EC-Council CHFI (312-49) Certification Exam — Questions and Answers

Question 1: Which of the following unique identifiers is permanently associated with the mobile device's hardware and is used by cellular networks to identify and potentially block a stolen or unauthorized device?

IMEI (International Mobile Equipment Identity) (Correct answer)
IMSI (International Mobile Subscriber Identity)
MSISDN (Mobile Station International Subscriber Directory Number)
ICCID (Integrated Circuit Card Identifier)

Correct answer: IMEI (International Mobile Equipment Identity)

The IMEI (International Mobile Equipment Identity) is a unique 15-digit number that identifies the physical mobile device hardware. Networks use the IMEI to track and block devices. In contrast, the IMSI is tied to the subscriber's SIM card, the ICCID is the SIM card's serial number, and the MSISDN is the user's phone number.

Question 2: A forensic investigator captures a packet with TTL value of 1. What does this most likely indicate?

The packet is encrypted
The packet was crafted to expire after one hop (Correct answer)
The packet uses IPv6
The packet originated from a local subnet

Correct answer: The packet was crafted to expire after one hop

A TTL of 1 means the packet will be dropped after crossing one router, often seen in traceroute probes or deliberately crafted reconnaissance packets.

Question 3: A forensic analyst discovers a Windows process with no parent process ID and an unusual network connection to a foreign IP. Which technique best describes what the malware is likely using?

DLL side-loading
DKOM rootkit hiding
Orphan process injection
Process hollowing (Correct answer)

Correct answer: Process hollowing

Process hollowing replaces a legitimate process's code with malicious code, often resulting in a process that appears legitimate but has anomalous network behavior and no normal parent.

Question 4: What is the significance of the SQL Server 'default trace' in a forensic investigation?

It monitors CPU usage by queries
It monitors network bandwidth usage
It captures database object changes, login failures, and DBCC events by default without configuration (Correct answer)
It logs all SELECT queries by default

Correct answer: It captures database object changes, login failures, and DBCC events by default without configuration

SQL Server's default trace automatically captures key security and administrative events like object creation/deletion, login failures, and DBCC commands without requiring manual configuration.

Question 5: A forensic investigator needs to determine which USB devices were ever connected to a Windows system. Which registry key is the primary source?

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2
HKLM\SYSTEM\CurrentControlSet\Enum\USB
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR (Correct answer)

Correct answer: HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR

HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR logs all USB storage devices ever connected, including vendor and product IDs.

Question 6: An investigator suspects a compromised EC2 instance on Amazon Web Services (AWS) was used for malicious activity. To preserve evidence for a forensic investigation, what is the most appropriate initial step to both contain the threat and preserve the state of the virtual machine's storage?

Log into the instance via SSH and create a tarball of the entire file system.
Submit a support ticket to AWS requesting a full physical disk image of the host server.
Terminate the instance immediately to halt all malicious processes.
Isolate the instance using a restrictive security group and create a snapshot of its EBS volume. (Correct answer)

Correct answer: Isolate the instance using a restrictive security group and create a snapshot of its EBS volume.

The correct procedure is to first isolate the instance to prevent it from causing further harm (e.g., attacking other systems) by modifying its security group to deny all traffic. Immediately following isolation, creating a snapshot of the Elastic Block Store (EBS) volume provides a forensically sound, point-in-time copy of the disk for later analysis without altering the original evidence. Terminating the instance destroys evidence, logging in alters the live system's state, and requesting a physical disk is not a standard procedure and would contain data from other tenants.

Question 7: A company utilizing a Software-as-a-Service (SaaS) application, such as Microsoft 365, experiences a data breach where an employee's account was used to access and exfiltrate sensitive documents from SharePoint Online. From a forensic standpoint, what is the primary limitation for the investigator?

Inability to create a forensic image of the user's workstation.
Lack of access to the underlying cloud infrastructure and server logs. (Correct answer)
The inability to determine the IP address of the logged-in user.
The data is always encrypted, making analysis impossible.

Correct answer: Lack of access to the underlying cloud infrastructure and server logs.

In a SaaS model, the customer has no access to the underlying physical servers, hypervisors, or host operating systems. The investigation is therefore limited to the logs and data export capabilities provided by the SaaS vendor (e.g., the Microsoft 365 Unified Audit Log). The investigator cannot perform low-level forensic analysis, such as acquiring a disk image of the SharePoint server or examining its memory. While the user's workstation can be imaged, the primary actions occurred on the cloud platform, for which the investigator has limited visibility.

Question 8: A suspect claims to have only stored a few contacts on their SIM card and that the phone's internal memory is irrelevant. Why is this statement often misleading in the context of modern smartphone forensics?

SIM cards are read-only and cannot be used to store any user-generated data like contacts.
Modern smartphones primarily store contacts, call logs, and extensive message histories on internal flash memory, not the SIM card. (Correct answer)
All data saved to a SIM card is automatically and permanently deleted after 30 days.
The IMEI number of the phone is stored on the SIM card, linking all activity to the subscriber.

Correct answer: Modern smartphones primarily store contacts, call logs, and extensive message histories on internal flash memory, not the SIM card.

While older feature phones had limited capacity to store contacts and SMS messages on a SIM card, modern smartphones use their large internal flash memory to store vast amounts of data, including comprehensive contact details, call logs, and entire message conversations. The SIM card's role is primarily to store subscriber identity information.

Question 9: A Windows system was shut down abruptly. Which file can help a forensic investigator recover the contents of RAM at the time of shutdown?

swapfile.sys
hiberfil.sys (Correct answer)
pagefile.sys
bootmgr

Correct answer: hiberfil.sys

hiberfil.sys stores a compressed image of RAM when the system hibernates, allowing recovery of memory contents including running processes and open files.

Question 10: What is the purpose of the Volume Boot Record (VBR) in a disk partition?

Holds the file allocation table
Maps bad sectors on the disk
Contains the bootstrap code to load the operating system for that partition (Correct answer)
Stores the partition table for the disk

Correct answer: Contains the bootstrap code to load the operating system for that partition

The VBR resides at the first sector of each partition and contains bootstrap code that the MBR passes control to during boot.

Question 11: In a Windows forensic investigation, an analyst discovers numerous `.pf` files in the `C:\Windows\Prefetch` directory. What is the primary forensic value of these files?

They provide a detailed, real-time log of all files accessed by the operating system kernel.
They cache portions of web pages and scripts for faster browsing in Microsoft Edge.
They track application execution, including the execution count and last run time, to speed up future launches. (Correct answer)
They store user-specific application settings and configurations in a binary format.

Correct answer: They track application execution, including the execution count and last run time, to speed up future launches.

Prefetch files (`.pf`) are created by Windows to speed up application loading. Forensically, they are valuable because they record an application's name, an execution count, and up to eight timestamps of the last times the application was run. They also list the files and directories the application accessed upon startup.

Question 12: Due to his visits to sexual websites and image downloads, a suspect is accused of abusing computer resources. The goal of the investigation is to show that the suspect actually went to these places. The suspect, however, has deleted the cookie cache and wiped the search history. In addition, he deleted any photographs he may have downloaded. What steps can the investigator take to demonstrate the infraction?

Seek the help of co-workers who are eye-witnesses
Approach the websites for evidence
Check the Windows registry for connection data (you may or may not cover)
Image the disk and try to recover deleted files (Correct answer)

Correct answer: Image the disk and try to recover deleted files

When files are 'deleted' from a computer, they are often not immediately overwritten; instead, the operating system simply marks the space they occupied as available. A forensic imaging tool creates a bit-for-bit copy of the entire storage device, including this unallocated space. Investigators can then use specialized data recovery software on this image to reconstruct and retrieve these 'deleted' files. This process can uncover evidence like browser history, cookies, and downloaded images, even after a suspect attempts to erase them.

Question 13: What does the term 'locard's exchange principle' mean in the context of digital forensics?

Every contact leaves a trace between the criminal and the crime scene (Correct answer)
Digital evidence must be isolated from all physical evidence
Forensic investigators must not interact with crime scene data
Every crime scene is unique and cannot be replicated

Correct answer: Every contact leaves a trace between the criminal and the crime scene

Locard's Exchange Principle states that any interaction between two entities results in an exchange of material, including digital artifacts.

Question 14: A forensic investigator needs to determine when a specific stored procedure was last modified in SQL Server. Which catalog view should they query?

sys.columns
sys.objects (Correct answer)
sys.partitions
sys.indexes

Correct answer: sys.objects

The sys.objects catalog view contains a modify_date column that records the last modification timestamp for all database objects including stored procedures.

Question 15: An investigator is presented with a powered-on, unlocked Android device and needs to perform a quick data extraction in the field. To minimize changes to the device and rapidly capture user data like contacts, call logs, and SMS messages, which acquisition method should be prioritized?

Chip-off acquisition
JTAG acquisition
Logical acquisition (Correct answer)
Physical acquisition

Correct answer: Logical acquisition

Logical acquisition is the fastest and least invasive method, ideal for a preliminary field examination of an unlocked device. It copies files and data accessible through the standard user interface, which includes contacts, call logs, and messages. Physical, JTAG, and Chip-off methods are much more invasive, time-consuming, and complex, typically reserved for laboratory analysis.

Question 16: A CHFI is called to investigate a potential data breach. The first step taken is to interview stakeholders, identify potentially affected systems (laptops, servers, mobile devices), and define the scope of the investigation. Which phase of the forensic process does this activity represent?

