EC-Council CHFI (312-49) Certification Exam — Questions and Answers

Question 1: Which of the following represents a major legal and logistical challenge that is significantly more prevalent in cloud forensics compared to traditional on-premises investigations?

The process of recovering deleted files from unallocated space.
Data sovereignty and cross-jurisdictional data access. (Correct answer)
The requirement to use hashing algorithms to verify data integrity.
The need to maintain a chain of custody for evidence.

Correct answer: Data sovereignty and cross-jurisdictional data access.

Data sovereignty is a paramount challenge in cloud forensics. Because a cloud service provider may store a customer's data in data centers located in different countries, investigators often face legal hurdles related to jurisdiction. A warrant or subpoena issued in one country may not be valid in another where the data physically resides, requiring complex international legal agreements like Mutual Legal Assistance Treaties (MLATs). The other options are fundamental challenges in all forms of digital forensics.

Question 2: During investigation, an analyst finds that a system sent a DHCP request claiming to be a different device's MAC address. This attack is called:

DHCP starvation
MAC spoofing (Correct answer)
IP spoofing
Rogue DHCP server attack

Correct answer: MAC spoofing

MAC spoofing involves changing the source MAC address in frames to impersonate another device, which can be detected by comparing DHCP requests against switch MAC address tables.

Question 3: What is the forensic significance of finding `null bytes (%00)` in web server log entries?

They indicate the client browser version is outdated
They signal an encrypted payload
They indicate compressed content
They may be used to truncate file extensions or bypass input validation filters (Correct answer)

Correct answer: They may be used to truncate file extensions or bypass input validation filters

Null byte injection (`%00`) was historically used to truncate strings in C-based languages, tricking the application into treating a file like `shell.php%00.jpg` as a PHP file.

Question 4: A forensic investigator finds a file with a .txt extension but the file header shows 'FF D8 FF E0'. What does this indicate?

The file is encrypted
The file is corrupted
The file extension has been changed to hide a JPEG image (Correct answer)
The file uses Unicode encoding

Correct answer: The file extension has been changed to hide a JPEG image

The magic bytes FF D8 FF E0 identify a JPEG file; a .txt extension on such a file indicates deliberate obfuscation.

Question 5: What is the Host Protected Area (HPA) on a hard disk drive?

A special partition created by Windows for recovery files
The first track reserved for the MBR and partition table
A hidden area at the end of the disk that is excluded from normal OS disk size reporting (Correct answer)
An encrypted volume used to store credentials

Correct answer: A hidden area at the end of the disk that is excluded from normal OS disk size reporting

The HPA is a hidden region defined by ATA standard SET MAX ADDRESS commands that the BIOS and OS cannot normally detect, commonly used to hide data from forensic tools.

Question 6: What is the forensic significance of the Windows Volume Shadow Copy Service (VSS)?

It maintains a duplicate copy of the MFT in a hidden shadow partition
It monitors network traffic and logs packet captures to a shadow volume
It creates point-in-time snapshots of volumes that may contain previous versions of deleted or modified files (Correct answer)
It encrypts files at rest to prevent unauthorized access during forensic acquisition

Correct answer: It creates point-in-time snapshots of volumes that may contain previous versions of deleted or modified files

VSS shadow copies can contain previous versions of files, registry hives, and even deleted artifacts, providing investigators access to historical system states.

Question 7: In network forensics, what does the term 'full packet capture' refer to?

Recording complete network packet content including payloads (Correct answer)
Mirroring traffic exclusively to an IDS sensor
Logging failed connection attempts only
Capturing only packet headers and metadata

Correct answer: Recording complete network packet content including payloads

Full packet capture records entire network packets, including headers and payload data, enabling comprehensive traffic reconstruction.

Question 8: What is 'email spoofing' and what forensic technique helps identify it?

Forging the From address to impersonate another sender; identified by analyzing Received headers and DKIM/SPF results (Correct answer)
Encrypting emails; decrypted by checking certificates
Deleting sent emails; recovered by log analysis
Compressing email attachments; identified by file signatures

Correct answer: Forging the From address to impersonate another sender; identified by analyzing Received headers and DKIM/SPF results

Email spoofing forges the From header to impersonate a trusted sender; investigators identify it by tracing Received headers to the true originating IP and checking DKIM/SPF authentication failures.

Question 9: A hardware write blocker fails to initialize with a specific NVMe SSD. What is the BEST alternative to preserve evidence integrity?

Proceed without a write blocker and document the decision
Image the drive without any write protection to save time
Boot the suspect machine from a trusted forensic Linux live CD with software write blocking enabled (Correct answer)
Remove the NVMe drive and attach it via a standard SATA adapter

Correct answer: Boot the suspect machine from a trusted forensic Linux live CD with software write blocking enabled

Booting from a trusted forensic live environment (e.g., CAINE or Tails with forensic mode) enables software write blocking for interfaces where hardware write blockers are not yet available.

Question 10: What is the purpose of analyzing the 'Bcc' (Blind Carbon Copy) field in email forensics investigations?

Bcc recipients are hidden from other recipients but may appear in server logs or sender's sent folder, revealing hidden communication parties (Correct answer)
Bcc encrypts the email content
Bcc is always visible in email headers and easy to read
Bcc prevents the email from being forwarded

Correct answer: Bcc recipients are hidden from other recipients but may appear in server logs or sender's sent folder, revealing hidden communication parties

While Bcc recipients are invisible to To/Cc recipients, mail server logs, the sender's sent items, and mail server transaction logs may reveal who received Bcc copies.

Question 11: Which Windows artifact can reveal evidence of a program execution even if the executable has since been deleted, by tracking compatibility telemetry data?

Windows Error Reporting (WER) files in C:\ProgramData\Microsoft\Windows\WER
Driver store at C:\Windows\System32\DriverStore
Windows Installer logs in C:\Windows\Temp
Application Compatibility Cache (Shimcache) in the registry (Correct answer)

Correct answer: Application Compatibility Cache (Shimcache) in the registry

The Shimcache (AppCompatCache) registry key tracks executables that the Windows Application Compatibility engine has processed, persisting evidence of execution even after deletion.

Question 12: Which HTTP response code in web server logs most strongly indicates a successful directory traversal attack?

500 Internal Server Error
403 Forbidden
200 OK with unexpected file content (Correct answer)
404 Not Found

Correct answer: 200 OK with unexpected file content

A 200 OK response to a traversal-style request (e.g., `../../etc/passwd`) confirms the server served a file outside the web root.

Question 13: A web application firewall (WAF) log shows a block event for a request containing `SLEEP(5)` in a parameter. What attack technique was attempted?

Reflected XSS
Remote file inclusion
Time-based blind SQL injection (Correct answer)
HTTP response splitting

Correct answer: Time-based blind SQL injection

Time-based blind SQL injection uses functions like `SLEEP()` to cause database delays, inferring information based on response time when no data is returned directly.

Question 14: What is the forensic significance of the `Referer` HTTP header found in web server logs?

It specifies the encryption cipher used in the connection
It records the attacker's operating system
It identifies the server-side programming language used
It shows the URL from which the request originated, helping trace attack navigation paths (Correct answer)

Correct answer: It shows the URL from which the request originated, helping trace attack navigation paths

The Referer header shows what page or resource the request came from, helping investigators trace how an attacker navigated through an application.

Question 15: A malware sample uses the Heaven's Gate technique on a 64-bit Windows system. What is the primary purpose of this technique?

Switching from 32-bit to 64-bit execution to bypass WOW64 API hooks (Correct answer)
Escalating privileges by abusing kernel call gates
Injecting code via 64-bit process from a 32-bit process
Encrypting code sections to evade signature detection

Correct answer: Switching from 32-bit to 64-bit execution to bypass WOW64 API hooks

Heaven's Gate allows 32-bit malware running under WOW64 to directly invoke 64-bit code, bypassing 32-bit API hooks placed by security products in the WOW64 layer.

Question 16: Which CHFI-relevant tool is specifically designed to recover and analyze SQLite database files commonly found on mobile devices and applications?

DB Browser for SQLite (Correct answer)
Volatility
Wireshark
FTK Imager

Correct answer: DB Browser for SQLite

DB Browser for SQLite allows forensic investigators to open, view, and recover data from SQLite database files, which are widely used in mobile apps and desktop applications.

Question 17: When investigating a social media account on Facebook, which legal process in the US must law enforcement typically follow to obtain private user data from Meta?

FOIA request
DNS lookup
Informal request via email to Meta
Subpoena, court order, or search warrant depending on the data type (Correct answer)

Correct answer: Subpoena, court order, or search warrant depending on the data type

Under the Stored Communications Act (SCA), law enforcement must use a subpoena for basic subscriber info, a court order for non-content records, and a search warrant for private message content.

Question 18: A suspect's drive shows a partition type code of 0x07 in the MBR partition table. What file system does this typically indicate?

