Computer Hacking Forensic Investigator CHFI (CHFI) — Questions 601–675

Chain of custody must include who handled the evidence, when (date/time), and what was done. Access control and backup procedures, while important, are not typically part of the chain of custody form itself.

Regshot is a lightweight open-source tool designed specifically to compare registry hives and file system snapshots taken before and after executing a binary. It generates a detailed report of added, modified, or deleted keys and files, making it ideal for malware analysis to quickly identify persistence mechanisms or configuration changes.

ext4 uses extents for efficient space management and a journal for metadata consistency.

MBR uses 32-bit partition table entries and supports up to 2 TB partitions. GPT uses 64-bit entries and supports larger disks.

The analyst should revoke access to prevent further exfiltration, preserve the logs for investigation, and examine the source of the role grant (IAM changes).

netscan and connscan are Volatility plugins that list network connections. pslist lists processes, not connections. pstree lists process trees. dlllist lists loaded DLLs.

Packet captures (PCAP), NetFlow logs, and IDS/IPS logs are all standard network forensic data sources that provide detail on network traffic.

The 'Received' field in an email header is added by each mail transfer agent (MTA) that processes the message, and the first 'Received' header (at the bottom of the header block) typically contains the IP address of the original sending client (the SMTP client that initiated the connection). This field records the 'from' IP and the 'by' host, making it the definitive source for tracing the origin of the email.

Option C is correct because stored procedures, triggers, and user-defined functions (UDFs) in MySQL can be maliciously created or modified by an attacker to execute arbitrary code, escalate privileges, or maintain persistence. Forensic analysis must inspect these objects for unauthorized changes, as they are often overlooked but can contain backdoor logic that survives database restarts and backups.

USB device history is stored in the SYSTEM hive under CurrentControlSet\Enum\USBSTOR. This key lists all USB storage devices that have been connected.

Option A is correct because `/data/data/<package_name>/` is the primary internal storage directory for an Android app's private data, including databases, shared preferences, and cached files. This directory is sandboxed per app and requires root access or a backup to read, making it a key forensic target for application-specific evidence.

Webshells often involve file uploads to directories like uploads, and subsequent requests to that file with parameters indicating command execution (e.g., cmd=).

Deleted items in PST files may still reside in the 'Deleted Items' folder or be recoverable from the Recoverable Items folder (dumpster) before permanent deletion.

A hardware write blocker is a device placed between the suspect drive and the forensic workstation that intercepts and blocks any write commands from the host system. Its primary function is to ensure that no data—such as file system metadata, temporary files, or operating system writes—can be written to the suspect drive, thereby preserving the original evidence in a forensically sound manner. This is critical for maintaining the integrity of the evidence and ensuring it is admissible in court.

The inode table stores metadata about each file (except name), superblock contains filesystem parameters, and journal records metadata changes for recovery.

PDF forensics involves parsing objects, checking for scripts, and sandbox analysis.

Option D is correct because volatile data (e.g., RAM contents, network connections, running processes) is lost when the system loses power. FTK Imager or dd can capture a bit-for-bit image of memory and live system state while the computer remains on, preserving evidence that would otherwise vanish. This aligns with the order of volatility (RFC 3227), which prioritizes capturing volatile data before any other action.

Firewall logs, proxy logs, and IDS/IPS logs are essential: firewall logs show allowed/denied connections, proxy logs reveal HTTP/HTTPS traffic details, and IDS/IPS logs detect malicious payloads.

The USN (Update Sequence Number) journal, also known as the change journal, records all changes to files on an NTFS volume. It is a valuable artifact for tracking file activity and forensic timeline analysis.

Option C is correct because a legal hold notice triggers a duty to preserve all potentially relevant electronically stored information (ESI). Under the Federal Rules of Civil Procedure (FRCP) Rule 37(e), failure to preserve can lead to spoliation sanctions. The immediate action is to issue a litigation hold notice and suspend routine data deletion policies, ensuring that all relevant emails, documents, and logs are preserved in their current state.