Reporting
Preservation
Analysis
Identification (Correct answer)

Correct answer: Identification

The Identification phase is the initial step in the digital forensic process. It involves recognizing and determining what evidence is present, where it is stored, and what format it is in. This includes identifying all potential sources of digital evidence like computers, mobile devices, and cloud storage.

Question 17: When creating a forensic image of a RAID array, what is the RECOMMENDED approach?

Use the RAID controller's native export function for best results
Power off the RAID controller before imaging to prevent parity updates
Image each individual disk separately, then reassemble the RAID virtually in analysis software (Correct answer)
Image only the parity disk since it contains all data

Correct answer: Image each individual disk separately, then reassemble the RAID virtually in analysis software

Imaging each disk individually and then using forensic software to virtually reconstruct the RAID ensures the original disks are not modified and allows flexible analysis.

Question 18: An attacker sends the payload `<img src=x onerror=alert(1)>` in a comment field that is rendered on a public page. This is an example of which XSS variant?

Stored XSS (Correct answer)
Reflected XSS
Blind XSS
DOM-based XSS

Correct answer: Stored XSS

Stored (persistent) XSS occurs when malicious script is saved to the server (e.g., a database) and later rendered to other users.

Question 19: Which of the following phases does the aforementioned duties take place in when performing the many phases of cloud forensics, one of which involves resolving functional, operational, and security issues in the cloud ecosystem?

Lof Monitoring
Investigation
Data and system Recovery
Troubleshooting (Correct answer)

Correct answer: Troubleshooting

The troubleshooting phase in cloud forensics involves identifying and resolving various issues that can arise within the complex cloud ecosystem. This includes addressing functional problems, operational inefficiencies, and security vulnerabilities that might impact the integrity of data or the forensic investigation itself. It's a proactive and reactive process to ensure the cloud environment is stable and secure for forensic activities and to overcome challenges in evidence collection.

Question 20: What is the forensic significance of the MIME (Multipurpose Internet Mail Extensions) structure in email investigation?

It encodes attachments and multi-part content that may contain embedded malware or evidence (Correct answer)
It defines email routing rules
It encrypts email body content
It authenticates sender domains

Correct answer: It encodes attachments and multi-part content that may contain embedded malware or evidence

MIME encoding allows emails to carry attachments and multi-part content; forensic investigators must decode MIME parts to extract and examine potentially malicious or evidential attachments.

Question 21: Which of the following is considered the most common and forensically sound method for duplicating a storage device, as it creates an exact, bit-for-bit copy of the entire drive, including unallocated space and deleted files?

Bit-stream disk-to-image file (Correct answer)
Sparse imaging
Logical file copy
System backup and restore

Correct answer: Bit-stream disk-to-image file

Creating a bit-stream disk-to-image file is the standard forensic method for duplicating evidence. This process creates a file that is an exact, sector-by-sector copy of the source drive, ensuring that all data, including deleted files, file slack, and unallocated space, is preserved for analysis. This is often referred to as creating a 'forensic image'.

Question 22: Which US Department of Defense standard specifies a data sanitization method using multiple overwrite passes with specific data patterns?

ISO 27001
DoD 5220.22-M (Correct answer)
PCI DSS
NIST SP 800-88

Correct answer: DoD 5220.22-M

The DoD 5220.22-M standard specifies a data sanitization method with multiple overwrite passes using defined patterns, widely implemented in secure wiping tools.

Question 23: Which hash algorithm is currently recommended by NIST for forensic image verification due to collision resistance concerns with MD5?

CRC-32
RIPEMD-128
SHA-256 (Correct answer)
SHA-1

Correct answer: SHA-256

NIST recommends SHA-256 (or stronger) for forensic integrity verification because MD5 and SHA-1 are vulnerable to collision attacks.

Question 24: In email forensics, what does the 'X-Originating-IP' header reveal?

The IP address of the client that originally submitted the email (Correct answer)
The DNS server IP used for delivery
The antivirus scanner IP
The destination mail server IP

Correct answer: The IP address of the client that originally submitted the email

The X-Originating-IP header, added by some mail providers, records the IP address of the device that originally sent the email, which can identify the sender's location.

Question 25: A _______________ is an attack where the steps in the attack sequence are carried out by a computer program rather than a hacker.

Automated attack (Correct answer)
Blackout attack
Distributed attack
Central processing attack

Correct answer: Automated attack

An automated attack is a type of cyberattack where the sequence of malicious actions is executed by a computer program, script, or botnet rather than requiring direct, real-time human interaction. These attacks are designed to operate autonomously, often scanning for vulnerabilities, exploiting weaknesses, or distributing malware on a large scale without constant human oversight.

Question 26: Which hashing algorithm is recommended by NIST for generating forensic integrity hashes of email evidence files such as PST archives?

MD5 alone
CRC32
Base64 encoding
SHA-256 or SHA-3 (Correct answer)

Correct answer: SHA-256 or SHA-3

NIST recommends SHA-256 or stronger algorithms for forensic evidence integrity verification, as MD5 and SHA-1 are considered cryptographically weak and vulnerable to collision attacks.

Question 27: Which HTTP response code in web server logs most strongly indicates a successful directory traversal attack?

403 Forbidden
500 Internal Server Error
404 Not Found
200 OK with unexpected file content (Correct answer)

Correct answer: 200 OK with unexpected file content

A 200 OK response to a traversal-style request (e.g., `../../etc/passwd`) confirms the server served a file outside the web root.

Question 28: Which anti-forensics technique involves modifying or deleting system log files to erase evidence of an attacker's activities?

Steganography
Timestomping
Log tampering (log sanitization) (Correct answer)
Data carving

Correct answer: Log tampering (log sanitization)

Log tampering involves modifying or deleting system, application, or security log files to erase records of an attacker's actions and prevent forensic reconstruction of events.

Question 29: What distinguishes a 'selective' acquisition from a 'full physical' acquisition?

Selective acquisition copies every bit of the drive including HPA
Selective acquisition uses hardware write blockers exclusively
Selective acquisition targets specific files or folders based on relevance criteria (Correct answer)
Selective acquisition always produces a compressed output

Correct answer: Selective acquisition targets specific files or folders based on relevance criteria

Selective acquisition collects only specific, forensically relevant files or directories rather than imaging the entire drive.

Question 30: When investigating a social media account on Facebook, which legal process in the US must law enforcement typically follow to obtain private user data from Meta?

FOIA request
DNS lookup
Subpoena, court order, or search warrant depending on the data type (Correct answer)
Informal request via email to Meta

Correct answer: Subpoena, court order, or search warrant depending on the data type

Under the Stored Communications Act (SCA), law enforcement must use a subpoena for basic subscriber info, a court order for non-content records, and a search warrant for private message content.

Question 31: In social media forensics, what is the significance of metadata embedded in images posted on social platforms?

It may contain GPS coordinates, device model, and timestamp revealing the photo's origin (Correct answer)
It contains the user's password hash
It only contains image resolution data
It only contains file size information

Correct answer: It may contain GPS coordinates, device model, and timestamp revealing the photo's origin

EXIF metadata in images can include GPS coordinates, camera model, and capture timestamp, though many social platforms strip EXIF data — investigators must check if the platform preserves it.

Question 32: In database forensics, which log file type records every transaction and database modification for SQL Server?

Audit log
Transaction log (.ldf) (Correct answer)
Event log
Error log

Correct answer: Transaction log (.ldf)

The SQL Server transaction log (.ldf) records all transactions and database modifications, making it critical for forensic timeline reconstruction.

Question 33: A CHFI investigator is analyzing a Linux system for malware. Which command would help identify shared libraries that have been hijacked via LD_PRELOAD?

find / -name '*.ko' -newer /boot
cat /proc/<pid>/maps | grep .so (Correct answer)
lsmod | grep suspicious
netstat -tulnp | grep LISTEN

Correct answer: cat /proc/<pid>/maps | grep .so

Reviewing /proc/<pid>/maps reveals all mapped memory regions including shared libraries, allowing detection of unexpected .so files injected via LD_PRELOAD.

Question 34: What forensic technique involves comparing database schema versions to identify unauthorized structural changes?

Index fragmentation analysis
Query profiling
Log tailing
Schema diffing (Correct answer)

Correct answer: Schema diffing

Schema diffing compares two versions of a database schema to detect unauthorized additions, modifications, or deletions of tables, columns, or stored procedures.

Question 35: What is the purpose of performing a 'disk-to-disk' clone versus a 'disk-to-image' acquisition?

Disk-to-disk is faster but does not preserve deleted files
Disk-to-disk clones are always preferred because they produce exact forensic images
Disk-to-image copies only partition tables, not data
Disk-to-disk creates a bootable working copy while disk-to-image creates an investigative archive (Correct answer)

Correct answer: Disk-to-disk creates a bootable working copy while disk-to-image creates an investigative archive

Disk-to-disk cloning produces a bootable duplicate that can replace the original for examination, while disk-to-image creates a compressed archive used for analysis and preservation.

Question 36: Which SQL Server system database stores metadata about all other databases on the SQL Server instance?

model
tempdb
msdb
master (Correct answer)

Correct answer: master

The master database stores all instance-level metadata including login accounts, endpoints, linked servers, and configuration settings.

