Event ID 4625 indicates a failed logon attempt. Multiple rapid failures suggest a brute-force password guessing attack.

File recovery involves selecting type, location, scanning, and saving to a different drive.

TRIM causes the SSD to erase deleted blocks immediately, making recovery impossible. Imaging the drive as soon as possible and using a write-blocker can prevent further TRIM commands.

MAC address spoofing is commonly used to bypass 802.1X authentication because 802.1X typically authenticates devices based on their MAC address after the EAP (Extensible Authentication Protocol) handshake. By spoofing the MAC address of an already-authenticated device, the attacker can impersonate that device and gain network access without valid credentials, effectively bypassing the NAC enforcement.

Option C is correct because the AddressBook.db (or Contacts.sqlitedb on newer iOS versions) stores contact information, and call history records are linked to contacts via the `call_history.db` file. The `call_history.db` database contains the actual call log entries, including timestamps, durations, and associated contact identifiers. Together, these two databases allow an analyst to reconstruct call history with contact names.

Alternate Data Streams (ADS) in NTFS allow data to be attached to a file, and the size is not shown in the main directory listing.

A transaction log showing INSERT operations on a sensitive table, especially with bulk insert, is strong evidence of data exfiltration. The timing and table name suggest unauthorized copying of credit card data.

Foremost uses file headers/footers for carving. If the file was fragmented, the tool may only recover the first fragment, leading to corruption.

The legitimate svchost.exe runs from C:\Windows\System32, not from C:\Users\Public. This is a common masquerading technique where malware uses a system process name in a user‑writable location.

The 'docker history' command shows the history of an image, listing each layer and the command that created it.

PACE requires that evidence is not obtained through oppression or in violation of legal procedures, ensuring reliability and fairness.

Option B is correct because IP addresses of command and control (C2) servers are a standard type of Indicator of Compromise (IoC). They represent network-based IoCs that allow defenders to identify and block communication between compromised hosts and attacker-controlled infrastructure, often used in conjunction with firewall logs or DNS queries.

Multi-tenancy means data from multiple customers may reside on the same physical hardware, complicating isolation and acquisition of evidence.

In ext4, when a file is deleted, the inode is marked as free but data blocks may remain. Using the debugfs command with the lsdel or undel function can recover the inode and data.

Physical acquisition creates a bit-for-bit copy of the entire flash memory, including deleted files and unallocated space, providing the most complete data recovery.

The unified logging system records download events, and the Quarantine database (com.apple.quarantine extended attribute or SQLite DB) tracks downloaded files with timestamps and source URLs.

Elcomsoft Phone Breaker is specifically designed to decrypt and display iOS keychain contents from backups, including passwords, tokens, and cryptographic keys. It leverages techniques such as brute-force, dictionary attacks, and GPU acceleration to recover the backup password, then extracts and decrypts the keychain data using iOS's Keychain Services API.

The log shows a UNION SELECT statement in the query parameter, indicating a SQL injection attempt. The URL-encoded single quote (') and comment (--) are classic SQLi payloads.

Webshells often have recent modification times out of sync with other files, and they typically accept command parameters in GET/POST requests. Large file size alone is not definitive, and missing index.html is unrelated.

USB device history is stored in the USBSTOR registry key, which enumerates devices by their Vendor ID (VID) and Product ID (PID).

TRUNCATE TABLE removes all rows and is often used by attackers to cover tracks after exfiltration, while INSERT adds data (possibly exfiltrated or planted).

Event ID 7045 is logged when a new service is installed on Windows.

Alternate Data Streams (ADS) allow data hiding in files, and the $Recycle.bin folder can be used to store deleted files that are not visible in normal browsing.

File timestamps can be manipulated by anti-forensics tools. A creation time before the volume format is a strong indicator of timestamp manipulation.

Unified logging (via log command) captures system and user activity in a centralized database, replacing traditional syslog.

/proc/[pid]/cmdline contains the command-line arguments of the process, null-separated.

iptables is a Linux firewall that can block IP addresses. fail2ban can automate this but is not listed; iptables is the direct tool.

Option D is correct because iOS Health app data is protected by iOS Data Protection, which uses a class key derived from the user's device passcode. This key encrypts the SQLite database files in iCloud backups, and decryption requires either the passcode or a forensic bypass tool that can extract the key from the device's Secure Enclave.

Performing a tail-log backup with NORECOVERY captures all transactions committed after the last log backup (1:45 PM) up to the current point in time, including the attack period. This preserves the database in a restoring state, preventing further changes while allowing point-in-time recovery to just before 2:00 PM. It is the mandatory first step to minimize data loss and maintain forensic integrity before any restore operations.

The modification of the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run is a classic persistence mechanism. This key is automatically processed by Windows Explorer at user logon, causing any executable listed there to run. Combined with the mutex creation (which prevents multiple instances), the behavioral indicator is clearly an attempt to establish persistence on the host.

Run keys under HKLM and HKCU are common autorun locations used by malware to start on boot or user login.

A full file system extraction in Oxygen Forensic Detective requires root access on the Android device because the tool must bypass the Linux kernel's permission model to read protected partitions (e.g., /data, /cache). Without root privileges, the extraction is limited to the logical or file-based scope, as the Android security model restricts user-space processes from accessing raw block devices or system files owned by root.