.plist (Property List) files store configuration data for applications and system settings on macOS. They can contain user preferences, recent items, and other forensic artifacts.

The dir /r command in Windows lists all alternate data streams associated with files in a directory. This is a standard forensic technique to detect hidden data.

The binary log (binlog) records all changes to database data and structure (INSERT, UPDATE, DELETE, DDL). It is essential for forensic analysis of data manipulation events.

The truncated log file is direct evidence because it is a tangible, physical artifact that, by its very state (having been truncated), directly indicates that an action was taken to alter or destroy log data. In computer forensics, direct evidence is evidence that, if believed, proves a fact without any inference or presumption. The truncation itself is a fact that can be observed and analyzed, and it directly supports the conclusion that someone tampered with the log file to conceal the failed SSH login attempts.

Volatility can extract process lists (pslist), network connections (netscan), and process trees (pstree). These are standard plugins for memory analysis.

In FAT filesystems, a deleted file's directory entry is marked with 0xE5 as the first byte of the filename. The file's cluster chain in the File Allocation Table is also marked as free. This is the standard deletion marker.

TestDisk is a powerful tool designed to recover lost partitions and repair boot sectors. It can scan for partition tables and restore deleted partitions on MBR and GPT disks.

When a suspect's computer is already turned off, the best procedure is to seize it and transport it to a forensic lab for imaging. This preserves the integrity of the evidence by preventing any accidental modification of the hard drive's contents, which could occur if the system is powered on or booted from a live CD. In forensic best practices, the first responder should never boot a suspect's computer, as doing so can alter critical system files, timestamps, and volatile data, compromising the chain of custody and admissibility of evidence.

Locard's exchange principle states that every contact leaves a trace. In digital forensics, this means that when a perpetrator interacts with a system—whether by accessing files, running commands, or connecting to a network—they inevitably leave digital artifacts such as log entries, registry keys, metadata, or network connection records. Option C correctly captures this core concept of trace transfer in the digital domain.

In ext3, deleted inodes can be recovered by analyzing the journal (which records metadata changes) or by scanning the inode table for orphan inodes. File carving recovers file data without metadata. Using debugfs to view the superblock does not recover inodes.

The USBSTOR registry key and setupapi.dev.log contain information about USB devices connected to the system, including device IDs and timestamps.

Maintaining a detailed chain of custody log (Option A) is a recommended practice because it provides a verifiable, chronological record of every person who handled the evidence, the time and date of each transfer, and the purpose of each transfer. This ensures the evidence's integrity by demonstrating that it has not been tampered with or altered from the moment of seizure through analysis and presentation in court. Without a proper chain of custody, the evidence can be challenged as inadmissible under rules like Federal Rule of Evidence 901.

SHA-1 and MD5 are the two hashing algorithms most commonly used in forensic practice to verify the integrity of forensic images. They produce a fixed-size hash value (160-bit for SHA-1, 128-bit for MD5) that acts as a digital fingerprint; if the hash of the original image matches the hash of a copy, the data is considered unchanged. Despite known collision weaknesses, they remain the de facto standards in tools like FTK Imager, EnCase, and dd due to their speed and widespread tool support.

The log file is admissible under the business records exception to the hearsay rule (Federal Rule of Evidence 803(6)). This exception applies because logs are created automatically or by a person with knowledge, near the time of the event, in the regular course of business, and it is the regular practice to make such records. In digital forensics, system logs (e.g., Windows Event Logs, syslog) are routinely admitted under this exception, as they are generated by the system without the declarant's bias or memory issues.

The Daubert standard requires that expert testimony be based on scientific methods that are testable, peer-reviewed, and have known error rates.

The SYSTEM\CurrentControlSet\Enum\USBSTOR registry key is a primary location where Windows records every USB storage device that has been connected to the system. Each device is listed under this key with a unique instance ID, including the vendor ID, product ID, and serial number, providing persistent evidence of USB connections even after the device is removed.