FAT32
Linux swap
NTFS or exFAT (Correct answer)
Linux ext4

Correct answer: NTFS or exFAT

Partition type code 0x07 is assigned to NTFS (and exFAT) partitions in the MBR partition table scheme.

Question 19: What is the primary forensic value of the SQL Server msdb database?

Contains SQL Agent job history and backup/restore history (Correct answer)
Stores user data tables
Stores model database templates
Holds temporary objects

Correct answer: Contains SQL Agent job history and backup/restore history

The msdb database stores SQL Server Agent job history, backup and restore history, and Database Mail data, providing a timeline of automated activities.

Question 20: Which SQL Server system database stores metadata about all other databases on the SQL Server instance?

msdb
model
tempdb
master (Correct answer)

Correct answer: master

The master database stores all instance-level metadata including login accounts, endpoints, linked servers, and configuration settings.

Question 21: During a forensic investigation, an analyst discovers that SQL Server error log entries have been deleted. Where else might evidence of malicious database activity be found?

Only in network packet captures
Windows Event Logs and SQL Server transaction logs (Correct answer)
Only in the application tier
Only in firewall logs

Correct answer: Windows Event Logs and SQL Server transaction logs

Windows Event Logs record SQL Server service events and security events, while transaction logs record all data modifications, providing corroborating evidence even when error logs are deleted.

Question 22: What does the 'Date' field in an email header represent, and why must investigators treat it with caution?

The date set by the sender's email client, which can be manipulated by the sender (Correct answer)
The date the email was received by the destination server, which is always accurate
The date the email was backed up
The date the email was scanned by antivirus

Correct answer: The date set by the sender's email client, which can be manipulated by the sender

The Date header is set by the sender's mail client and can be manually altered, so investigators should corroborate it against 'Received' header timestamps from mail servers.

Question 23: Which acquisition method captures only the allocated, in-use clusters on a drive rather than every sector?

Targeted acquisition
Logical acquisition (Correct answer)
Live acquisition
Sparse acquisition

Correct answer: Logical acquisition

Logical acquisition copies only the active file system contents (allocated clusters), not unallocated space or slack space.

Question 24: Which log source would provide the most reliable evidence of an internal host performing port scanning?

Email server logs
Web server access logs
Firewall or IDS/IPS logs showing repeated connection attempts (Correct answer)
DHCP lease logs

Correct answer: Firewall or IDS/IPS logs showing repeated connection attempts

Firewall and IDS/IPS logs capture connection attempts across multiple ports and IPs, making them the best source for identifying port scanning activity.

Question 25: When a hacker utilizes one compromised cloud to attack additional accounts, they are using the cloud as a tool.

False
True (Correct answer)

Correct answer: True

This statement is true. When a hacker leverages a compromised cloud environment (e.g., using a compromised virtual machine or cloud account) to launch attacks against other targets, the cloud infrastructure is serving as an instrument or means to facilitate the crime. In this scenario, the cloud is not the victim or the location of the crime, but rather the 'tool' used by the perpetrator to achieve their malicious goals.

Question 26: When creating a forensic image of a RAID array, what is the RECOMMENDED approach?

Use the RAID controller's native export function for best results
Image only the parity disk since it contains all data
Power off the RAID controller before imaging to prevent parity updates
Image each individual disk separately, then reassemble the RAID virtually in analysis software (Correct answer)

Correct answer: Image each individual disk separately, then reassemble the RAID virtually in analysis software

Imaging each disk individually and then using forensic software to virtually reconstruct the RAID ensures the original disks are not modified and allows flexible analysis.

Question 27: Which artifact from a Windows system BEST helps determine what files were recently accessed by malware running under a specific user account?

Amcache.hve entries
Event Log ID 4688 entries
NTUSER.DAT RecentDocs and OpenSave MRU keys (Correct answer)
Prefetch file execution counts

Correct answer: NTUSER.DAT RecentDocs and OpenSave MRU keys

The RecentDocs and OpenSave MRU registry keys in NTUSER.DAT record files recently opened or saved by the user account, revealing malware file access patterns.

Question 28: Which Oracle database view provides information about all currently connected sessions and can help identify unauthorized access?

DBA_TABLES
V$DATAFILE
ALL_OBJECTS
V$SESSION (Correct answer)

Correct answer: V$SESSION

V$SESSION is a dynamic performance view in Oracle that displays information about all current database sessions including username, logon time, and program.

Question 29: An investigator finds that the MAC times on key files have been modified. What type of anti-forensic technique was most likely used?

Timestomping (Correct answer)
Steganography
Encryption
Data wiping

Correct answer: Timestomping

Timestomping is an anti-forensic technique where an attacker alters file MAC (Modified, Accessed, Created) timestamps to obscure the timeline.

Question 30: Which Windows registry hive stores the most recently accessed files and applications, useful for establishing user activity timelines?

HKEY_USERS\.DEFAULT
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs (Correct answer)
HKEY_LOCAL_MACHINE\SAM
HKEY_LOCAL_MACHINE\SYSTEM

Correct answer: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

The RecentDocs registry key tracks files recently opened by the user in Windows Explorer, providing a timeline of file access.

Question 31: During a database forensics investigation, an investigator finds rows in a SQL Server table with no matching audit records. What should be checked first?

Firewall logs
The transaction log for direct inserts (Correct answer)
DNS logs
Application event logs

Correct answer: The transaction log for direct inserts

Direct inserts bypassing the application layer appear in the transaction log even if application-level audit triggers did not fire.

Question 32: Which forensic technique involves reviewing the `Last-Modified` and `ETag` HTTP response headers to establish a timeline of web content changes?

Cache-based temporal analysis (Correct answer)
Passive fingerprinting
Deep packet inspection
Fuzzing

Correct answer: Cache-based temporal analysis

Cache-related headers like `Last-Modified` and `ETag` reflect when server-side content was last changed, helping investigators establish a timeline of modifications.

Question 33: In ext4, what is the 'journal' and what mode provides the strongest data integrity?

A SMART monitoring log; enabled in BIOS settings
A backup copy of the superblock; activated via tune2fs -j
A write-ahead log for file system metadata; 'data=journal' mode journals both metadata and data blocks (Correct answer)
A file listing all user logins; enabled by setting mount option 'log=full'

Correct answer: A write-ahead log for file system metadata; 'data=journal' mode journals both metadata and data blocks

ext4's journal records operations before committing them; 'data=journal' mode (writeback < ordered < journal) provides the highest integrity by journaling both data and metadata.

Question 34: What information is stored in the Windows Prefetch files located in C:\Windows\Prefetch?

Pre-fetched web page content stored by Internet Explorer
Application crash dumps collected before system shutdown
Cached DNS query results used to speed up network connections
Executable run count, last run time, and files/directories referenced during execution (Correct answer)

Correct answer: Executable run count, last run time, and files/directories referenced during execution

Prefetch (.pf) files record execution count, last eight run timestamps, and all files and directories loaded during an application's startup, aiding timeline reconstruction.

Question 35: An investigator is presented with a powered-on, unlocked Android device and needs to perform a quick data extraction in the field. To minimize changes to the device and rapidly capture user data like contacts, call logs, and SMS messages, which acquisition method should be prioritized?

JTAG acquisition
Logical acquisition (Correct answer)
Chip-off acquisition
Physical acquisition

Correct answer: Logical acquisition

Logical acquisition is the fastest and least invasive method, ideal for a preliminary field examination of an unlocked device. It copies files and data accessible through the standard user interface, which includes contacts, call logs, and messages. Physical, JTAG, and Chip-off methods are much more invasive, time-consuming, and complex, typically reserved for laboratory analysis.

Question 36: In web attack forensics, what does the presence of `%2e%2e%2f` in a URL request indicate?

Base64-encoded command injection
LDAP injection attempt
XML entity injection
URL-encoded directory traversal (`../`) (Correct answer)

Correct answer: URL-encoded directory traversal (`../`)

`%2e%2e%2f` is the URL-encoded form of `../`, used in directory traversal attacks to escape the web root.

Question 37: Which technique allows a forensic investigator to recover deleted rows from a SQL Server database without a backup?

Index scan
Schema comparison
Log file analysis using transaction log parser (Correct answer)
Full-text search

Correct answer: Log file analysis using transaction log parser

Deleted rows remain in the transaction log until the log is truncated, allowing forensic tools like ApexSQL Log to reconstruct and recover deleted data.

Question 38: Which of the following phases does the aforementioned duties take place in when performing the many phases of cloud forensics, one of which involves resolving functional, operational, and security issues in the cloud ecosystem?

Lof Monitoring
Data and system Recovery
Troubleshooting (Correct answer)
Investigation

Correct answer: Troubleshooting

The troubleshooting phase in cloud forensics involves identifying and resolving various issues that can arise within the complex cloud ecosystem. This includes addressing functional problems, operational inefficiencies, and security vulnerabilities that might impact the integrity of data or the forensic investigation itself. It's a proactive and reactive process to ensure the cloud environment is stable and secure for forensic activities and to overcome challenges in evidence collection.

Question 39: What is 'forensic soundness' in the context of data acquisition?

