CHFI Forensic Investigation Process 5

Question 1

A suspect claims a file was never opened. Which forensic artifact would BEST refute or support this claim on a Windows system?

Accepted Answer

Prefetch files and LNK files (shell items)

Answer

Prefetch files record application execution history, and LNK (shortcut) files record recently accessed files, directly countering or corroborating the suspect's claim.

Question 2

During an investigation, an examiner must testify that a forensic tool correctly acquired evidence. What is the best way to establish tool reliability?

Accepted Answer

Cite independent validation studies or tool qualification results from NIST CFTT

Answer

NIST's Computer Forensics Tool Testing (CFTT) program provides independent validation of forensic tools, establishing their reliability in court.

Question 3

Which international standard provides guidance on digital evidence collection and handling?

Accepted Answer

ISO/IEC 27037

Answer

ISO/IEC 27037 provides international guidelines for the identification, collection, acquisition, and preservation of digital evidence.

Question 4

An investigator finds that the MAC times on key files have been modified. What type of anti-forensic technique was most likely used?

Accepted Answer

Timestomping

Answer

Timestomping is an anti-forensic technique where an attacker alters file MAC (Modified, Accessed, Created) timestamps to obscure the timeline.

Question 5

What is the primary goal of the 'containment' step when a forensic investigation overlaps with an active incident response?

Accepted Answer

Stop the spread of the incident while minimizing disruption and preserving evidence

Answer

Containment aims to prevent further damage or spread of the incident while balancing the need to preserve as much forensic evidence as possible.

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI Forensic Investigation Process 5