Question 37: A forensic investigator suspects that a user has attempted to cover their tracks by clearing the Windows Security Event Log. Which of the following Event IDs would be a direct indicator that this action occurred?

4720 (A user account was created)
4624 (An account was successfully logged on)
4634 (An account was logged off)
1102 (The audit log was cleared) (Correct answer)

Correct answer: 1102 (The audit log was cleared)

Event ID 1102 is specifically generated in the Security log when an administrator or a process with sufficient privileges clears the log. Its presence is a strong indicator of an attempt to hide activity, as it shows the log was intentionally emptied. The other events are standard audit entries for user account activity.

Question 38: Which forensic tool is widely used to parse and examine Outlook PST files during email investigations?

Kernel OST/PST Viewer or FTK with PST support (Correct answer)
Aircrack-ng
Volatility
Nessus

Correct answer: Kernel OST/PST Viewer or FTK with PST support

Tools like Kernel OST/PST Viewer and FTK's email module can parse PST/OST files to recover emails, deleted items, and metadata without requiring Outlook to be installed.

Question 39: Which forensic recovery method is specifically used to recover files subjected to anti-forensic deletion by searching for file headers and footers in raw disk data?

Event log analysis
Hash verification
Live network traffic capture
File carving (data carving) (Correct answer)

Correct answer: File carving (data carving)

File carving recovers files by scanning raw disk data for known file headers and footers, bypassing file system structures that may have been manipulated, deleted, or corrupted.

Question 40: A forensic investigator is analyzing a hard drive from a suspect's computer and finds a small file. The file's logical size is 300 bytes. The file system uses a cluster size of 4096 bytes and a sector size of 512 bytes. The investigator wants to examine the area from the end of the 300-byte file to the end of the first sector. What is this specific area known as?

RAM Slack (Correct answer)
Drive Slack
Unallocated Cluster
File Slack

Correct answer: RAM Slack

RAM Slack is the space from the end of a file to the end of the sector it occupies. In this scenario, the file ends at byte 300, and the sector ends at byte 512. The 212 bytes in between constitute the RAM slack. This area is often filled with random data from the computer's memory at the time the file was written. Drive slack would be the remaining sectors in the cluster.

Question 41: During a web attack investigation, you find the string `' OR '1'='1` in server logs. What type of attack does this indicate?

SQL injection (Correct answer)
Cross-site scripting (XSS)
Directory traversal
Command injection

Correct answer: SQL injection

The string `' OR '1'='1` is a classic SQL injection payload used to bypass authentication by making a WHERE clause always evaluate to true.

Question 42: What is 'remote forensic acquisition' and what network tool is commonly used to facilitate it?

Using RDP to manually copy files from a remote system
Performing acquisition via VPN with a hardware write blocker at the remote site
Imaging a drive over the internet using cloud storage APIs
Acquiring evidence from a remote computer using an agent (e.g., EnCase Enterprise) deployed on the target (Correct answer)

Correct answer: Acquiring evidence from a remote computer using an agent (e.g., EnCase Enterprise) deployed on the target

Remote forensic acquisition uses an agent (such as EnCase Enterprise's SAFE server or F-Response) deployed on the target machine to allow an examiner to image it across the network.

Question 43: A forensic analyst acquires the `hiberfil.sys` file from a Windows 10 laptop. What type of information can the analyst expect to recover by analyzing this file?

A backup of the Master File Table (MFT) and critical registry hives.
Encrypted user login credentials for all accounts on the system.
A compressed copy of the system's RAM at the time of the last hibernation. (Correct answer)
A historical log of all installed programs and their version numbers.

Correct answer: A compressed copy of the system's RAM at the time of the last hibernation.

The `hiberfil.sys` file is used by Windows for the hibernation power-saving state. It contains a compressed snapshot of the contents of physical RAM at the moment the system was hibernated. This makes it an incredibly valuable source for memory forensics if a live acquisition was not possible, as it can contain running processes, network connections, loaded DLLs, and other volatile data.

Question 44: During a live forensic acquisition, an investigator wants to capture volatile memory. Which tool is most appropriate?

FTK Imager
WinPmem (Correct answer)
Autopsy
Volatility

Correct answer: WinPmem

WinPmem is a memory acquisition tool used to dump live RAM to a file on Windows systems.

Question 45: Which artifact would BEST help an investigator determine whether a rootkit has been hiding files on an NTFS volume?

Analyzing Prefetch files for hidden binaries
Comparing $MFT entries with directory listings from a clean OS (Correct answer)
Checking the registry hive HKLM\SYSTEM\CurrentControlSet\Services
Reviewing Windows Event Log ID 4688

Correct answer: Comparing $MFT entries with directory listings from a clean OS

Discrepancies between the raw $MFT (Master File Table) and what the running OS reports can reveal files hidden by a rootkit intercepting directory enumeration calls.

Question 46: In Windows forensics, what does the acronym LNK file refer to and why is it forensically significant?

A linked database file used by SQL Server to store transaction logs
A Windows shortcut file that records metadata about accessed files including original path and timestamps (Correct answer)
A network configuration file storing linked DNS resolver entries
A locked file handle record created when a file is opened exclusively

Correct answer: A Windows shortcut file that records metadata about accessed files including original path and timestamps

LNK (shortcut) files automatically created in Recent Items contain metadata about accessed files including MAC times, file size, and original volume serial number.

Question 47: What are the following? cloud computing services that deliver hardware, operating systems, and virtual machines. Which a service API may be used to govern.

Platform-as-a-Service (PaaS)
Infrastructure-as-a-Service (IaaS) (Correct answer)
Platform-as-a-Service (PaaS)

Correct answer: Infrastructure-as-a-Service (IaaS)

Infrastructure-as-a-Service (IaaS) provides virtualized computing resources over the internet, including virtual machines, storage, networks, and operating systems. Users have control over the operating systems, applications, and middleware, while the cloud provider manages the underlying infrastructure. This model allows for significant flexibility and scalability, often managed through APIs for programmatic control.

Question 48: Which Wireshark display filter would isolate only TCP SYN packets without ACK flags?

tcp.flags == 0x02
tcp.flags.ack == 0
tcp.flags.syn == 1 && tcp.flags.ack == 0 (Correct answer)
tcp.handshake == syn

Correct answer: tcp.flags.syn == 1 && tcp.flags.ack == 0

The filter `tcp.flags.syn == 1 && tcp.flags.ack == 0` precisely isolates TCP SYN packets that initiate connections without an acknowledgment flag.

Question 49: A forensic analyst is investigating a compromised web server where the attacker is suspected of having uploaded a web shell. Which of the following is the MOST reliable indicator of a web shell's presence?

A sudden increase in outbound traffic from the web server on port 80.
A large image file (`.jpg`) with a recent modification timestamp.
A script file in an uploads directory containing functions like `exec()`, `passthru()`, or `system()`. (Correct answer)
An unusually large number of 404 'Not Found' errors in the access logs.

Correct answer: A script file in an uploads directory containing functions like `exec()`, `passthru()`, or `system()`.

Web shells are scripts that allow attackers to execute system commands on a server. The most reliable indicator among the choices is finding a script file containing PHP, ASP, or other server-side language functions specifically designed to execute operating system commands, such as `exec()`, `passthru()`, `system()`, or `shell_exec`. The other options are less specific and can be caused by benign activities.

Question 50: What artifact would BEST help determine whether an attacker successfully exploited a web shell uploaded to a server?

SSL certificate expiration dates
Web server access logs showing GET/POST requests to the shell file (Correct answer)
IDS alert timestamps
Firewall deny rules

Correct answer: Web server access logs showing GET/POST requests to the shell file

Access log entries showing requests to the web shell file with resulting 200 responses confirm the shell was accessed and used.

Question 51: Corporate investigations are often simpler than those conducted by the government because:

The users can load whatever they want on their machines
The users have standard corporate equipment and software
The investigator has to get a warrant
The investigator does not have to get a warrant (Correct answer)

Correct answer: The investigator does not have to get a warrant

Corporate investigations are typically simpler because they operate under different legal frameworks than government investigations. In a corporate setting, employees usually consent to monitoring and searches of company-owned equipment as part of their employment agreement or company policy. This pre-existing consent often negates the need for a search warrant, which is a strict legal requirement for government agencies to seize or search private property.

Question 52: During an investigation into a suspected malware infection, a CHFI analyst discovers an unusually high volume of DNS queries for various, seemingly random subdomains of a single parent domain (e.g., `axj34.evil.com`, `b9dk1.evil.com`). The compromised host is not receiving valid IP addresses in response. This pattern is a strong indicator of which activity?

Data exfiltration or Command and Control (C2) communication using DNS tunneling. (Correct answer)
A Distributed Denial of Service (DDoS) attack against the organization's DNS server.
A DNS amplification attack originating from the compromised host.
A DNS zone transfer attempt to enumerate all hosts in the domain.

Correct answer: Data exfiltration or Command and Control (C2) communication using DNS tunneling.

This pattern is a classic indicator of DNS tunneling, a technique used to bypass firewalls by encoding data into DNS queries. Malware on a compromised host encodes stolen data or C2 communications into the subdomain portion of a DNS query, which is then sent to a malicious DNS server controlled by the attacker. The high volume of queries with long, randomized subdomains is a key giveaway.

Question 53: A forensic investigator arrives at a scene to collect evidence from a computer that is still powered on. According to the order of volatility, which of the following data types should be collected FIRST to prevent its loss?