The Fourth Amendment protects against unreasonable searches and seizures, and a computer located in a private residence generally falls under a heightened expectation of privacy. Without exigent circumstances (e.g., imminent destruction of evidence, hot pursuit), a forensic examiner must obtain a search warrant based on probable cause before seizing and analyzing the device. This ensures that the digital evidence is admissible under the exclusionary rule.

Option C is correct because, under the full recovery model, point-in-time recovery is required to undo the DROP TABLE. By performing a tail-log backup (to capture any transactions after the last log backup), then restoring the full backup and all subsequent transaction log backups with STOPAT or STOPBEFOREMARK to the moment just before the DROP TABLE, the analyst can recover the table without losing other transactions. This is the only method that preserves the dropped table's data while maintaining database consistency.

Option D is correct because once a VM is terminated, its underlying instance store or ephemeral disks are destroyed, but persistent snapshots and backups retain the disk state at the time they were taken. Restoring from a recent snapshot or backup is the only reliable method to recover the VM's file system, application data, and user artifacts for forensic analysis in a cloud environment.

The journal in ext3/ext4 logs metadata changes (and optionally data) to ensure filesystem consistency after a crash. It is a circular log that is replayed during mount.

The `message` table in iOS's SMS.db database stores the actual text content of each SMS and iMessage in its `text` column. This is the primary table queried to retrieve the body of sent and received messages, as it contains one row per message with fields like `is_from_me`, `date`, and `text`.

A hardware write-blocker like the Tableau Forensic Bridge sits between the suspect drive and the forensic workstation at the physical layer, intercepting and blocking any write commands (e.g., ATA WRITE DMA, SCSI WRITE) before they reach the drive. This ensures that no data—including metadata, timestamps, or file system artifacts—is altered during acquisition, which is critical for maintaining evidentiary integrity. Software-based blockers can be bypassed by the OS or a malicious driver, making hardware-level blocking the gold standard in forensic acquisition.

The primary action is to place a legal hold on relevant data and suspend routine deletion policies. This ensures that all potentially relevant electronically stored information (ESI) is preserved in its current state, preventing spoliation and compliance with the legal hold notice. Suspending deletion policies stops automated processes like email purge jobs or document retention schedules from destroying evidence, which is a foundational step in the e-discovery process.

DKIM (DomainKeys Identified Mail) uses a digital signature to verify the email's origin and integrity.

PEiD is specifically designed to analyze PE (Portable Executable) headers, making it ideal for quickly viewing section tables, import/export tables, and detecting packers or compilers. It parses the IMAGE_NT_HEADERS structure directly, providing a concise summary of the PE layout without requiring disassembly or decompilation.

Event ID 7045 indicates a new service was installed, which is a common persistence mechanism used by malware.

TRIM causes the SSD to erase data blocks that are no longer in use, making recovery difficult. Wear-leveling distributes writes evenly, but also moves data around, complicating physical recovery.

Option C is correct because write-blocking devices (hardware or software) prevent any write operations to the source drive during acquisition, ensuring the original data remains unaltered. This is fundamental to maintaining the integrity of digital evidence, as any modification could render the evidence inadmissible in court. Forensic imaging tools like FTK Imager or dd rely on write-blockers to guarantee a bit-for-bit copy without contaminating the source.

Physical extraction using a JTAG or chip-off technique provides the most complete and forensically sound image because it accesses the raw NAND flash memory at the hardware level, bypassing the operating system and any software-based restrictions. This method captures deleted data, unallocated space, and the entire file system structure, including areas not accessible via logical or file system extractions, ensuring a bit-for-bit copy of the internal storage.

Event ID 4625 indicates a failed logon attempt. Multiple failed attempts from one source against different usernames is characteristic of a password spraying attack, where an attacker tries a few common passwords across many accounts.

SSL certificate mismatches occur when a man-in-the-middle (MITM) attacker presents a forged or self-signed certificate that does not match the legitimate server's certificate. Browsers and security tools will flag this mismatch (e.g., different Common Name, invalid issuer, or expired validity), providing a clear indicator of an ongoing MITM attack. This is a direct detection method because the attacker cannot easily obtain a valid certificate for the target domain without the private key.

The general query log captures every SQL statement, including SELECT queries, making it ideal for identifying data exfiltration.

The 'CurrentVersion\Run' registry key is a standard persistence location where malware adds entries to execute automatically at user logon. Filtering for 'RegSetValue' events targeting this path directly captures the act of writing a new value to that key, which is a common persistence mechanism. Process Monitor's 'RegSetValue' operation specifically monitors registry value modifications, making it the most effective filter for this purpose.

The legal hold notice imposes a duty to preserve relevant evidence. Deleting emails after receiving such notice constitutes intentional destruction of evidence, which is spoliation. This violates the legal principle of spoliation of evidence, as the organization had a duty to preserve the emails for the pending litigation.

Webshells are often detected by recent file timestamps and anomalous POST requests in logs.

$LogFile (A) records metadata changes to the NTFS volume, including transactions that can be replayed to recover file names and directory entries for recently deleted files. $MFT (C) contains the master file table entries for every file and directory; even after deletion, the MFT entry often remains until overwritten, allowing recovery of file attributes and data runs.

Rundll32.exe executing JavaScript is a known technique for code execution, often used by malware to run scripts for persistence or payload delivery.