CHFI General 5 — Questions and Answers
Question 1: Which file system metadata attribute in NTFS records the time a file's metadata was last changed, separate from its content modification time?
- $STANDARD_INFORMATION Modified time (Correct answer)
- $FILE_NAME Modified time
- $DATA attribute timestamp
- MFT entry sequence number
Correct answer: $STANDARD_INFORMATION Modified time
The $STANDARD_INFORMATION attribute holds four timestamps including the metadata change time, which is updated when file attributes change.
Question 2: What is the primary forensic significance of Windows Volume Shadow Copies (VSS)?
- They contain live RAM snapshots for volatile data recovery
- They provide historical point-in-time snapshots of files that may have been deleted or modified (Correct answer)
- They log all user login and logout events
- They store BitLocker recovery keys for encrypted volumes
Correct answer: They provide historical point-in-time snapshots of files that may have been deleted or modified
VSS snapshots are forensically valuable because they preserve previous versions of files, enabling recovery of deleted or ransomware-encrypted data.
Question 3: During an intrusion investigation, which log source on a Windows system would best reveal successful and failed login attempts?
- Application Event Log
- Security Event Log (Correct answer)
- System Event Log
- PowerShell Operational Log
Correct answer: Security Event Log
The Windows Security Event Log records authentication events including successful logins (Event ID 4624) and failed attempts (Event ID 4625).
Question 4: What is 'data exfiltration' in the context of a cybersecurity incident investigation?
- The process of encrypting sensitive data for secure storage
- Unauthorized transfer of data from an organization to an external destination (Correct answer)
- Recovering deleted files from a compromised system
- Analyzing outbound firewall rules for misconfigurations
Correct answer: Unauthorized transfer of data from an organization to an external destination
Data exfiltration is the unauthorized copying or transfer of organizational data to an attacker-controlled location.
Question 5: Which forensic concept describes the practice of ensuring that the investigation process itself does not alter or contaminate the evidence?
- Evidence spoliation
- Forensic soundness (Correct answer)
- Admissibility standard
- Contemporaneous recording
Correct answer: Forensic soundness
Forensic soundness means that acquisition and analysis methods do not modify the original evidence and can be validated by hash verification.
Question 6: In cloud forensics investigations, which challenge is most unique compared to traditional disk forensics?
- Difficulty computing hash values of acquired data
- Multi-tenancy and lack of direct physical access to infrastructure (Correct answer)
- Inability to use standard forensic imaging tools
- Absence of log files in cloud environments
Correct answer: Multi-tenancy and lack of direct physical access to infrastructure
Cloud environments involve shared infrastructure across multiple tenants, making direct media access impossible and requiring cooperation with providers.
Question 7: Which type of malware analysis involves executing a suspicious file in an isolated environment to observe its behavior without reverse engineering its code?
- Static analysis
- Dynamic analysis (Correct answer)
- Code review
- Signature-based analysis
Correct answer: Dynamic analysis
Dynamic analysis runs malware in a controlled sandbox to capture runtime behaviors such as network connections, file drops, and registry modifications.
CHFI General 5
Which file system metadata attribute in NTFS records the time a file's metadata was last changed, separate from its content modification time?