Data on hard disks
CPU registers and cache (Correct answer)
Temporary file systems
Data on archival media

Correct answer: CPU registers and cache

The order of volatility dictates that the most transient data be collected first. CPU registers and cache are extremely volatile and change within nanoseconds. Therefore, this information must be captured before any other data, as even the act of running a collection tool can alter it.

Question 54: During an investigation involving an IaaS provider, a forensic analyst successfully acquires a snapshot of a virtual disk. The analysis reveals that the disk was part of a volume group managed by a Logical Volume Manager (LVM). What is a key implication of this discovery for the forensic process?

All files will be encrypted by default by the LVM system.
A snapshot is not a valid acquisition method for disks using LVM.
The investigator must reassemble the logical volumes from the physical volume(s) before analyzing the file systems. (Correct answer)
The data is unrecoverable as LVM is a proprietary format.

Correct answer: The investigator must reassemble the logical volumes from the physical volume(s) before analyzing the file systems.

LVM is an abstraction layer that allows disk space to be managed in logical volumes, which can span multiple physical partitions or disks. When analyzing a disk image containing an LVM physical volume, standard forensic tools may not immediately see the file systems. The investigator must first use tools that can interpret the LVM metadata to virtually reassemble the logical volumes. Once the logical volume is exposed as a block device, it can be analyzed like any other partition to find the file system within it.

Question 55: A forensic investigator notices repeated POST requests to `/wp-login.php` with hundreds of different passwords. What attack type is this?

Dictionary attack
Password spraying
Brute-force attack (Correct answer)
Credential stuffing

Correct answer: Brute-force attack

Repeated login attempts against a single account with many passwords characterizes a brute-force attack.

Question 56: A CHFI is at a scene and must decide on an acquisition method for a suspect's laptop. The investigator has limited time and is primarily interested in specific user-created documents and emails, not the entire operating system or unallocated space. Which acquisition method would be the most efficient in this situation?

Live RAM Capture
Bit-stream Imaging
Physical Acquisition
Logical Acquisition (Correct answer)

Correct answer: Logical Acquisition

Logical acquisition is the process of acquiring only the active data files and directories from a storage device. It does not capture the entire physical drive (including unallocated space or deleted files). When time is limited and the focus is on specific file types, logical acquisition is much faster and more efficient than a full physical or bit-stream acquisition.

Question 57: Which document formally authorizes a forensic investigator to conduct an investigation within an organization?

Non-disclosure agreement
Subpoena
Written authorization or letter of engagement (Correct answer)
Search warrant

Correct answer: Written authorization or letter of engagement

A written authorization or letter of engagement from the organization legally authorizes the investigator to examine its systems.

Question 58: Which NTFS feature creates a hidden copy of data that can be used to recover files even after deletion?

NTFS compression
Alternate Data Streams
Volume Shadow Copies (VSS) (Correct answer)
EFS encryption

Correct answer: Volume Shadow Copies (VSS)

Volume Shadow Copy Service creates point-in-time snapshots of volumes, which forensic investigators can use to recover deleted files.

Question 59: During a forensic investigation, an analyst discovers that SQL Server error log entries have been deleted. Where else might evidence of malicious database activity be found?

Windows Event Logs and SQL Server transaction logs (Correct answer)
Only in network packet captures
Only in firewall logs
Only in the application tier

Correct answer: Windows Event Logs and SQL Server transaction logs

Windows Event Logs record SQL Server service events and security events, while transaction logs record all data modifications, providing corroborating evidence even when error logs are deleted.

Question 60: Which protocol is primarily analyzed when investigating DNS-based data exfiltration attacks?

FTP
SMTP
HTTPS
DNS (Correct answer)

Correct answer: DNS

DNS tunneling encodes data within DNS query/response payloads to exfiltrate data, making DNS traffic the primary focus of such investigations.

Question 61: Which technique allows a forensic investigator to recover deleted rows from a SQL Server database without a backup?

Log file analysis using transaction log parser (Correct answer)
Index scan
Schema comparison
Full-text search

Correct answer: Log file analysis using transaction log parser

Deleted rows remain in the transaction log until the log is truncated, allowing forensic tools like ApexSQL Log to reconstruct and recover deleted data.

Question 62: A forensic investigator discovers volatile data on a running system. According to the order of volatility, what should be collected FIRST?

Hard disk contents
Optical media
Network configuration files on disk
CPU registers and cache (Correct answer)

Correct answer: CPU registers and cache

CPU registers and cache are the most volatile data and must be collected first as they are lost immediately upon power-off.

Question 63: When a hacker utilizes one compromised cloud to attack additional accounts, they are using the cloud as a tool.

False
True (Correct answer)

Correct answer: True

This statement is true. When a hacker leverages a compromised cloud environment (e.g., using a compromised virtual machine or cloud account) to launch attacks against other targets, the cloud infrastructure is serving as an instrument or means to facilitate the crime. In this scenario, the cloud is not the victim or the location of the crime, but rather the 'tool' used by the perpetrator to achieve their malicious goals.

Question 64: What forensic technique involves examining the allocated and unallocated areas of a disk to find deleted files?

Registry hive parsing
Steganography analysis
File carving (Correct answer)
Log correlation

Correct answer: File carving

File carving recovers files by searching for file headers and footers in raw disk data, regardless of filesystem structure.

Question 65: Which email header field is most important for tracing the originating IP address of an email message?

Reply-To
Message-ID
Received (Correct answer)
From

Correct answer: Received

The 'Received' headers form a chain of mail server hops and the earliest 'Received' header contains the originating IP address of the sender.

Question 66: What is the primary purpose of the 'chain of custody' document in digital forensics?

List all suspects involved in the case
Record all software used during analysis
Track evidence handling to preserve admissibility (Correct answer)
Document the network topology of the crime scene

Correct answer: Track evidence handling to preserve admissibility

Chain of custody tracks who handled evidence, when, and how to ensure it remains unaltered and legally admissible.

Question 67: Which Oracle audit trail type stores audit records in OS files rather than within the database itself?

Database audit trail
Fine-grained auditing
OS audit trail (Correct answer)
Unified auditing

Correct answer: OS audit trail

The OS audit trail writes audit records to the operating system audit log, making them harder for a compromised DBA to tamper with.

Question 68: What does 'timestomping' refer to in anti-forensics?

Destroying physical storage media with a hammer
Hiding files in unallocated disk space
Encrypting file contents to conceal data from investigators
Modifying file metadata timestamps to mislead timeline analysis (Correct answer)

Correct answer: Modifying file metadata timestamps to mislead timeline analysis

Timestomping involves modifying a file's MAC (Modified, Accessed, Created) timestamps to mislead forensic investigators about when events occurred.

Question 69: How many bytes do hard disk sectors normally contain?

512 (Correct answer)
2048
1024
256

Correct answer: 512

Hard disk sectors have historically contained 512 bytes of data. While newer 'Advanced Format' drives use 4096-byte (4KB) sectors, they often employ 512-byte sector emulation for compatibility with legacy operating systems and software. Therefore, 512 bytes remains the standard and most commonly encountered sector size in general computer forensics contexts.

Question 70: Which SQL Server feature, when enabled, records all login attempts including failed ones, and is critical for forensic investigations?

Database Mirroring
Replication
SQL Server Audit (Correct answer)
Change Data Capture

Correct answer: SQL Server Audit

SQL Server Audit tracks and logs SQL Server and database-level events including successful and failed login attempts, providing a forensic audit trail.

Question 71: Which anti-forensics technique involves an attacker deliberately planting false digital evidence to mislead forensic investigators?

Log rotation
Secure deletion
Data carving
Evidence fabrication (anti-forensic deception) (Correct answer)

Correct answer: Evidence fabrication (anti-forensic deception)

Evidence fabrication involves planting false or misleading digital artifacts to confuse investigators, waste forensic resources, or frame innocent parties for the crime.

Question 72: An investigator is analyzing a compromised Windows machine and needs to determine how a piece of malware achieves persistence across reboots. Which of the following is one of the most common registry keys an analyst should examine for malicious entries?

HKEY_USERS\.DEFAULT\Keyboard Layout
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services (Correct answer)
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
HKEY_CLASSES_ROOT\.dll

Correct answer: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

The `HKLM\SYSTEM\CurrentControlSet\Services` registry key is a fundamental location where Windows services are defined. Malware frequently creates a new service pointing to its executable to ensure it is launched automatically by the operating system at startup, often with high privileges. While other locations can be used for persistence, this is a primary and critical location to investigate.

Question 73: An investigator finds ARP replies with no preceding ARP request in a packet capture. This is a sign of:

ARP cache poisoning (Correct answer)
DNS hijacking
Normal router behavior
DHCP spoofing

Correct answer: ARP cache poisoning

Unsolicited ARP replies (gratuitous ARP) sent by an attacker are the primary mechanism of ARP cache poisoning, used to associate the attacker's MAC with a legitimate IP.

Question 74: Computer forensic investigator Carlo is. He was given an assignment by a company to look into a forensic case. The computer at the crime site was turned off when Carlo arrived at the company to investigate the location. What do you think Carlo ought to do in this situation?

