CHFI General 5

Question 1

Which file system metadata attribute in NTFS records the time a file's metadata was last changed, separate from its content modification time?

Accepted Answer

$STANDARD_INFORMATION Modified time

Answer

The $STANDARD_INFORMATION attribute holds four timestamps including the metadata change time, which is updated when file attributes change.

Question 2

What is the primary forensic significance of Windows Volume Shadow Copies (VSS)?

Accepted Answer

They provide historical point-in-time snapshots of files that may have been deleted or modified

Answer

VSS snapshots are forensically valuable because they preserve previous versions of files, enabling recovery of deleted or ransomware-encrypted data.

Question 3

During an intrusion investigation, which log source on a Windows system would best reveal successful and failed login attempts?

Accepted Answer

Security Event Log

Answer

The Windows Security Event Log records authentication events including successful logins (Event ID 4624) and failed attempts (Event ID 4625).

Question 4

What is 'data exfiltration' in the context of a cybersecurity incident investigation?

Accepted Answer

Unauthorized transfer of data from an organization to an external destination

Answer

Data exfiltration is the unauthorized copying or transfer of organizational data to an attacker-controlled location.

Question 5

Which forensic concept describes the practice of ensuring that the investigation process itself does not alter or contaminate the evidence?

Accepted Answer

Forensic soundness

Answer

Forensic soundness means that acquisition and analysis methods do not modify the original evidence and can be validated by hash verification.

CHFI - Computer Hacking Forensic Investigator Practice Test