CHFI Forensic Investigation Process 5 — Questions and Answers
Question 1: A suspect claims a file was never opened. Which forensic artifact would BEST refute or support this claim on a Windows system?
- Windows Event Log (Security)
- Prefetch files and LNK files (shell items) (Correct answer)
- MFT file size records
- Registry hive creation dates
Correct answer: Prefetch files and LNK files (shell items)
Prefetch files record application execution history, and LNK (shortcut) files record recently accessed files, directly countering or corroborating the suspect's claim.
Question 2: During an investigation, an examiner must testify that a forensic tool correctly acquired evidence. What is the best way to establish tool reliability?
- State the tool is popular among investigators
- Reference the tool's vendor marketing materials
- Cite independent validation studies or tool qualification results from NIST CFTT (Correct answer)
- Demonstrate the tool can export data in multiple formats
Correct answer: Cite independent validation studies or tool qualification results from NIST CFTT
NIST's Computer Forensics Tool Testing (CFTT) program provides independent validation of forensic tools, establishing their reliability in court.
Question 3: Which international standard provides guidance on digital evidence collection and handling?
- ISO/IEC 27037 (Correct answer)
- NIST SP 800-53
- PCI DSS v4.0
- RFC 3227
Correct answer: ISO/IEC 27037
ISO/IEC 27037 provides international guidelines for the identification, collection, acquisition, and preservation of digital evidence.
Question 4: An investigator finds that the MAC times on key files have been modified. What type of anti-forensic technique was most likely used?
- Steganography
- Timestomping (Correct answer)
- Data wiping
- Encryption
Correct answer: Timestomping
Timestomping is an anti-forensic technique where an attacker alters file MAC (Modified, Accessed, Created) timestamps to obscure the timeline.
Question 5: What is the primary goal of the 'containment' step when a forensic investigation overlaps with an active incident response?
- Preserve all volatile data before it is lost
- Stop the spread of the incident while minimizing disruption and preserving evidence (Correct answer)
- Shut down all affected systems immediately
- Begin prosecuting the suspect
Correct answer: Stop the spread of the incident while minimizing disruption and preserving evidence
Containment aims to prevent further damage or spread of the incident while balancing the need to preserve as much forensic evidence as possible.
Question 6: A forensic investigator is documenting the scene before touching any evidence. Which documentation method provides the most comprehensive scene record?
- Handwritten notes only
- Photographs, video, sketches, and written notes combined (Correct answer)
- A single photograph of the workstation
- A verbal description recorded on audio
Correct answer: Photographs, video, sketches, and written notes combined
Combining photographs, video, sketches, and written notes provides the most thorough and legally defensible documentation of the original crime scene.
Question 7: In the context of CHFI, what does 'anti-forensics' refer to?
- Techniques investigators use to recover deleted data
- Methods used to obstruct, manipulate, or eliminate evidence to hinder a forensic investigation (Correct answer)
- The legal process for challenging forensic evidence in court
- Encryption applied to forensic images for secure transport
Correct answer: Methods used to obstruct, manipulate, or eliminate evidence to hinder a forensic investigation
Anti-forensics encompasses techniques like wiping, encryption, timestomping, and steganography used by attackers to hinder forensic investigations.
CHFI Forensic Investigation Process 5
A suspect claims a file was never opened.
Which forensic artifact would BEST refute or support this claim on a Windows system?