He should turn on the computer and should start analyzing it
He should leave the computer off (Correct answer)
He should turn on the computer
He should turn on the computer and extract the data

Correct answer: He should leave the computer off

When a computer at a crime scene is found turned off, the best practice for a forensic investigator is to leave it off. Turning it on would alter the system's state, potentially overwriting volatile data in RAM and modifying timestamps or log files, thus compromising the integrity of potential evidence. The correct procedure is to transport the device to a forensic lab for a controlled examination, where a forensically sound acquisition can be performed without altering the original state.

Question 75: Which tool is primarily used by forensic analysts to reconstruct and replay HTTP sessions captured in a PCAP file?

Nessus
Volatility
Wireshark's Follow TCP Stream (Correct answer)
Autopsy

Correct answer: Wireshark's Follow TCP Stream

Wireshark's Follow TCP Stream feature allows analysts to reconstruct and review full HTTP conversations from packet captures.

Question 76: What is the Device Configuration Overlay (DCO) and how does it differ from the HPA?

DCO is configured by the manufacturer or OEM to limit drive capacity; HPA is user-configurable (Correct answer)
DCO and HPA are different names for the same feature
DCO is set by the user; HPA is set by the manufacturer at the factory
DCO stores partition tables; HPA stores firmware

Correct answer: DCO is configured by the manufacturer or OEM to limit drive capacity; HPA is user-configurable

The DCO is typically set by manufacturers to standardize drive capacity across product lines, while the HPA can be set by the user or OS to hide data; both are invisible to the OS.

Question 77: Which of the following is a hard disk's smallest allocation unit? Depending on the formatting system, a hard disk can have anywhere between 2 and 32 tracks and sectors.

4Platter
Cluster (Correct answer)
Track
Sector

Correct answer: Cluster

A cluster is the smallest logical unit of disk space that the operating system can allocate to hold a file. While a sector is the smallest physical unit of storage on a disk, the operating system groups multiple sectors together to form a cluster. Files are stored in whole clusters, meaning even a tiny file will occupy at least one full cluster, leading to potential slack space which can contain remnants of previous data.

Question 78: Which technique involves overwriting storage media multiple times with random data patterns to prevent file recovery?

File encryption
File compression
Data carving
Secure wiping (data sanitization) (Correct answer)

Correct answer: Secure wiping (data sanitization)

Secure wiping overwrites storage media multiple times with random data patterns, making the original data unrecoverable even with advanced forensic tools.

Question 79: A forensic investigator is attempting to extract data from a severely damaged smartphone that will not power on. The device's motherboard is cracked, making JTAG and ISP methods impossible. Which of the following is the most appropriate, albeit destructive, technique to attempt data recovery?

File system acquisition
Manual acquisition
Logical acquisition
Chip-off (Correct answer)

Correct answer: Chip-off

Chip-off is an advanced, invasive forensic technique where the flash memory chip is physically de-soldered from the circuit board and read with a specialized device. It is considered a last resort when the device is non-functional and other methods like JTAG are not viable due to physical damage. The other methods require a functioning or at least partially functioning device.

Question 80: What is the purpose of analyzing the 'Bcc' (Blind Carbon Copy) field in email forensics investigations?

Bcc prevents the email from being forwarded
Bcc encrypts the email content
Bcc recipients are hidden from other recipients but may appear in server logs or sender's sent folder, revealing hidden communication parties (Correct answer)
Bcc is always visible in email headers and easy to read

Correct answer: Bcc recipients are hidden from other recipients but may appear in server logs or sender's sent folder, revealing hidden communication parties

While Bcc recipients are invisible to To/Cc recipients, mail server logs, the sender's sent items, and mail server transaction logs may reveal who received Bcc copies.

Question 81: A suspect's laptop uses full-disk BitLocker encryption and is found powered ON. What is the BEST immediate action to preserve decrypted data?

Perform a live RAM acquisition before powering off (Correct answer)
Wait for BitLocker to time out and re-encrypt
Remove the drive and image it in a write blocker
Shut it down immediately to prevent data changes

Correct answer: Perform a live RAM acquisition before powering off

Performing a live RAM acquisition captures the BitLocker encryption keys stored in volatile memory before the machine is powered off.

Question 82: An investigator is analyzing a Windows 10 system to determine which external storage devices have been previously connected. Which Registry hive and key would provide the most direct evidence of USB devices, including vendor and product IDs?

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR (Correct answer)
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\TypedURLs
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2
HKEY_LOCAL_MACHINE\SAM\Domains\Account\Users

Correct answer: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR

The `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR` registry key is specifically designed to enumerate USB Mass Storage Devices that have been connected to the system. It contains subkeys for each unique device, which in turn store details like the device's vendor ID, product ID, and unique serial number.

Question 83: When investigating a network security incident, a forensic analyst lacks a full packet capture but has access to NetFlow records from the organization's routers. What type of information can the analyst primarily derive from this data?

Metadata about network conversations, including source/destination IPs, ports, and the volume of data transferred. (Correct answer)
The complete content of emails transmitted during the incident.
Specific commands executed by an attacker on a compromised host.
Cryptographic keys used to encrypt the network traffic.

Correct answer: Metadata about network conversations, including source/destination IPs, ports, and the volume of data transferred.

NetFlow data provides a high-level summary or metadata of network traffic, often compared to a phone bill. It records details like the source and destination IP addresses, source and destination ports, protocol, and the total bytes transferred for a given conversation ('flow'). It does not capture the actual payload or content of the packets, so it cannot reveal email contents, specific commands, or cryptographic keys.

Question 84: A forensic investigator is analyzing web server access logs to profile an attacker's activity. What critical piece of information does the User-Agent string provide in a log entry?

The client software, browser, and operating system used to make the request. (Correct answer)
The client's IP address and port number.
The referring URL that led the client to the requested page.
The final HTTP status code of the server's response.

Correct answer: The client software, browser, and operating system used to make the request.

The User-Agent string is an HTTP header that identifies the client software originating the request. For an investigator, this can reveal the attacker's browser, browser version, and operating system. It can also indicate the use of automated attack tools (like scanners or SQLMap), which often have unique User-Agent strings.

Question 85: A forensic examiner is acquiring a drive from a Mac with Apple Silicon (M1/M2). What is a key challenge compared to Intel-based Macs?

M1/M2 drives use SCSI, which is incompatible with standard write blockers
Target Disk Mode is not available; acquisition requires OS-level tools or JTAG methods (Correct answer)
Apple Silicon encrypts RAM, preventing all live acquisition
M1/M2 Macs use a different file system (APFS) that no tools support

Correct answer: Target Disk Mode is not available; acquisition requires OS-level tools or JTAG methods

Apple Silicon Macs removed Target Disk Mode, making traditional hardware-based acquisition impossible and requiring alternative methods like using Apple Configurator or specialized JTAG hardware.

Question 86: What does the term 'database carving' refer to in forensic investigations?

Encrypting database columns
Splitting a database across multiple servers
Recovering database records from raw disk images without a live database (Correct answer)
Partitioning a database for performance

Correct answer: Recovering database records from raw disk images without a live database

Database carving involves extracting database records and structures directly from raw disk images or unallocated space when the database system is unavailable.

Question 87: What is the goal of 'artifact wiping' as an anti-forensics technique?

To modify network packet headers to remove source IP addresses
To hide executable files in alternate NTFS data streams
To remove all forensic traces of a tool's presence including registry entries, prefetch files, and log entries (Correct answer)
To encrypt disk artifacts using symmetric encryption

Correct answer: To remove all forensic traces of a tool's presence including registry entries, prefetch files, and log entries

Artifact wiping aims to remove all traces of a tool's execution, including registry keys, prefetch files, event logs, and temp files, preventing investigators from determining which tools were run on the system.

Question 88: What is 'write blocking' and which layer does a software write blocker operate at?

Intercepts write commands via OS driver or API interception before they reach the drive (Correct answer)
Monitors SMART data to detect write operations
Encrypts all writes to prevent data modification
Physically disconnects the write pin; operates at the SATA controller layer

Correct answer: Intercepts write commands via OS driver or API interception before they reach the drive

Software write blockers intercept OS-level write commands (via drivers or system call hooks) before they reach the storage device, preventing data modification during examination.

Question 89: Which disk partitioning scheme supports more than 2 TB volumes and up to 128 primary partitions on Windows?

VBR
MBR
GPT (Correct answer)
APT

Correct answer: GPT

GUID Partition Table (GPT) supports drives larger than 2 TB and allows up to 128 primary partitions, overcoming MBR limitations.

Question 90: During a forensic investigation, which principle ensures that evidence collected is admissible in a court of law?

Chain of custody (Correct answer)
Log aggregation
Evidence compression
Data normalization

Correct answer: Chain of custody

Chain of custody documents every person who handled the evidence, ensuring its integrity and admissibility in court.

Question 91: During a memory forensics analysis using a tool like Volatility, an investigator lists all running processes from a memory dump. The output shows a suspicious process named `svc-host.exe`, which is a common misspelling of the legitimate `svchost.exe`. This finding is an example of which malware analysis technique?

File carving
Masquerading (Correct answer)
Code signing verification
Steganography

Correct answer: Masquerading

Masquerading is a technique where malware disguises itself by using a name that is very similar to a legitimate system file or process. The goal is to deceive system administrators or investigators who are performing a quick review, causing them to overlook the malicious process.