Using only government-approved forensic software
Completing acquisition within a legally required time window
The absence of audio data from the acquired image
Ensuring the acquisition process does not alter original evidence and can be independently verified (Correct answer)

Correct answer: Ensuring the acquisition process does not alter original evidence and can be independently verified

Forensic soundness means the acquisition method preserves original evidence without modification and produces results that can be independently repeated and verified.

Question 40: Which forensic tool is widely used to parse and examine Outlook PST files during email investigations?

Volatility
Aircrack-ng
Nessus
Kernel OST/PST Viewer or FTK with PST support (Correct answer)

Correct answer: Kernel OST/PST Viewer or FTK with PST support

Tools like Kernel OST/PST Viewer and FTK's email module can parse PST/OST files to recover emails, deleted items, and metadata without requiring Outlook to be installed.

Question 41: What are the following? cloud computing services that deliver hardware, operating systems, and virtual machines. Which a service API may be used to govern.

Platform-as-a-Service (PaaS)
Infrastructure-as-a-Service (IaaS) (Correct answer)
Platform-as-a-Service (PaaS)

Correct answer: Infrastructure-as-a-Service (IaaS)

Infrastructure-as-a-Service (IaaS) provides virtualized computing resources over the internet, including virtual machines, storage, networks, and operating systems. Users have control over the operating systems, applications, and middleware, while the cloud provider manages the underlying infrastructure. This model allows for significant flexibility and scalability, often managed through APIs for programmatic control.

Question 42: What is 'timeline analysis' in file system forensics, and which three NTFS timestamps are primarily used?

Chronologically ordering file system events; primarily uses Modified, Accessed, and Created (MAC) times from $STANDARD_INFORMATION (Correct answer)
Comparing access logs from IDS; uses firewall, proxy, and event log timestamps
Reconstructing database transactions; uses commit, rollback, and checkpoint timestamps
Analyzing network packet captures; uses SYN, ACK, and FIN timestamps

Correct answer: Chronologically ordering file system events; primarily uses Modified, Accessed, and Created (MAC) times from $STANDARD_INFORMATION

Timeline analysis arranges file system events chronologically using MAC times (Modified, Accessed, Created) along with the MFT entry change time to reconstruct attacker or user activity.

Question 43: A company website that hosts a public comment forum has been compromised. An attacker posted a comment containing malicious JavaScript, which is now executing in the browsers of legitimate users who view the forum page, stealing their session cookies. This is a classic example of a Stored XSS attack. Where would an investigator most likely find the original malicious script payload?

In the server's error logs, triggered by failed script execution.
Exclusively in the volatile memory (RAM) of the web server.
Within the web application's database, stored as part of the attacker's forum comment. (Correct answer)
Embedded within a modified JavaScript file in the web root directory.

Correct answer: Within the web application's database, stored as part of the attacker's forum comment.

In a Stored (or Persistent) Cross-Site Scripting (XSS) attack, the malicious script is submitted to the web application and saved in a persistent data store, such as a database. When other users request the page containing the malicious data (e.g., a forum post), the server retrieves the script from the database and includes it in the response, causing it to execute in the victim's browser. Therefore, the primary evidence is the payload stored in the database.

Question 44: A forensic analyst is investigating a compromised web server where the attacker is suspected of having uploaded a web shell. Which of the following is the MOST reliable indicator of a web shell's presence?

A large image file (`.jpg`) with a recent modification timestamp.
A script file in an uploads directory containing functions like `exec()`, `passthru()`, or `system()`. (Correct answer)
An unusually large number of 404 'Not Found' errors in the access logs.
A sudden increase in outbound traffic from the web server on port 80.

Correct answer: A script file in an uploads directory containing functions like `exec()`, `passthru()`, or `system()`.

Web shells are scripts that allow attackers to execute system commands on a server. The most reliable indicator among the choices is finding a script file containing PHP, ASP, or other server-side language functions specifically designed to execute operating system commands, such as `exec()`, `passthru()`, `system()`, or `shell_exec`. The other options are less specific and can be caused by benign activities.

Question 45: Which dcfldd command option generates a hash of the acquired image simultaneously during the imaging process?

--verify
hashlog= (Correct answer)
conv=hash
bs=hashmode

Correct answer: hashlog=

dcfldd's 'hashlog=' option writes a running hash (MD5 or SHA-1) to a specified log file as the image is being created, enabling simultaneous acquisition and verification.

Question 46: In database forensics, which log file type records every transaction and database modification for SQL Server?

Event log
Audit log
Error log
Transaction log (.ldf) (Correct answer)

Correct answer: Transaction log (.ldf)

The SQL Server transaction log (.ldf) records all transactions and database modifications, making it critical for forensic timeline reconstruction.

Question 47: Which tool would a CHFI investigator use to detect anti-forensic timestomping performed by malware on a Windows NTFS system?

Comparing $STANDARD_INFORMATION and $FILE_NAME timestamps in the MFT (Correct answer)
Running sigcheck on the affected files
Comparing file hashes against known-good databases
Checking Windows Event Log ID 4663

Correct answer: Comparing $STANDARD_INFORMATION and $FILE_NAME timestamps in the MFT

Timestomping modifies $STANDARD_INFORMATION timestamps but often leaves $FILE_NAME timestamps untouched, so comparing both MFT attributes reveals manipulation.

Question 48: During a forensic investigation, which principle ensures that evidence collected is admissible in a court of law?

Chain of custody (Correct answer)
Evidence compression
Log aggregation
Data normalization

Correct answer: Chain of custody

Chain of custody documents every person who handled the evidence, ensuring its integrity and admissibility in court.

Question 49: In the context of wireless network forensics, what does a 'deauthentication flood' attack leave as evidence in wireless packet captures?

Elevated data frame retransmission rates
High volume of deauthentication frames from a spoofed BSSID (Correct answer)
Duplicate SSID beacons
Excessive probe request frames

Correct answer: High volume of deauthentication frames from a spoofed BSSID

A deauthentication flood generates massive quantities of 802.11 deauth management frames with a spoofed source BSSID, forcing clients offline; these frames are clearly visible in wireless captures.

Question 50: During network-based forensic acquisition, which protocol is commonly used to stream a disk image over the network?

HTTP multipart file upload
FTP with passive mode
TFTP with block-size negotiation
netcat or dcfldd piped over SSH (Correct answer)

Correct answer: netcat or dcfldd piped over SSH

Forensic examiners commonly pipe dd or dcfldd output through netcat or SSH to transfer disk images over a network to a remote storage server.

Question 51: What is the significance of the SQL Server 'default trace' in a forensic investigation?

It monitors CPU usage by queries
It captures database object changes, login failures, and DBCC events by default without configuration (Correct answer)
It monitors network bandwidth usage
It logs all SELECT queries by default

Correct answer: It captures database object changes, login failures, and DBCC events by default without configuration

SQL Server's default trace automatically captures key security and administrative events like object creation/deletion, login failures, and DBCC commands without requiring manual configuration.

Question 52: A forensic image of a compromised host shows that the malware modified the hosts file to redirect antivirus update domains to 127.0.0.1. What is the forensic artifact path for the Windows hosts file?

C:\Windows\System32\drivers\etc\hosts (Correct answer)
C:\ProgramData\Microsoft\Windows\hosts
C:\Windows\SysWOW64\drivers\hosts
C:\Windows\System32\etc\hosts

Correct answer: C:\Windows\System32\drivers\etc\hosts

The Windows hosts file is located at C:\Windows\System32\drivers\etc\hosts and is a common target for malware to block security tool updates by overriding DNS resolution.

Question 53: An investigator finds ARP replies with no preceding ARP request in a packet capture. This is a sign of:

DHCP spoofing
Normal router behavior
DNS hijacking
ARP cache poisoning (Correct answer)

Correct answer: ARP cache poisoning

Unsolicited ARP replies (gratuitous ARP) sent by an attacker are the primary mechanism of ARP cache poisoning, used to associate the attacker's MAC with a legitimate IP.

Question 54: Which anti-forensics technique involves an attacker deliberately planting false digital evidence to mislead forensic investigators?

Secure deletion
Log rotation
Data carving
Evidence fabrication (anti-forensic deception) (Correct answer)

Correct answer: Evidence fabrication (anti-forensic deception)

Evidence fabrication involves planting false or misleading digital artifacts to confuse investigators, waste forensic resources, or frame innocent parties for the crime.

Question 55: What is the Amcache.hve file and how does it differ from Shimcache in Windows forensics?

Amcache records failed application launches while Shimcache records successful ones
Amcache stores application settings while Shimcache tracks DLL injection events
Amcache is a registry hive storing SHA1 hashes and install/execution metadata; Shimcache stores execution timestamps without hashes (Correct answer)
Amcache is a RAM-based cache while Shimcache is stored on disk; both record network connections

Correct answer: Amcache is a registry hive storing SHA1 hashes and install/execution metadata; Shimcache stores execution timestamps without hashes

Amcache.hve stores executable metadata including SHA1 file hash, enabling identification of specific malware binaries, while Shimcache tracks execution without storing hashes.

