CHFI General 3

Question 1

Which Windows registry hive stores user-specific settings and is critical for forensic investigations of user activity?

Accepted Answer

HKEY_CURRENT_USER

Answer

HKEY_CURRENT_USER (backed by the NTUSER.DAT hive) stores settings and activity data specific to the logged-in user.

Question 2

In network forensics, what does the term 'full packet capture' refer to?

Accepted Answer

Recording complete network packet content including payloads

Answer

Full packet capture records entire network packets, including headers and payload data, enabling comprehensive traffic reconstruction.

Question 3

What is the significance of the MFT (Master File Table) in NTFS forensics?

Accepted Answer

It contains metadata for every file and directory on the volume

Answer

The MFT is the core database of an NTFS volume, containing attributes including timestamps, file size, and data location for every object.

Question 4

Which anti-forensic technique involves hiding data within ordinary-looking files such as images or audio?

Accepted Answer

Steganography

Answer

Steganography conceals secret data within innocuous carrier files, making detection challenging without specialized tools.

Question 5

What is the purpose of the 'dd' command in Unix-based forensic investigations?

Accepted Answer

To create a bit-for-bit image of a storage device

Answer

The dd command copies data at the bit level, enabling forensic duplication of drives while preserving every byte including deleted data.

CHFI - Computer Hacking Forensic Investigator Practice Test