Question 92: Which dcfldd command option generates a hash of the acquired image simultaneously during the imaging process?

bs=hashmode
conv=hash
hashlog= (Correct answer)
--verify

Correct answer: hashlog=

dcfldd's 'hashlog=' option writes a running hash (MD5 or SHA-1) to a specified log file as the image is being created, enabling simultaneous acquisition and verification.

Question 93: An investigator is analyzing a compromised Docker environment. It is suspected that an attacker gained access to the host and deployed a malicious container. To understand what file system changes the running container has made relative to its original image, which command would be most effective?

docker inspect [container_id]
docker logs [container_id]
docker diff [container_id] (Correct answer)
docker history [image_name]

Correct answer: docker diff [container_id]

The `docker diff` command is specifically designed to inspect the changes made to a container's filesystem since it was created. It will show files and directories that have been added (A), changed (C), or deleted (D) in the container's writable layer. This is extremely useful for identifying malware droppers, modified configuration files, or data exfiltration staging files created by an attacker after the container was started. `docker history` shows image layers, `docker inspect` shows metadata, and `docker logs` shows application output.

Question 94: What is the primary forensic value of the SQL Server msdb database?

Holds temporary objects
Stores model database templates
Contains SQL Agent job history and backup/restore history (Correct answer)
Stores user data tables

Correct answer: Contains SQL Agent job history and backup/restore history

The msdb database stores SQL Server Agent job history, backup and restore history, and Database Mail data, providing a timeline of automated activities.

Question 95: What is the primary purpose of NetFlow data in network forensics?

Providing summarized metadata about network traffic flows (Correct answer)
Decrypting SSL/TLS sessions
Capturing full packet payloads for deep inspection
Mapping physical network topology

Correct answer: Providing summarized metadata about network traffic flows

NetFlow records summarize traffic flow metadata (source/destination IPs, ports, byte counts, timestamps) without capturing full payloads, enabling efficient large-scale traffic analysis.

Question 96: Which protocol is used to retrieve email from a mail server and keeps messages stored server-side, making it critical for cloud-based email forensics?

POP3
FTP
SMTP
IMAP (Correct answer)

Correct answer: IMAP

IMAP (Internet Message Access Protocol) keeps emails stored on the server, meaning evidence may be preserved in the cloud even after local deletion.

Question 97: An investigator is preparing a final report after analyzing a compromised system. Which phase of the forensic investigation process involves creating a detailed record of the findings, including the methods used and the evidence discovered?

Identification
Analysis
Preservation
Documentation and Reporting (Correct answer)

Correct answer: Documentation and Reporting

The Documentation and Reporting phase is where the investigator formally records all actions taken, methodologies used for analysis, and the conclusions drawn from the evidence. This report is crucial for legal proceedings and must be clear, concise, and defensible.

Question 98: An examiner acquires a drive and calculates an MD5 hash that differs from the hash taken by the first responder. What is the MOST likely conclusion?

The hash mismatch is expected because MD5 is non-deterministic
The file system was journaled, causing automatic hash changes
The evidence was altered or the chain of custody was broken between acquisitions (Correct answer)
The forensic tool used a different sector size

Correct answer: The evidence was altered or the chain of custody was broken between acquisitions

A hash mismatch between acquisition points indicates that data changed, suggesting evidence tampering or a broken chain of custody.

Question 99: What is the anti-forensics purpose of exploiting Alternate Data Streams (ADS) in NTFS?

To encrypt the primary data stream with AES
To delete files beyond forensic recovery
To compress large files automatically for storage efficiency
To hide data within NTFS file metadata, invisible to standard directory listings (Correct answer)

Correct answer: To hide data within NTFS file metadata, invisible to standard directory listings

Alternate Data Streams (ADS) is an NTFS feature that allows data to be attached to a file's metadata stream, making it invisible to standard directory listings and many forensic tools.

Question 100: Which Android acquisition method provides the most complete data extraction, including deleted files, but requires the device to be rooted?

Physical acquisition (Correct answer)
Logical extraction via USB
ADB backup
Cloud sync extraction

Correct answer: Physical acquisition

Physical acquisition creates a bit-for-bit image of the storage medium and can recover deleted data, but typically requires root access.

Question 101: Which of the following best describes the cloud deployment paradigm used for shared infrastructure between multiple enterprises with common concerns (security, compliance, jurisdiction, etc.)?

Community Cloud (Correct answer)
Public Cloud
Private Cloud
Hybrid Cloud

Correct answer: Community Cloud

A community cloud deployment model is designed for a specific community of organizations that share common concerns, such as security requirements, compliance regulations, or jurisdiction. It can be managed internally or by a third party and hosted either internally or externally. This model allows for shared infrastructure and resources while addressing the unique needs of the participating entities, offering a balance between public and private cloud benefits.

Question 102: Which artifact on a Windows system stores evidence of web-based email access (e.g., Gmail via browser) useful in email forensics?

Registry hives only
Browser cache, history, and cookies (Correct answer)
Windows Event Logs only
Prefetch files only

Correct answer: Browser cache, history, and cookies

Browser cache files may contain cached email content and attachments, browser history shows Gmail/webmail access timestamps, and cookies can reveal authenticated sessions.

Question 103: A company website that hosts a public comment forum has been compromised. An attacker posted a comment containing malicious JavaScript, which is now executing in the browsers of legitimate users who view the forum page, stealing their session cookies. This is a classic example of a Stored XSS attack. Where would an investigator most likely find the original malicious script payload?

In the server's error logs, triggered by failed script execution.
Embedded within a modified JavaScript file in the web root directory.
Exclusively in the volatile memory (RAM) of the web server.
Within the web application's database, stored as part of the attacker's forum comment. (Correct answer)

Correct answer: Within the web application's database, stored as part of the attacker's forum comment.

In a Stored (or Persistent) Cross-Site Scripting (XSS) attack, the malicious script is submitted to the web application and saved in a persistent data store, such as a database. When other users request the page containing the malicious data (e.g., a forum post), the server retrieves the script from the database and includes it in the response, causing it to execute in the victim's browser. Therefore, the primary evidence is the payload stored in the database.

Question 104: A forensic investigator is analyzing a wireless packet capture and identifies a large number of deauthentication frames being broadcast. These frames appear to originate from the legitimate Access Point's MAC address but are targeting all connected clients, causing widespread disconnections. What is this specific type of attack called?

Evil Twin Attack
MAC Flooding
Wi-Fi Disassociation/Deauthentication Attack (Correct answer)
ARP Spoofing

Correct answer: Wi-Fi Disassociation/Deauthentication Attack

This scenario describes a Wi-Fi Disassociation or Deauthentication attack. In this attack, an adversary sends forged deauthentication or disassociation frames to clients, spoofing the MAC address of the Access Point. This tricks the clients into disconnecting from the network, causing a denial-of-service condition.

Question 105: What iOS artifact contains a history of locations visited by the device, stored as a SQLite database?

significant_locations.db
CellLocationLocal.db
com.apple.locationd/clients
consolidated.db (Correct answer)

Correct answer: consolidated.db

Historically, consolidated.db stored location history on iOS devices and became a major forensic artifact.

Question 106: What does 'counter-forensics' refer to from a forensic investigator's perspective?

Destroying digital evidence before it can be collected by law enforcement
The use of forensic tools to analyze captured network traffic packets
Encrypting forensic disk images for secure chain-of-custody storage
Investigator techniques and tools used to detect, overcome, and document anti-forensic measures (Correct answer)

Correct answer: Investigator techniques and tools used to detect, overcome, and document anti-forensic measures

Counter-forensics refers to the investigator's use of techniques and specialized tools to detect, overcome, and formally document anti-forensic measures employed by suspects to preserve evidence integrity.

Question 107: What is the primary purpose of using 'segment files' (e.g., E01.E01, E01.E02...) during forensic acquisition?

To accommodate file system size limits and enable splitting across multiple storage media (Correct answer)
To allow parallel hashing of each segment separately
To allow different examiners to work on separate segments simultaneously
To encrypt each segment with a different key for security

Correct answer: To accommodate file system size limits and enable splitting across multiple storage media

Forensic image segmentation splits large images into manageable chunks to work within file system limitations (e.g., FAT32's 4GB limit) or to span multiple storage devices.

Question 108: When a cloud acts like an object, it is committing the crime of cloud as object.

False (Correct answer)
True

Correct answer: False

This statement is false. When a cloud acts as an object, it means the cloud itself is the victim of the crime, such as a denial-of-service attack against a cloud provider's infrastructure or data being stolen from cloud storage. The cloud is not 'committing' the crime; rather, it is the entity being acted upon by the criminal, suffering the impact of the malicious activity.

Question 109: Cloud forensics are divided into nine main groups, according to NIST.

False (Correct answer)
True

Correct answer: False

This statement is false. NIST (National Institute of Standards and Technology) has published extensive guidelines and frameworks for cloud computing and forensics, but they do not categorize cloud forensics into a specific number like 'nine main groups.' NIST documents typically define cloud deployment models, service models, and outline challenges and principles for cloud forensics, rather than a fixed number of groups.

Question 110: Which of the following is a PRIMARY advantage of using EnCase's E01 format over a raw dd image?

E01 images are always smaller due to mandatory compression
E01 format does not require a write blocker during acquisition
E01 images can be mounted natively by all Linux distributions
E01 embeds case metadata and a hash for integrity verification within the file (Correct answer)

Correct answer: E01 embeds case metadata and a hash for integrity verification within the file

The E01 (Expert Witness) format stores case metadata, examiner notes, and MD5/SHA-1 hashes inside the image container itself for built-in integrity verification.