Question 56: Which disk partitioning scheme supports more than 2 TB volumes and up to 128 primary partitions on Windows?

VBR
GPT (Correct answer)
MBR
APT

Correct answer: GPT

GUID Partition Table (GPT) supports drives larger than 2 TB and allows up to 128 primary partitions, overcoming MBR limitations.

Question 57: Which hashing algorithm is recommended by NIST for generating forensic integrity hashes of email evidence files such as PST archives?

MD5 alone
SHA-256 or SHA-3 (Correct answer)
CRC32
Base64 encoding

Correct answer: SHA-256 or SHA-3

NIST recommends SHA-256 or stronger algorithms for forensic evidence integrity verification, as MD5 and SHA-1 are considered cryptographically weak and vulnerable to collision attacks.

Question 58: In NTFS, which metadata file records changes to the file system including file creation, modification, and deletion, and is essential for timeline analysis?

$Boot
$LogFile
$UsnJrnl:$J (Correct answer)
$Bitmap

Correct answer: $UsnJrnl:$J

The NTFS Change Journal ($UsnJrnl:$J) records file system changes with USN (Update Sequence Number) entries, enabling chronological reconstruction of file activity.

Question 59: When analyzing a suspect's network traffic, an investigator observes large ICMP packets with payloads containing structured data. This suggests:

Fragmentation reassembly issues
Normal network diagnostics
IPv6 transition mechanism
ICMP tunneling for covert data exfiltration (Correct answer)

Correct answer: ICMP tunneling for covert data exfiltration

ICMP tunneling embeds data inside ICMP echo request/reply payloads, exploiting protocols often allowed through firewalls to create a covert communication channel.

Question 60: Which Android acquisition method provides the most complete data extraction, including deleted files, but requires the device to be rooted?

Logical extraction via USB
ADB backup
Cloud sync extraction
Physical acquisition (Correct answer)

Correct answer: Physical acquisition

Physical acquisition creates a bit-for-bit image of the storage medium and can recover deleted data, but typically requires root access.

Question 61: Which tool is specifically designed for acquiring volatile memory (RAM) on a live Windows system?

WinPmem (Correct answer)
dcfldd
FTK Imager Lite (disk only mode)
Autopsy

Correct answer: WinPmem

WinPmem is an open-source Windows memory acquisition tool that dumps physical RAM to a file for forensic analysis of volatile data.

Question 62: What is the Device Configuration Overlay (DCO) on ATA hard drives?

A firmware update mechanism for hard drives
A diagnostic partition created by the manufacturer
The error correction code area on each track
A hidden area similar to HPA that restricts features and capacity visible to the OS and BIOS (Correct answer)

Correct answer: A hidden area similar to HPA that restricts features and capacity visible to the OS and BIOS

DCO is an ATA feature that allows manufacturers or users to permanently hide disk capacity and features; like HPA, it requires special ATA commands to detect.

Question 63: What distinguishes a 'selective' acquisition from a 'full physical' acquisition?

Selective acquisition targets specific files or folders based on relevance criteria (Correct answer)
Selective acquisition uses hardware write blockers exclusively
Selective acquisition always produces a compressed output
Selective acquisition copies every bit of the drive including HPA

Correct answer: Selective acquisition targets specific files or folders based on relevance criteria

Selective acquisition collects only specific, forensically relevant files or directories rather than imaging the entire drive.

Question 64: A suspect claims a file was never opened. Which forensic artifact would BEST refute or support this claim on a Windows system?

Windows Event Log (Security)
Registry hive creation dates
MFT file size records
Prefetch files and LNK files (shell items) (Correct answer)

Correct answer: Prefetch files and LNK files (shell items)

Prefetch files record application execution history, and LNK (shortcut) files record recently accessed files, directly countering or corroborating the suspect's claim.

Question 65: Which analysis technique examines the timing intervals between network packets to identify covert communication channels even when content is encrypted?

Hash-based file carving
Traffic timing analysis / inter-arrival time analysis (Correct answer)
Banner grabbing
Signature-based detection

Correct answer: Traffic timing analysis / inter-arrival time analysis

Traffic timing analysis examines inter-packet arrival times to detect patterns that may indicate covert channels where timing itself encodes information, bypassing content-level inspection.

Question 66: What is the primary purpose of using 'segment files' (e.g., E01.E01, E01.E02...) during forensic acquisition?

To accommodate file system size limits and enable splitting across multiple storage media (Correct answer)
To allow different examiners to work on separate segments simultaneously
To encrypt each segment with a different key for security
To allow parallel hashing of each segment separately

Correct answer: To accommodate file system size limits and enable splitting across multiple storage media

Forensic image segmentation splits large images into manageable chunks to work within file system limitations (e.g., FAT32's 4GB limit) or to span multiple storage devices.

Question 67: During investigation of a data breach, an analyst finds large volumes of traffic to a cloud storage IP during off-hours. What forensic step should be taken next?

Submit the IP to a threat intelligence feed
Correlate the traffic with user authentication logs to identify which account or process initiated the transfers (Correct answer)
Immediately block the destination IP at the firewall
Reimage the potentially affected systems

Correct answer: Correlate the traffic with user authentication logs to identify which account or process initiated the transfers

Correlating suspicious network traffic with authentication and process logs identifies the specific user account or process responsible for the transfers, establishing attribution before taking remediation steps.

Question 68: What tool can a CHFI investigator use to read and analyze MySQL binary logs during a database forensic investigation?

mysqlcheck
mysql_upgrade
mysqldump
mysqlbinlog (Correct answer)

Correct answer: mysqlbinlog

The mysqlbinlog utility reads MySQL binary log files, allowing investigators to reconstruct all SQL statements executed on the server.

Question 69: A forensic investigator needs to determine when a specific stored procedure was last modified in SQL Server. Which catalog view should they query?

sys.columns
sys.indexes
sys.partitions
sys.objects (Correct answer)

Correct answer: sys.objects

The sys.objects catalog view contains a modify_date column that records the last modification timestamp for all database objects including stored procedures.

Question 70: An investigator finds that an attacker used `UNION SELECT NULL, username, password FROM users--` in a web request. What is this technique called?

Time-based SQL injection
UNION-based SQL injection (Correct answer)
Error-based SQL injection
Blind SQL injection

Correct answer: UNION-based SQL injection

UNION-based SQL injection appends a UNION SELECT statement to extract data from other database tables into the application's response.

Question 71: During a ransomware investigation on a Windows system, which registry artifact would help determine if the Volume Shadow Copies were deleted by the attacker?

System event log combined with examining vssadmin.exe in the Shimcache or Amcache (Correct answer)
Security event log event ID 524 for shadow copy deletion
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
HKLM\SYSTEM\CurrentControlSet\Services\VSS\Parameters

Correct answer: System event log combined with examining vssadmin.exe in the Shimcache or Amcache

Checking Shimcache/Amcache for vssadmin.exe or wmic.exe execution, combined with System log entries, reveals whether shadow copies were deliberately purged.

Question 72: In FAT32, what is the maximum supported file size?

4 GB minus 1 byte (Correct answer)
8 GB
16 TB
2 GB

Correct answer: 4 GB minus 1 byte

FAT32 uses a 32-bit file size field, limiting individual files to 4 GB minus 1 byte (4,294,967,295 bytes).

Question 73: A forensic investigator captures a packet with TTL value of 1. What does this most likely indicate?

The packet was crafted to expire after one hop (Correct answer)
The packet originated from a local subnet
The packet is encrypted
The packet uses IPv6

Correct answer: The packet was crafted to expire after one hop

A TTL of 1 means the packet will be dropped after crossing one router, often seen in traceroute probes or deliberately crafted reconnaissance packets.

Question 74: During a web forensics investigation, an analyst discovers requests to `/admin/../../../etc/shadow`. What evasion technique is the attacker using?

Path traversal disguised within a valid-looking path (Correct answer)
HTTP verb tampering
Path traversal with null byte injection
Parameter pollution

Correct answer: Path traversal disguised within a valid-looking path

The attacker embeds `../` sequences within an apparently legitimate path to evade simple blacklist filters that only check the beginning of the URL.

Question 75: During investigation of a web compromise, the analyst finds `/etc/passwd` content in a server response. Which vulnerability was likely exploited?

Insecure deserialization
Open redirect
Local file inclusion (LFI) (Correct answer)
Cross-site request forgery (CSRF)

Correct answer: Local file inclusion (LFI)

Local File Inclusion (LFI) allows an attacker to read arbitrary files on the server, such as `/etc/passwd`, by manipulating file path parameters.

Question 76: A ransomware sample generates a unique key per victim and sends it to a C2 server before encrypting files. If the C2 is taken down before the key is transmitted, what is the most likely forensic implication?