The `dir /r` command in Windows Command Prompt lists all files, including their alternate data streams. Alternatively, tools like 'streams' from Sysinternals can be used.

svchost.exe from C:\Windows\Temp indicates a masquerading technique where malware names itself after a legitimate Windows process but runs from an unauthorized location. The outbound connections on port 443 are likely command-and-control (C2) traffic.

The /data/data/ directory on Android devices stores application-specific data for user-installed apps, including preferences (shared preferences XML files), databases, and cached information. This location is part of the internal storage partition and is sandboxed per app, ensuring that each app can only access its own data directory. It is the primary repository for runtime app data, making it the most relevant for forensic analysis of user-installed app artifacts.

Prefetch files contain the first run time, last run time, and run count of applications, plus loaded DLLs, useful for timeline analysis.

Option A is correct because modifying the hosts file to redirect a legitimate domain to 192.168.1.1 is a classic persistence mechanism: the malware ensures that every time the system resolves that domain, it points to the attacker-controlled IP, effectively hijacking network traffic persistently across reboots without needing to run at startup. This behavior directly maintains unauthorized control over name resolution, which is a hallmark of persistence.

Scheduled Tasks via schtasks (Option A) are a common persistence mechanism because malware can create a task that runs at system startup or at regular intervals to re-infect or maintain a foothold. The schtasks command allows creating tasks with SYSTEM privileges, often triggered by logon or system boot events, making it a stealthy way to survive reboots.

The backup GPT header is stored at the last sector of the disk to provide redundancy in case the primary GPT header is corrupted.

The `mysqlbinlog` utility is specifically designed to parse MySQL binary log files and output the contained SQL statements in a human-readable format. Binary logs record all data-changing operations (e.g., INSERT, UPDATE, DELETE) in a proprietary binary format, so only `mysqlbinlog` can decode them back into readable SQL for forensic analysis.

LNK files are correct because they record the last access timestamp of the file or application they point to, along with the volume serial number and path. This metadata allows a forensic examiner to reconstruct user activity and file access sequences during timeline analysis. Prefetch files are correct because they store the last run time, run count, and file paths of executed applications, enabling the creation of a chronological timeline of program execution on a Windows system.

tcpdump is a command-line packet capture utility that captures raw network traffic at the link layer, making it ideal for collecting full packet captures (PCAP) from a SPAN port. Unlike GUI tools, it can run headless on a forensic workstation and write binary PCAP files for later analysis with tools like Wireshark. It captures all packets traversing the SPAN port without filtering by default, ensuring a complete record of the compromise.

The $I files in the $Recycle.bin contain metadata about the deleted file, including original path and deletion time.

A write blocker prevents any write operations to the evidence drive, ensuring the original data is not altered during acquisition.

The Police and Criminal Evidence Act (PACE) 1984 governs the powers of police in England and Wales to search, seize, and retain evidence. Without a warrant, the seizure of a computer likely violates PACE's requirements for lawful entry and seizure, making the evidence inadmissible under UK law.

Jumplists contain recently accessed files and application-specific destinations, used for Quick Access and Recent Items.

FSEvents records file system events such as file creation, modification, and deletion. It is a key artifact for timeline analysis on macOS.

The iOS Keychain is designed to store small, sensitive credentials such as passwords, keys, and certificates. SMS message content is stored in the SMS/MMS database (sms.db) under the protected /private/var/mobile/Library/SMS/ directory, not in the Keychain. Keychain items are encrypted per-app or per-service, whereas SMS messages are managed by the Messages app and stored in a SQLite database with its own encryption layer.

Aid4Mail is a forensic email analysis tool that supports PST, OST, MBOX, and other formats. It is commonly used for email investigations.

Network capture requires admin rights, interface selection, optional filters, and saving the capture.

A factory reset on Android typically performs a fast format of the /data partition, which only erases the file system metadata (e.g., ext4 journal and inode tables) but does not overwrite the actual data blocks. Therefore, user data may remain on the flash storage and be recoverable using forensic tools until those blocks are overwritten by new writes. This is why option A is correct: some user data may be recoverable from the /data partition if it has not been overwritten.