Question 111: Which Windows log file records successful and failed logon attempts and is critical for investigating unauthorized access?

Application.evtx
Setup.evtx
System.evtx
Security.evtx (Correct answer)

Correct answer: Security.evtx

Security.evtx contains event IDs 4624 (successful logon) and 4625 (failed logon), making it the primary source for access investigations.

Question 112: In a PostgreSQL forensic investigation, which directory contains the server log files by default?

$PGDATA/global
$PGDATA/log (Correct answer)
$PGDATA/pg_stat
$PGDATA/pg_wal

Correct answer: $PGDATA/log

PostgreSQL writes server log files to the $PGDATA/log directory by default, recording connections, errors, and optionally all SQL statements.

Question 113: In investigating a Twitter/X account for evidence, which API does law enforcement reference for legal data requests to the platform?

Twitter's Legal Request Submission portal under the Stored Communications Act (Correct answer)
Google Safe Browsing API
WHOIS API
Twitter Developer API v2 public endpoints

Correct answer: Twitter's Legal Request Submission portal under the Stored Communications Act

Law enforcement submits legal requests for Twitter/X user data through Twitter's official legal request portal, following the Stored Communications Act framework for subpoenas and warrants.

Question 114: In which location does Microsoft Outlook store emails, contacts, and calendar data in a local file format?

.eml file
.msg file
.mbox file
.pst or .ost file (Correct answer)

Correct answer: .pst or .ost file

Outlook stores local email data in Personal Storage Table (.pst) files for local storage and Offline Storage Table (.ost) files for cached Exchange mailbox data.

Question 115: A forensic analyst suspects a system is infected with a sophisticated kernel-mode rootkit. The analyst runs `tasklist` on the live system and sees no malicious processes. However, after acquiring a memory dump and analyzing it with Volatility, a hidden process is discovered. This discrepancy is most likely caused by the rootkit performing what action?

Using Direct Kernel Object Manipulation (DKOM) to unlink its process from the active process list. (Correct answer)
Deleting the process executable from the disk after loading.
Injecting its code into a legitimate process like `explorer.exe`.
Encrypting its own process memory.

Correct answer: Using Direct Kernel Object Manipulation (DKOM) to unlink its process from the active process list.

Kernel-mode rootkits can directly manipulate the kernel's data structures. By using DKOM, a rootkit can remove the `EPROCESS` block of its process from the doubly-linked list of active processes that the kernel maintains. User-mode tools that rely on standard APIs to list processes will not see the malware, but memory forensics tools that parse these raw kernel structures directly can still find the unlinked process.

Question 116: What is the primary purpose of a forensic investigation report?

To list all tools used during the investigation
To outline the suspect's criminal history
To summarize remediation steps taken
To document findings in a legally defensible and comprehensible manner (Correct answer)

Correct answer: To document findings in a legally defensible and comprehensible manner

The forensic report must document findings clearly and in a legally defensible way so it can be used in judicial or corporate proceedings.

Question 117: During a network forensics investigation, an analyst notices many short-duration flows to a single external IP. This pattern is most consistent with:

File transfer protocol activity
Beaconing malware behavior (Correct answer)
VoIP communications
Normal web browsing

Correct answer: Beaconing malware behavior

Regular short-duration connections to a single external IP at consistent intervals are a hallmark of malware beaconing for command-and-control communication.

Question 118: When imaging a solid-state drive (SSD), which characteristic makes forensic acquisition more challenging than with HDDs?

SSDs do not support the ATA interface required for forensic tools
SSDs use proprietary encryption that cannot be bypassed
SSDs store data in volatile memory that disappears when powered off
Wear leveling and TRIM commands can overwrite deleted data, reducing recoverability (Correct answer)

Correct answer: Wear leveling and TRIM commands can overwrite deleted data, reducing recoverability

SSD controllers use wear leveling to distribute writes, and TRIM actively zeroes deleted blocks, making traditional deleted-data recovery difficult on SSDs.

Question 119: A forensic examiner is creating an image of a hard drive that uses the Master Boot Record (MBR) partitioning scheme. Which of the following correctly describes the structure and location of the MBR?

It is located in the first 512-byte sector of the disk and contains the boot code and partition table. (Correct answer)
It is a variable-sized structure stored within the first partition that defines the file system.
It can be located anywhere on the disk and primarily contains user data.
It is located at the end of the disk and contains a backup of the partition table.

Correct answer: It is located in the first 512-byte sector of the disk and contains the boot code and partition table.

The Master Boot Record (MBR) is a critical data structure located in the very first 512-byte sector of a partitioned storage device. It contains the master boot code (which initiates the boot process), the partition table (which defines the primary partitions), and a boot signature.

Question 120: In the dd command 'dd if=/dev/sda of=/mnt/evidence/disk.img bs=512 conv=noerror,sync', what does the 'sync' option do?

Pads bad blocks with zeros to maintain image size integrity (Correct answer)
Syncs the image hash after completion
Skips read errors silently
Forces synchronous writes to prevent buffering

Correct answer: Pads bad blocks with zeros to maintain image size integrity

The 'sync' option pads every failed read block with null bytes so the output image remains the same size as the source, preserving offset alignment.

Question 121: In FTK Imager, what does the 'Verify images after they are created' option do?

Submits the image hash to an online verification database
Re-images the drive a second time to compare both images
Reads the completed image and recalculates the hash to confirm it matches the acquisition hash (Correct answer)
Checks the image for file system errors using chkdsk

Correct answer: Reads the completed image and recalculates the hash to confirm it matches the acquisition hash

FTK Imager's post-acquisition verification reads the completed image file and recalculates its hash, confirming it matches the hash computed during acquisition.

Question 122: If a crime is committed in a cloud environment, identify the specific offense that was committed there.

Cloud as an object
Cloud as a subject (Correct answer)
Cloud as a tool

Correct answer: Cloud as a subject

When a crime is committed *in* a cloud environment, meaning the cloud itself is the target or location of the criminal activity (e.g., data theft from a cloud server, unauthorized access to cloud resources), it is categorized as 'Cloud as a Subject.' This distinguishes it from using the cloud as a tool to commit a crime elsewhere or the cloud being the object of a crime (e.g., the cloud provider itself being attacked).

Question 123: Which open-source full disk encryption tool is considered a major challenge for digital forensic investigators due to its strong encryption?

MD5sum
VeraCrypt (Correct answer)
SHA-256
Wireshark

Correct answer: VeraCrypt

VeraCrypt provides strong full-disk or volume encryption that makes encrypted data completely inaccessible without the correct passphrase or key, presenting a significant obstacle to forensic access.

Question 124: In web attack forensics, what does the presence of `%2e%2e%2f` in a URL request indicate?

XML entity injection
Base64-encoded command injection
URL-encoded directory traversal (`../`) (Correct answer)
LDAP injection attempt

Correct answer: URL-encoded directory traversal (`../`)

`%2e%2e%2f` is the URL-encoded form of `../`, used in directory traversal attacks to escape the web root.

Question 125: Which of the following is the central and most critical metadata file in an NTFS file system, containing records for every file and directory on the volume?

$Bitmap
$MFT (Master File Table) (Correct answer)
$Boot
$LogFile

Correct answer: $MFT (Master File Table)

The Master File Table ($MFT) is the heart of the NTFS file system. It contains at least one entry for every file and directory on the volume, storing all their metadata, such as name, size, timestamps, and permissions. For small files, the data itself can even be stored directly within the MFT record.

Question 126: Which Windows artifact records the applications that were set to auto-start at system boot and can reveal persistence mechanisms used by malware?

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run (Correct answer)
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
HKLM\SYSTEM\CurrentControlSet\Control\CrashControl

Correct answer: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

The Run key under both HKLM and HKCU is a common persistence location where programs are registered to execute automatically at every user login.

Question 127: Which CHFI-relevant tool is specifically designed to recover and analyze SQLite database files commonly found on mobile devices and applications?

DB Browser for SQLite (Correct answer)
Wireshark
FTK Imager
Volatility

Correct answer: DB Browser for SQLite

DB Browser for SQLite allows forensic investigators to open, view, and recover data from SQLite database files, which are widely used in mobile apps and desktop applications.

Question 128: During a database forensics investigation, an investigator finds rows in a SQL Server table with no matching audit records. What should be checked first?

The transaction log for direct inserts (Correct answer)
DNS logs
Firewall logs
Application event logs

Correct answer: The transaction log for direct inserts

Direct inserts bypassing the application layer appear in the transaction log even if application-level audit triggers did not fire.

Question 129: During behavioral analysis in a sandbox, a malware sample calls CreateRemoteThread targeting explorer.exe. What is the malware most likely attempting?

Establishing a reverse shell listener
Privilege escalation to SYSTEM
Deleting Volume Shadow Copies
Process injection to evade detection (Correct answer)

Correct answer: Process injection to evade detection

CreateRemoteThread is a common process injection API that injects and executes malicious code within the address space of a legitimate host process like explorer.exe.

Question 130: Which tool is commonly used by CHFI investigators to analyze email headers and trace email origins?

Metasploit
Wireshark
MXToolbox Email Header Analyzer (Correct answer)
Nmap

Correct answer: MXToolbox Email Header Analyzer

MXToolbox Email Header Analyzer parses raw email headers to display the routing path, timestamps, and originating IP addresses in an investigator-friendly format.

Question 131: An investigator notices that a malware sample modifies the SSDT (System Service Descriptor Table). This is an indicator of which malware category?

Fileless malware
Polymorphic virus
Kernel-mode rootkit (Correct answer)
User-mode RAT

Correct answer: Kernel-mode rootkit

Modifying the SSDT to redirect system calls to malicious routines is a classic kernel-mode rootkit technique used to hide processes, files, and network connections.

Question 132: What is 'forensic soundness' in the context of data acquisition?

Using only government-approved forensic software
Completing acquisition within a legally required time window
Ensuring the acquisition process does not alter original evidence and can be independently verified (Correct answer)
The absence of audio data from the acquired image

Correct answer: Ensuring the acquisition process does not alter original evidence and can be independently verified

Forensic soundness means the acquisition method preserves original evidence without modification and produces results that can be independently repeated and verified.

Question 133: Which tool is specifically designed for reconstructing TCP streams from packet captures to recover transferred files?

Metasploit
Nmap
NetworkMiner (Correct answer)
Aircrack-ng

Correct answer: NetworkMiner

NetworkMiner passively captures packets and automatically reassembles TCP streams to extract transferred files, credentials, and messages from network traffic.

Question 134: Which email authentication mechanism adds a digital signature to outgoing emails that can be verified to confirm the sender's domain integrity?

MX record
SPF
DKIM (Correct answer)
DMARC

Correct answer: DKIM

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to the email header that allows receivers to verify the email was not altered and originated from the claimed domain.

Question 135: Which Oracle database view provides information about all currently connected sessions and can help identify unauthorized access?

DBA_TABLES
V$DATAFILE
V$SESSION (Correct answer)
ALL_OBJECTS

Correct answer: V$SESSION

V$SESSION is a dynamic performance view in Oracle that displays information about all current database sessions including username, logon time, and program.

Question 136: During network-based forensic acquisition, which protocol is commonly used to stream a disk image over the network?

TFTP with block-size negotiation
FTP with passive mode
HTTP multipart file upload
netcat or dcfldd piped over SSH (Correct answer)

Correct answer: netcat or dcfldd piped over SSH

Forensic examiners commonly pipe dd or dcfldd output through netcat or SSH to transfer disk images over a network to a remote storage server.

Question 137: What is 'slack space' in the context of disk forensics?

The space between the end of a file and the end of its allocated cluster (Correct answer)
Unused partitions on a hard drive
Encrypted regions of a disk not accessible by the OS
Overwritten sectors that still contain recoverable data

Correct answer: The space between the end of a file and the end of its allocated cluster

Slack space is the residual storage area between the end of a file's logical content and the end of the last cluster allocated to it.

Question 138: What is 'chain of custody' documentation required to include for a forensic image to be admissible in court?

The suspect's signature acknowledging the acquisition occurred
Identity of each person who handled the evidence, dates/times of transfer, and condition of evidence at each transfer (Correct answer)
Only the hash value of the image is legally required
A signed affidavit from the forensic tool vendor confirming software accuracy

Correct answer: Identity of each person who handled the evidence, dates/times of transfer, and condition of evidence at each transfer

Chain of custody records must document every person who handled the evidence, when transfers occurred, and the evidence's condition, establishing an unbroken accountability trail from collection to court.

Question 139: Which acquisition order principle, based on volatility, should guide what is collected FIRST during live forensic response?

CPU registers and cache, then RAM, then swap space, then disk (Correct answer)
Disk first because it is the most stable evidence
Hard drive contents, then RAM, then network connections
Log files first because they will be overwritten by new events

Correct answer: CPU registers and cache, then RAM, then swap space, then disk

The order of volatility (RFC 3227) dictates collecting the most transient data first: CPU/cache → RAM → swap → network state → running processes → disk → archival media.

Question 140: Which of the following scenarios REQUIRES a live acquisition rather than a static (dead-box) acquisition?

A running database server with encrypted volumes that will lock on shutdown (Correct answer)
A USB drive found in a suspect's bag
A powered-off laptop found at a crime scene
A drive connected to a decommissioned workstation

Correct answer: A running database server with encrypted volumes that will lock on shutdown

Encrypted volumes are only accessible while the system is running and the keys are loaded in memory; shutting down would lock the encrypted data.

Question 141: A forensic investigator finds a file with a .txt extension but the file header shows 'FF D8 FF E0'. What does this indicate?

The file extension has been changed to hide a JPEG image (Correct answer)
The file is corrupted
The file is encrypted
The file uses Unicode encoding

Correct answer: The file extension has been changed to hide a JPEG image

The magic bytes FF D8 FF E0 identify a JPEG file; a .txt extension on such a file indicates deliberate obfuscation.

Question 142: In FAT32, what is the maximum supported file size?

4 GB minus 1 byte (Correct answer)
16 TB
2 GB
8 GB

Correct answer: 4 GB minus 1 byte

FAT32 uses a 32-bit file size field, limiting individual files to 4 GB minus 1 byte (4,294,967,295 bytes).

Question 143: During malware analysis, you observe that the sample reads from HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options. What capability does this suggest?

Persistence via debugger hijacking (Correct answer)
DLL search order hijacking
Registry-based keylogging
UAC bypass technique

Correct answer: Persistence via debugger hijacking

The Image File Execution Options (IFEO) registry key can be abused to redirect execution of a target program to a malicious binary using the Debugger value.

Question 144: Which Windows artifact stores the last 10 commands typed into the Run dialog box and is found in the registry?

HKCU\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU (Correct answer)
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager

Correct answer: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU

The RunMRU key stores the most recently used commands typed into the Run dialog, useful for tracking attacker activity.

Question 145: What term describes the area between the last partition and the end of the disk that is not allocated to any partition?

Unpartitioned space (Correct answer)
Disk slack
Slack space
Host protected area

Correct answer: Unpartitioned space

Unpartitioned space (also called unallocated space at the disk level) exists between the last partition boundary and the physical end of the disk.

Question 146: What is the purpose of the $MFT file in NTFS forensics?

It logs all file access timestamps in real time
It stores encrypted file system keys
It contains the Windows boot sector and partition layout
It is the Master File Table containing metadata for every file and directory on the volume (Correct answer)

Correct answer: It is the Master File Table containing metadata for every file and directory on the volume

The $MFT (Master File Table) is the core NTFS structure storing file name, size, timestamps, and data location for every file.

Question 147: What is the forensic significance of 'slack space' that makes it relevant to anti-forensics investigations?

It is a dedicated area for storing deleted files before final purge
It is the unused space between the end of a file and the end of its allocated cluster that may contain remnant data (Correct answer)
It stores encrypted data that cannot be accessed without a key
It refers to RAM not used by running processes

Correct answer: It is the unused space between the end of a file and the end of its allocated cluster that may contain remnant data

Slack space is the unused portion between the end of a file and the end of its allocated storage cluster, which may retain remnant data from previously stored files.

Question 148: An investigator is tasked with determining which files a specific user recently accessed through the Windows taskbar or Start Menu. The user heavily used applications like Microsoft Word and Notepad. Which artifact would be the most efficient to analyze for this information?

Volume Shadow Copies (VSS)
The NTUSER.DAT registry hive's MRU lists
The hiberfil.sys file
Jump Lists (.automaticDestinations-ms files) (Correct answer)

Correct answer: Jump Lists (.automaticDestinations-ms files)

Jump Lists are a Windows feature designed to give users quick access to recently opened files and applications directly from the taskbar or Start Menu. These are stored as `.automaticDestinations-ms` and `.customDestinations-ms` files within the user's profile and are an excellent source for determining recent user activity within specific programs.

Question 149: A ransomware sample generates a unique key per victim and sends it to a C2 server before encrypting files. If the C2 is taken down before the key is transmitted, what is the most likely forensic implication?

The encryption key is permanently lost
The ransomware will fail to encrypt any files
Decryption may be possible from memory artifacts (Correct answer)
Backup shadow copies will remain intact

Correct answer: Decryption may be possible from memory artifacts

If the key was generated in memory before transmission, forensic memory analysis may recover it from RAM dumps or hibernation files before it is overwritten.

Question 150: What type of data can be recovered from a Facebook account's 'Download Your Information' feature that is useful in forensic investigations?

Only public posts
Messages, posts, friends list, login activity, and location history (Correct answer)
Only payment information
Only profile photos

Correct answer: Messages, posts, friends list, login activity, and location history

Facebook's Download Your Information feature exports a comprehensive archive including private messages, post history, friend connections, IP-based login activity, and location data.

Question 151: In NTFS, which metadata file stores the location of all other metadata files and is always located at the beginning of the volume?

$LogFile
$MFT (Correct answer)
$Bitmap
$Boot

Correct answer: $MFT

The $MFT (Master File Table) is the first file in an NTFS volume and contains records for every file and directory on the volume.

EC-Council CHFI (312-49) Certification Exam

The EC-Council Computer Hacking Forensic Investigator (CHFI) v11 certification validates professionals in detecting cyberattacks, extracting digital evidence, and reporting cybercrime findings for legal proceedings.

150

Questions

240 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

cert.eccouncil.org — Score validity, test delivery, score release, passing score, eligibility, fees, exam information · verified Nov 2026
eccouncil.org — Exam format, time limit · verified Nov 2026