Decryption may be possible from memory artifacts (Correct answer)
Backup shadow copies will remain intact
The ransomware will fail to encrypt any files
The encryption key is permanently lost

Correct answer: Decryption may be possible from memory artifacts

If the key was generated in memory before transmission, forensic memory analysis may recover it from RAM dumps or hibernation files before it is overwritten.

Question 77: Which Windows forensic artifact stores evidence of files that were deleted via the Windows GUI (dragged to Recycle Bin) including original file path and deletion time?

$Recycle.Bin\$I files on the volume root (Correct answer)
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket
C:\Windows\System32\recycler.dat
$Recycle.Bin\$R files on the volume root

Correct answer: $Recycle.Bin\$I files on the volume root

$I files in $Recycle.Bin store the original file path, file size, and deletion timestamp for each deleted item, while $R files hold the actual deleted content.

Question 78: If a crime is committed in a cloud environment, identify the specific offense that was committed there.

Cloud as a subject (Correct answer)
Cloud as a tool
Cloud as an object

Correct answer: Cloud as a subject

When a crime is committed *in* a cloud environment, meaning the cloud itself is the target or location of the criminal activity (e.g., data theft from a cloud server, unauthorized access to cloud resources), it is categorized as 'Cloud as a Subject.' This distinguishes it from using the cloud as a tool to commit a crime elsewhere or the cloud being the object of a crime (e.g., the cloud provider itself being attacked).

Question 79: Cloud forensics are divided into nine main groups, according to NIST.

True
False (Correct answer)

Correct answer: False

This statement is false. NIST (National Institute of Standards and Technology) has published extensive guidelines and frameworks for cloud computing and forensics, but they do not categorize cloud forensics into a specific number like 'nine main groups.' NIST documents typically define cloud deployment models, service models, and outline challenges and principles for cloud forensics, rather than a fixed number of groups.

Question 80: Which Windows registry key stores the time zone setting of the system, which is critical for accurate timeline normalization during forensic analysis?

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones
HKCU\Control Panel\International\TimeZone
HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation (Correct answer)
HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Parameters

Correct answer: HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation

The TimeZoneInformation key stores the active time zone bias values used by Windows, essential for converting system timestamps to UTC for accurate correlation.

Question 81: In social media forensics, what is the significance of metadata embedded in images posted on social platforms?

It contains the user's password hash
It only contains image resolution data
It only contains file size information
It may contain GPS coordinates, device model, and timestamp revealing the photo's origin (Correct answer)

Correct answer: It may contain GPS coordinates, device model, and timestamp revealing the photo's origin

EXIF metadata in images can include GPS coordinates, camera model, and capture timestamp, though many social platforms strip EXIF data — investigators must check if the platform preserves it.

Question 82: Which Windows artifact tracks files and folders that a user has recently accessed via Windows Explorer and can be found in the user profile?

C:\Users\<user>\AppData\Local\Microsoft\Windows\History\
C:\ProgramData\Microsoft\Windows\Recent Documents\
C:\Windows\System32\Recent\
C:\Users\<user>\AppData\Roaming\Microsoft\Windows\Recent\ (Correct answer)

Correct answer: C:\Users\<user>\AppData\Roaming\Microsoft\Windows\Recent\

The Recent folder in the user's AppData contains LNK shortcut files pointing to recently accessed files and folders, automatically maintained by the shell.

Question 83: Which anti-forensics technique involves modifying or deleting system log files to erase evidence of an attacker's activities?

Steganography
Timestomping
Data carving
Log tampering (log sanitization) (Correct answer)

Correct answer: Log tampering (log sanitization)

Log tampering involves modifying or deleting system, application, or security log files to erase records of an attacker's actions and prevent forensic reconstruction of events.

Question 84: A banking trojan hooks the browser's SSL functions to capture plaintext credentials before encryption. What technique is this?

Man-in-the-browser (MitB) attack (Correct answer)
Session hijacking
ARP poisoning
SSL stripping

Correct answer: Man-in-the-browser (MitB) attack

MitB malware injects into the browser process and hooks SSL/TLS functions or form submission handlers to steal credentials before they are encrypted.

Question 85: A CHFI analyst is reviewing Apache logs and sees a User-Agent string containing `sqlmap/1.6`. What should the analyst conclude?

A legitimate SEO crawler indexed the site
An automated SQL injection tool targeted the application (Correct answer)
A vulnerability scanner performed a general audit
A DDoS bot flooded the server

Correct answer: An automated SQL injection tool targeted the application

SQLMap is an open-source automated SQL injection tool, and its presence in the User-Agent field confirms it was used against the application.

Question 86: What does the MFT entry attribute $DATA contain in NTFS?

The parent directory reference
The file's security descriptor and ACL
The actual file content or data runs pointing to the file's data clusters (Correct answer)
The file's MAC timestamps

Correct answer: The actual file content or data runs pointing to the file's data clusters

The $DATA attribute in an MFT entry either contains the file's data directly (resident) or data runs that map to the clusters holding the file's content (non-resident).

Question 87: Which SQL Server feature, when enabled, records all login attempts including failed ones, and is critical for forensic investigations?

Database Mirroring
SQL Server Audit (Correct answer)
Replication
Change Data Capture

Correct answer: SQL Server Audit

SQL Server Audit tracks and logs SQL Server and database-level events including successful and failed login attempts, providing a forensic audit trail.

Question 88: What is the forensic significance of identifying a 'long tail' domain (very low query frequency) in DNS logs?

It may indicate a dynamically generated domain used by malware (DGA) (Correct answer)
It indicates a misconfigured resolver
It indicates a popular CDN endpoint
It is a sign of legitimate load balancing

Correct answer: It may indicate a dynamically generated domain used by malware (DGA)

Domain Generation Algorithm (DGA) malware produces rarely-seen algorithmically generated domains; these appear as 'long tail' entries with very low query counts in DNS logs.

Question 89: Which artifact on a Windows system stores evidence of web-based email access (e.g., Gmail via browser) useful in email forensics?

Windows Event Logs only
Registry hives only
Prefetch files only
Browser cache, history, and cookies (Correct answer)

Correct answer: Browser cache, history, and cookies

Browser cache files may contain cached email content and attachments, browser history shows Gmail/webmail access timestamps, and cookies can reveal authenticated sessions.

Question 90: Which Volatility 3 plugin would an investigator use to extract network connections (including those in CLOSE_WAIT and TIME_WAIT states) from a Windows memory image?

windows.netstat
windows.sockets
windows.netscan (Correct answer)
windows.connections

Correct answer: windows.netscan

windows.netscan scans memory pools for network structures and recovers connections in various TCP states including those that windows.netstat would miss.

Question 91: An investigator finds a suspicious DLL in C:\Windows\System32 that is loaded by svchost.exe but does not appear in any Microsoft catalog. The BEST first step to assess this DLL is to:

Run strings against it and review the output
Submit its SHA-256 hash to VirusTotal and check its digital signature (Correct answer)
Check the DLL against the Prefetch execution record
Delete it immediately and restart the service

Correct answer: Submit its SHA-256 hash to VirusTotal and check its digital signature

Checking the hash against VirusTotal and verifying the code-signing certificate are non-destructive, rapid triage steps that establish whether the DLL is known malicious before deeper analysis.

Question 92: A forensic examiner finds evidence of a malware using named pipes for inter-process communication. Which Windows Sysinternals tool would BEST enumerate active named pipes?

PipeList (Correct answer)
Process Monitor
Autoruns
TCPView

Correct answer: PipeList

PipeList from Sysinternals enumerates all named pipes on a Windows system, making it ideal for identifying malicious IPC channels used by malware.

Question 93: A network forensic analyst is examining a packet capture (.pcap) file and observes a three-way handshake followed by an encrypted exchange between a client and a server. Suddenly, the analyst sees a large number of TCP packets with the RST (Reset) flag set being sent from the server to the client. What does this pattern most likely indicate?

An abrupt termination of the TCP connection, possibly by a firewall or Intrusion Prevention System (IPS). (Correct answer)
A normal termination of the connection using the FIN flag.
A successful file transfer was completed using FTP.
A Distributed Denial of Service (DDoS) attack using a TCP SYN flood.

Correct answer: An abrupt termination of the TCP connection, possibly by a firewall or Intrusion Prevention System (IPS).

A TCP RST (Reset) flag is used to immediately terminate a connection. While it can occur for normal reasons like an application crash, a sudden flood of RST packets after a valid connection has been established is often indicative of an external system, like a firewall or an IPS, forcibly closing the session because it detected suspicious or malicious traffic. A normal termination uses the FIN flag, and a SYN flood would consist of many SYN packets without a completed handshake.

Question 94: In Windows forensics, what does the acronym LNK file refer to and why is it forensically significant?

A Windows shortcut file that records metadata about accessed files including original path and timestamps (Correct answer)
A linked database file used by SQL Server to store transaction logs
A network configuration file storing linked DNS resolver entries
A locked file handle record created when a file is opened exclusively

Correct answer: A Windows shortcut file that records metadata about accessed files including original path and timestamps

LNK (shortcut) files automatically created in Recent Items contain metadata about accessed files including MAC times, file size, and original volume serial number.