EmailTracker is a tool that analyzes email headers to trace the path and identify the source IP, often used in email forensics.

The Security Account Manager (SAM) registry hive stores local user account information and password hashes, typically located at HKLM\SAM.

The malware writes to 'HKLM\SYSTEM\CurrentControlSet\Services\<malware>\ImagePath' and creates a service, which is the exact mechanism for registering a Windows service. This persistence method ensures the malware runs automatically when the system boots, as the Service Control Manager (SCM) loads services based on this registry key. Option D is correct because this behavior directly corresponds to the Windows service persistence technique.

Factory reset (option C) is a common anti-forensic technique in mobile forensics because it wipes user data partitions and resets the device to its original state, often using the 'wipe_data' command in recovery mode or via settings. This removes user-installed applications, accounts, and files, making data recovery difficult unless a physical or chip-off method is used. Timestomping (option E) is also common, as attackers modify file timestamps (e.g., using 'touch -t' on rooted devices or manipulating EXT4 metadata) to mislead forensic timelines and hide the sequence of events.

A hardware write blocker physically prevents any write commands from reaching the original drive at the SATA/IDE bus level, ensuring the drive remains unaltered during acquisition. Tableau is a well-known manufacturer of forensic hardware write blockers that operate transparently to the imaging software, making it the correct choice for a hardware-based solution.

Locard's Exchange Principle states that every contact leaves a trace. In digital forensics, this translates to the idea that when a system interacts with another, digital artifacts (such as log entries, registry keys, or network connection records) are created. Option A is correct because the log files on the suspect's computer are a direct trace of the contact between the suspect's system and the server, demonstrating the principle in a digital context.

Static analysis examines a binary's code and structure without executing it, allowing analysts to identify malicious indicators such as embedded strings, import tables, and cryptographic constants. This approach avoids triggering anti-analysis mechanisms that activate upon execution, making it a foundational step in malware forensics.

The primary purpose of a legal hold is to preserve all forms of potentially relevant evidence by suspending normal data retention and deletion policies. This ensures that data, including emails, documents, and logs, is not altered or destroyed during the e-discovery process, which is critical for maintaining the integrity of evidence for litigation.

The log shows a path traversal attempt using URL-encoded backslashes (%5c) to navigate to cmd.exe. The 200 status indicates the request succeeded. This is a classic path traversal attack.

Transaction logs (also called redo logs) record all changes to the database, enabling point-in-time recovery and auditing of data modifications.

The filter matches TCP packets to port 22 (SSH) with only the SYN flag set (SYN=1, ACK=0). These are the first packets in a TCP handshake, representing connection attempts.

SiLK (System for Internet-Level Knowledge) is a set of NetFlow analysis tools designed for large-scale flow data analysis, including identifying top talkers and anomaly detection.

DKIM provides a digital signature that verifies the email was not tampered with and originates from the claimed domain. A failed DKIM check indicates the email may have been altered or spoofed.

Option C is correct because GrayKey is a specialized hardware/software tool designed to perform a full file system extraction from locked iOS devices, including those with passcodes. It exploits vulnerabilities in the iOS Secure Enclave or bootrom to bypass security mechanisms and retrieve a bit-for-bit copy of the device's storage, which is critical for forensic acquisition.

A legal hold (also known as a litigation hold) is a directive that suspends the normal deletion or destruction of data that may be relevant to pending or reasonably anticipated litigation. In e-discovery, this ensures that potentially relevant electronically stored information (ESI) is preserved and not altered or destroyed, thereby preventing spoliation of evidence. The purpose is to maintain the integrity and availability of data for discovery obligations under rules such as FRCP Rule 37(e).

Path traversal attacks use '../' sequences or encoded versions to access files outside the web root. Both options A and B are typical signatures.

Prefetch files track application launches; Jump Lists track recently used files per application.

Software write blockers are not as reliable as hardware ones because they rely on the operating system, which can be compromised; hardware write blockers provide physical write protection.