Question 95: Which field in an IIS web server log records the action method used in an HTTP request (GET, POST, PUT, etc.)?

sc-status
cs-bytes
cs-uri-stem
cs-method (Correct answer)

Correct answer: cs-method

The `cs-method` field in IIS W3C logs records the HTTP method (verb) used in the client's request.

Question 96: Which tool is commonly used in Linux forensics to recover deleted files from an ext4 file system by scanning unallocated inode entries?

blkid
mkfs
extundelete (Correct answer)
fdisk

Correct answer: extundelete

extundelete is a Linux tool that analyzes ext3/ext4 journal and inode tables to recover deleted files from unallocated space.

Question 97: A CHFI is called to investigate a potential data breach. The first step taken is to interview stakeholders, identify potentially affected systems (laptops, servers, mobile devices), and define the scope of the investigation. Which phase of the forensic process does this activity represent?

Preservation
Identification (Correct answer)
Analysis
Reporting

Correct answer: Identification

The Identification phase is the initial step in the digital forensic process. It involves recognizing and determining what evidence is present, where it is stored, and what format it is in. This includes identifying all potential sources of digital evidence like computers, mobile devices, and cloud storage.

Question 98: What is 'write blocking' and which layer does a software write blocker operate at?

Physically disconnects the write pin; operates at the SATA controller layer
Monitors SMART data to detect write operations
Intercepts write commands via OS driver or API interception before they reach the drive (Correct answer)
Encrypts all writes to prevent data modification

Correct answer: Intercepts write commands via OS driver or API interception before they reach the drive

Software write blockers intercept OS-level write commands (via drivers or system call hooks) before they reach the storage device, preventing data modification during examination.

Question 99: A forensic investigator notices repeated POST requests to `/wp-login.php` with hundreds of different passwords. What attack type is this?

Brute-force attack (Correct answer)
Password spraying
Credential stuffing
Dictionary attack

Correct answer: Brute-force attack

Repeated login attempts against a single account with many passwords characterizes a brute-force attack.

Question 100: What forensic information can be extracted from Windows Jump Lists located in AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations?

Recently and frequently accessed files per application, including files on removed media (Correct answer)
Browser history and cookie data for all installed web browsers
Cached passwords for recently used network shares and web sites
Scheduled task definitions and their last execution timestamps

Correct answer: Recently and frequently accessed files per application, including files on removed media

Jump Lists store per-application MRU entries (AppIDs) linking recently opened files, revealing what an application accessed even after files are deleted.

Question 101: Which Windows artifact stores the last 10 commands typed into the Run dialog box and is found in the registry?

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU (Correct answer)
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
HKCU\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit

Correct answer: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU

The RunMRU key stores the most recently used commands typed into the Run dialog, useful for tracking attacker activity.

Question 102: Which Windows registry hive is stored in the file %SystemRoot%\System32\config\SAM and what forensic information does it contain?

HKLM\SOFTWARE — stores installed application settings and license keys
HKLM\SECURITY — stores local security policies and cached credentials
HKCU — stores the current user's personal preferences and recent documents
HKLM\SAM — stores local user account names and password hashes (Correct answer)

Correct answer: HKLM\SAM — stores local user account names and password hashes

The SAM hive stores local user accounts and their NTLM/LM password hashes, which can be extracted and cracked offline by investigators or attackers.

Question 103: Which of the following best describes the cloud deployment paradigm used for shared infrastructure between multiple enterprises with common concerns (security, compliance, jurisdiction, etc.)?

Private Cloud
Community Cloud (Correct answer)
Hybrid Cloud
Public Cloud

Correct answer: Community Cloud

A community cloud deployment model is designed for a specific community of organizations that share common concerns, such as security requirements, compliance regulations, or jurisdiction. It can be managed internally or by a third party and hosted either internally or externally. This model allows for shared infrastructure and resources while addressing the unique needs of the participating entities, offering a balance between public and private cloud benefits.

Question 104: During behavioral analysis in a sandbox, a malware sample calls CreateRemoteThread targeting explorer.exe. What is the malware most likely attempting?

Process injection to evade detection (Correct answer)
Deleting Volume Shadow Copies
Establishing a reverse shell listener
Privilege escalation to SYSTEM

Correct answer: Process injection to evade detection

CreateRemoteThread is a common process injection API that injects and executes malicious code within the address space of a legitimate host process like explorer.exe.

Question 105: Which Windows artifact records the applications that were set to auto-start at system boot and can reveal persistence mechanisms used by malware?

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run (Correct answer)
HKLM\SYSTEM\CurrentControlSet\Control\CrashControl
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit

Correct answer: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

The Run key under both HKLM and HKCU is a common persistence location where programs are registered to execute automatically at every user login.

Question 106: An investigator wants to determine all websites visited by a user using only proxy server logs. Which log field is most critical for this analysis?

Bytes transferred
Client IP address
HTTP response code
Requested URL or CONNECT hostname (Correct answer)

Correct answer: Requested URL or CONNECT hostname

The requested URL or CONNECT hostname in proxy logs directly identifies which web resources the client accessed, making it the primary field for website visit reconstruction.

Question 107: During an email forensics investigation, what does a missing or broken DMARC alignment indicate?

The email may be a phishing attempt or spoofed to impersonate a legitimate domain (Correct answer)
The email was encrypted end-to-end
The email server is overloaded
The email was sent via a mobile device

Correct answer: The email may be a phishing attempt or spoofed to impersonate a legitimate domain

Failed DMARC alignment indicates that SPF and/or DKIM checks failed, suggesting the email may be spoofed or sent by an unauthorized server impersonating the domain.

Question 108: What artifact would BEST help determine whether an attacker successfully exploited a web shell uploaded to a server?

SSL certificate expiration dates
Web server access logs showing GET/POST requests to the shell file (Correct answer)
IDS alert timestamps
Firewall deny rules

Correct answer: Web server access logs showing GET/POST requests to the shell file

Access log entries showing requests to the web shell file with resulting 200 responses confirm the shell was accessed and used.

Question 109: Which type of malware analysis involves executing a suspicious file in an isolated environment to observe its behavior without reverse engineering its code?

Signature-based analysis
Code review
Static analysis
Dynamic analysis (Correct answer)

Correct answer: Dynamic analysis

Dynamic analysis runs malware in a controlled sandbox to capture runtime behaviors such as network connections, file drops, and registry modifications.

Question 110: The Inspect Pane can be used to view the file content of evidence files. To display file content, the View pane offers a number of tabs. Which of these tabs offers native views of the formats that Oracle supports outside of its own technology?

Hex tab
Text tab
Picture tab
Doc tab (Correct answer)

Correct answer: Doc tab

The Doc tab in forensic tools like EnCase is designed to provide native views of various document formats, including those created by applications like Microsoft Office, Adobe PDF, and other common business software. It allows investigators to view these files as they would appear in their original applications, without needing the applications themselves. This functionality is crucial for examining a broad range of document types, including those that might be supported by or interact with Oracle technologies, but are not exclusively Oracle's proprietary format.

Question 111: A suspect's laptop uses full-disk BitLocker encryption and is found powered ON. What is the BEST immediate action to preserve decrypted data?

Shut it down immediately to prevent data changes
Remove the drive and image it in a write blocker
Wait for BitLocker to time out and re-encrypt
Perform a live RAM acquisition before powering off (Correct answer)

Correct answer: Perform a live RAM acquisition before powering off

Performing a live RAM acquisition captures the BitLocker encryption keys stored in volatile memory before the machine is powered off.

Question 112: A wiper malware overwrites the first 512 bytes of every connected drive. What critical structure is it targeting?

Master Boot Record (MBR) (Correct answer)
Volume Boot Record (VBR)
NTFS $Boot file
GUID Partition Table (GPT) header

Correct answer: Master Boot Record (MBR)

The Master Boot Record occupies the first 512 bytes of a disk and contains the bootloader code and partition table; overwriting it renders the system unbootable.

Question 113: Which acquisition order principle, based on volatility, should guide what is collected FIRST during live forensic response?

Disk first because it is the most stable evidence
CPU registers and cache, then RAM, then swap space, then disk (Correct answer)
Hard drive contents, then RAM, then network connections
Log files first because they will be overwritten by new events

Correct answer: CPU registers and cache, then RAM, then swap space, then disk

The order of volatility (RFC 3227) dictates collecting the most transient data first: CPU/cache → RAM → swap → network state → running processes → disk → archival media.

Question 114: Which tool is commonly used by CHFI investigators to analyze email headers and trace email origins?

MXToolbox Email Header Analyzer (Correct answer)
Metasploit
Nmap
Wireshark

Correct answer: MXToolbox Email Header Analyzer

MXToolbox Email Header Analyzer parses raw email headers to display the routing path, timestamps, and originating IP addresses in an investigator-friendly format.

Question 115: Which Oracle audit trail type stores audit records in OS files rather than within the database itself?

Fine-grained auditing
OS audit trail (Correct answer)
Database audit trail
Unified auditing

Correct answer: OS audit trail

The OS audit trail writes audit records to the operating system audit log, making them harder for a compromised DBA to tamper with.

Question 116: A forensic investigator is attempting to extract data from a severely damaged smartphone that will not power on. The device's motherboard is cracked, making JTAG and ISP methods impossible. Which of the following is the most appropriate, albeit destructive, technique to attempt data recovery?

Manual acquisition
File system acquisition
Chip-off (Correct answer)
Logical acquisition

Correct answer: Chip-off

Chip-off is an advanced, invasive forensic technique where the flash memory chip is physically de-soldered from the circuit board and read with a specialized device. It is considered a last resort when the device is non-functional and other methods like JTAG are not viable due to physical damage. The other methods require a functioning or at least partially functioning device.

Question 117: When imaging a solid-state drive (SSD), which characteristic makes forensic acquisition more challenging than with HDDs?

SSDs use proprietary encryption that cannot be bypassed
SSDs do not support the ATA interface required for forensic tools
SSDs store data in volatile memory that disappears when powered off
Wear leveling and TRIM commands can overwrite deleted data, reducing recoverability (Correct answer)

Correct answer: Wear leveling and TRIM commands can overwrite deleted data, reducing recoverability

SSD controllers use wear leveling to distribute writes, and TRIM actively zeroes deleted blocks, making traditional deleted-data recovery difficult on SSDs.

Question 118: What type of attack involves inserting malicious SQL code into a query to extract or manipulate database data, and is commonly investigated in CHFI database forensics?

ARP poisoning
Buffer overflow
Cross-site scripting
SQL injection (Correct answer)

Correct answer: SQL injection

SQL injection attacks insert malicious SQL statements into input fields to manipulate database queries, often leaving traces in web server logs and database logs.

Question 119: In email forensics, what does the 'X-Originating-IP' header reveal?

The antivirus scanner IP
The destination mail server IP
The IP address of the client that originally submitted the email (Correct answer)
The DNS server IP used for delivery

Correct answer: The IP address of the client that originally submitted the email

The X-Originating-IP header, added by some mail providers, records the IP address of the device that originally sent the email, which can identify the sender's location.

Question 120: During an investigation into a suspected malware infection, a CHFI analyst discovers an unusually high volume of DNS queries for various, seemingly random subdomains of a single parent domain (e.g., `axj34.evil.com`, `b9dk1.evil.com`). The compromised host is not receiving valid IP addresses in response. This pattern is a strong indicator of which activity?

A DNS amplification attack originating from the compromised host.
A Distributed Denial of Service (DDoS) attack against the organization's DNS server.
A DNS zone transfer attempt to enumerate all hosts in the domain.
Data exfiltration or Command and Control (C2) communication using DNS tunneling. (Correct answer)

Correct answer: Data exfiltration or Command and Control (C2) communication using DNS tunneling.

This pattern is a classic indicator of DNS tunneling, a technique used to bypass firewalls by encoding data into DNS queries. Malware on a compromised host encodes stolen data or C2 communications into the subdomain portion of a DNS query, which is then sent to a malicious DNS server controlled by the attacker. The high volume of queries with long, randomized subdomains is a key giveaway.

Question 121: A forensic examiner is acquiring a drive from a Mac with Apple Silicon (M1/M2). What is a key challenge compared to Intel-based Macs?

Apple Silicon encrypts RAM, preventing all live acquisition
M1/M2 drives use SCSI, which is incompatible with standard write blockers
Target Disk Mode is not available; acquisition requires OS-level tools or JTAG methods (Correct answer)
M1/M2 Macs use a different file system (APFS) that no tools support

Correct answer: Target Disk Mode is not available; acquisition requires OS-level tools or JTAG methods

Apple Silicon Macs removed Target Disk Mode, making traditional hardware-based acquisition impossible and requiring alternative methods like using Apple Configurator or specialized JTAG hardware.

Question 122: A forensic examiner finds a file with a .jpg extension but the hex viewer shows the magic bytes 'PK\x03\x04'. What does this indicate?

The file extension was deliberately changed to hide that it is a ZIP archive (Correct answer)
The JPEG was compressed with PK encryption before storage
The file is a corrupted JPEG and cannot be recovered
The file is a Windows Portable Key certificate, not an image

Correct answer: The file extension was deliberately changed to hide that it is a ZIP archive

Magic bytes 'PK\x03\x04' identify a ZIP archive; a mismatched extension indicates deliberate file masquerading to evade casual inspection.

Question 123: During a live forensic acquisition, an investigator wants to capture volatile memory. Which tool is most appropriate?

WinPmem (Correct answer)
Autopsy
Volatility
FTK Imager

Correct answer: WinPmem

WinPmem is a memory acquisition tool used to dump live RAM to a file on Windows systems.

Question 124: In NTFS, which metadata file stores the location of all other metadata files and is always located at the beginning of the volume?

$LogFile
$Boot
$Bitmap
$MFT (Correct answer)

Correct answer: $MFT

The $MFT (Master File Table) is the first file in an NTFS volume and contains records for every file and directory on the volume.

Question 125: Which of the following best describes the primary goal of performing reverse engineering on a malware sample during a forensic investigation?

To determine the date and time the malware was compiled by the author.
To create a valid cryptographic hash of the malicious file for an IOC database.
To safely execute the malware in a sandbox to observe its network traffic.
To understand the malware's precise functionality, algorithms, and capabilities by analyzing its disassembled code. (Correct answer)

Correct answer: To understand the malware's precise functionality, algorithms, and capabilities by analyzing its disassembled code.

Reverse engineering involves disassembling or decompiling a binary to analyze its assembly code. The ultimate goal is to understand exactly what the program does, how its algorithms work (e.g., encryption routines, C2 communication protocols), and what its full capabilities are. This provides a much deeper understanding than static or dynamic analysis alone.

Question 126: A forensic analyst discovers that malware is using DNS TXT records to receive commands. This is an example of which C2 technique?

Fast-flux DNS evasion
Domain generation algorithm (DGA)
DNS cache poisoning
DNS tunneling for command-and-control (Correct answer)

Correct answer: DNS tunneling for command-and-control

DNS tunneling encodes C2 commands and data within DNS query/response fields such as TXT records, allowing covert communication that often bypasses firewall rules permitting DNS traffic.

Question 127: Which email authentication mechanism adds a digital signature to outgoing emails that can be verified to confirm the sender's domain integrity?

DKIM (Correct answer)
DMARC
SPF
MX record

Correct answer: DKIM

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to the email header that allows receivers to verify the email was not altered and originated from the claimed domain.

Question 128: When a cloud acts like an object, it is committing the crime of cloud as object.

True
False (Correct answer)

Correct answer: False

This statement is false. When a cloud acts as an object, it means the cloud itself is the victim of the crime, such as a denial-of-service attack against a cloud provider's infrastructure or data being stolen from cloud storage. The cloud is not 'committing' the crime; rather, it is the entity being acted upon by the criminal, suffering the impact of the malicious activity.

Question 129: An investigator is analyzing a botnet C2 protocol and finds that the malware generates domain names using the current date as a seed for a pseudo-random algorithm. This is BEST described as:

Bullet-proof hosting
Domain generation algorithm (DGA) (Correct answer)
Fast-flux DNS
DNS sinkholeability evasion

Correct answer: Domain generation algorithm (DGA)

A Domain Generation Algorithm (DGA) uses a seed value such as the current date to algorithmically produce large numbers of potential C2 domain names, making takedowns difficult.

Question 130: A mobile malware sample on Android requests the READ_SMS and SEND_SMS permissions. From a forensic perspective, which threat category does this MOST indicate?

Ransomware seeking contact exfiltration
Spyware recording microphone audio
Adware generating click fraud revenue
Banking trojan intercepting OTP SMS codes (Correct answer)

Correct answer: Banking trojan intercepting OTP SMS codes

Banking trojans commonly abuse SMS permissions to intercept one-time passwords sent by banks for two-factor authentication, forwarding them to the attacker.

Question 131: A forensic analyst is examining Zeek (Bro) logs. Which log file contains records of all DNS queries and responses observed on the network?

dns.log (Correct answer)
conn.log
notice.log
http.log

Correct answer: dns.log

Zeek's dns.log records all DNS transaction details including query names, types, responses, and TTL values observed on the network.

Question 132: An investigator suspects a compromised EC2 instance on Amazon Web Services (AWS) was used for malicious activity. To preserve evidence for a forensic investigation, what is the most appropriate initial step to both contain the threat and preserve the state of the virtual machine's storage?

Terminate the instance immediately to halt all malicious processes.
Isolate the instance using a restrictive security group and create a snapshot of its EBS volume. (Correct answer)
Submit a support ticket to AWS requesting a full physical disk image of the host server.
Log into the instance via SSH and create a tarball of the entire file system.

Correct answer: Isolate the instance using a restrictive security group and create a snapshot of its EBS volume.

The correct procedure is to first isolate the instance to prevent it from causing further harm (e.g., attacking other systems) by modifying its security group to deny all traffic. Immediately following isolation, creating a snapshot of the Elastic Block Store (EBS) volume provides a forensically sound, point-in-time copy of the disk for later analysis without altering the original evidence. Terminating the instance destroys evidence, logging in alters the live system's state, and requesting a physical disk is not a standard procedure and would contain data from other tenants.

Question 133: In CHFI investigations of web attacks, what is the PRIMARY purpose of hashing web server log files upon collection?

To index the logs for faster searching
To compress the logs for storage efficiency
To encrypt the logs from unauthorized access
To ensure the integrity of log evidence and detect any post-collection tampering (Correct answer)

Correct answer: To ensure the integrity of log evidence and detect any post-collection tampering

Hashing log files (e.g., with SHA-256) at the time of collection creates a verifiable integrity record, proving the evidence has not been altered since acquisition.

Question 134: What does the term 'inode' refer to in Linux/ext4 file systems?

A data structure containing file metadata such as permissions, timestamps, and block pointers (Correct answer)
The directory entry linking a filename to data
The journal entry for a file transaction
The physical block where file data is stored

Correct answer: A data structure containing file metadata such as permissions, timestamps, and block pointers

An inode is a data structure in ext file systems that stores all metadata about a file except its name, including ownership, permissions, and pointers to data blocks.

Question 135: Which protocol is primarily analyzed when investigating DNS-based data exfiltration attacks?

HTTPS
FTP
SMTP
DNS (Correct answer)

Correct answer: DNS

DNS tunneling encodes data within DNS query/response payloads to exfiltrate data, making DNS traffic the primary focus of such investigations.

Question 136: What distinguishes a 'bit-stream image' from a simple file backup in digital forensics?

A bit-stream image compresses data to save space
A bit-stream image encrypts the copied data automatically
A bit-stream image only copies active files
A bit-stream image captures every bit including deleted files and slack space (Correct answer)

Correct answer: A bit-stream image captures every bit including deleted files and slack space

A bit-stream (forensic) image captures an exact sector-by-sector copy including deleted files, slack space, and unallocated regions.

Question 137: Which command-line tool is used to display active network connections and their associated process IDs on a Windows system?

netstat -ano (Correct answer)
ipconfig /all
arp -a
route print

Correct answer: netstat -ano

`netstat -ano` shows all active TCP/UDP connections, listening ports, and the PID of the owning process on Windows systems.

Question 138: Which protocol is used to retrieve email from a mail server and keeps messages stored server-side, making it critical for cloud-based email forensics?

IMAP (Correct answer)
POP3
SMTP
FTP

Correct answer: IMAP

IMAP (Internet Message Access Protocol) keeps emails stored on the server, meaning evidence may be preserved in the cloud even after local deletion.

Question 139: What is the purpose of the Volume Boot Record (VBR) in a disk partition?

Stores the partition table for the disk
Contains the bootstrap code to load the operating system for that partition (Correct answer)
Holds the file allocation table
Maps bad sectors on the disk

Correct answer: Contains the bootstrap code to load the operating system for that partition

The VBR resides at the first sector of each partition and contains bootstrap code that the MBR passes control to during boot.

Question 140: In the context of CHFI investigations, what does the term 'volatile data' refer to?

Data overwritten by file system operations
Data stored in encrypted containers
Data that exists only while a system is powered on and is lost at shutdown (Correct answer)
Data hidden in slack space

Correct answer: Data that exists only while a system is powered on and is lost at shutdown

Volatile data resides in RAM, CPU registers, and running processes, and is immediately lost when the system is powered off.

Question 141: In a Windows forensic investigation, an analyst discovers numerous `.pf` files in the `C:\Windows\Prefetch` directory. What is the primary forensic value of these files?

They store user-specific application settings and configurations in a binary format.
They provide a detailed, real-time log of all files accessed by the operating system kernel.
They cache portions of web pages and scripts for faster browsing in Microsoft Edge.
They track application execution, including the execution count and last run time, to speed up future launches. (Correct answer)

Correct answer: They track application execution, including the execution count and last run time, to speed up future launches.

Prefetch files (`.pf`) are created by Windows to speed up application loading. Forensically, they are valuable because they record an application's name, an execution count, and up to eight timestamps of the last times the application was run. They also list the files and directories the application accessed upon startup.

Question 142: In a PostgreSQL forensic investigation, which directory contains the server log files by default?

$PGDATA/pg_stat
$PGDATA/log (Correct answer)
$PGDATA/global
$PGDATA/pg_wal

Correct answer: $PGDATA/log

PostgreSQL writes server log files to the $PGDATA/log directory by default, recording connections, errors, and optionally all SQL statements.

Question 143: What does a `403 Forbidden` response to automated scanner requests in web logs typically indicate from a forensic perspective?

Access controls blocked the request, but the target resource exists (Correct answer)
The request was silently logged and discarded
The server crashed due to the request
The attack succeeded and the attacker retreated

Correct answer: Access controls blocked the request, but the target resource exists

A 403 response means the server understood the request but refused it due to access controls, confirming the resource exists but was protected.

Question 144: What is the significance of 'slack space' in forensic data acquisition?

Slack space between the end of a file and the end of its last cluster may contain remnants of previously deleted data (Correct answer)
Slack space is the unused area in a drive's HPA
Slack space is only present on FAT file systems and contains no useful data
Slack space refers to unused RAM during acquisition that slows the process

Correct answer: Slack space between the end of a file and the end of its last cluster may contain remnants of previously deleted data

File system slack (RAM slack + drive slack) occupies the space between a file's logical end and its allocated cluster boundary, which may contain overwritten fragments of old data.

Question 145: Which of the following is a commonly used Windows tool for secure file deletion that supports multiple overwrite passes?

Autopsy
FTK Imager
Recuva
Eraser (Correct answer)

Correct answer: Eraser

Eraser is a widely used Windows tool that performs secure file deletion by overwriting files with multiple passes of random data, making recovery infeasible.

Question 146: What is 'passive OS fingerprinting' in network forensics?

Identifying operating systems by analyzing characteristics of traffic they generate without sending probes (Correct answer)
Sending probe packets to determine a remote system's OS
Scanning open ports to match known OS signatures
Examining installed patches on a target system

Correct answer: Identifying operating systems by analyzing characteristics of traffic they generate without sending probes

Passive OS fingerprinting identifies remote operating systems by analyzing observable TCP/IP stack characteristics (TTL values, TCP window sizes, flag combinations) in captured traffic without generating any probe traffic.

Question 147: In mobile device forensics, what does 'logical acquisition' refer to?

Accessing data through JTAG or ISP methods
Extracting data through the device's OS via standard interfaces like USB or Bluetooth (Correct answer)
Removing and directly reading memory chips from the device
Creating a physical bit-for-bit copy of the device's flash memory

Correct answer: Extracting data through the device's OS via standard interfaces like USB or Bluetooth

Logical acquisition extracts data accessible via the operating system's APIs, yielding files and databases but potentially missing deleted data.

Question 148: Which network forensics artifact would best help an investigator determine the exact time a specific external IP address first communicated with an internal host?

Routing table entries
SNMP trap logs
ARP cache entries
Firewall log timestamps for the first allowed session (Correct answer)

Correct answer: Firewall log timestamps for the first allowed session

Firewall logs record timestamped allow/deny decisions for every connection attempt, providing the most reliable record of when external communication with an internal host first occurred.

Question 149: What does 'timestomping' refer to in anti-forensics?

Encrypting file contents to conceal data from investigators
Modifying file metadata timestamps to mislead timeline analysis (Correct answer)
Destroying physical storage media with a hammer
Hiding files in unallocated disk space

Correct answer: Modifying file metadata timestamps to mislead timeline analysis

Timestomping involves modifying a file's MAC (Modified, Accessed, Created) timestamps to mislead forensic investigators about when events occurred.

Question 150: Which NTFS feature creates a hidden copy of data that can be used to recover files even after deletion?

EFS encryption
NTFS compression
Alternate Data Streams
Volume Shadow Copies (VSS) (Correct answer)

Correct answer: Volume Shadow Copies (VSS)

Volume Shadow Copy Service creates point-in-time snapshots of volumes, which forensic investigators can use to recover deleted files.

Question 151: Which tool is specifically designed for reconstructing TCP streams from packet captures to recover transferred files?

Nmap
Metasploit
Aircrack-ng
NetworkMiner (Correct answer)

Correct answer: NetworkMiner

NetworkMiner passively captures packets and automatically reassembles TCP streams to extract transferred files, credentials, and messages from network traffic.

EC-Council CHFI (312-49) Certification Exam

The EC-Council Computer Hacking Forensic Investigator (CHFI) v11 certification validates professionals in detecting cyberattacks, extracting digital evidence, and reporting cybercrime findings for legal proceedings.

150

Questions

240 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds