CHFI General MCQ 2

Question 1

Which file system artifact records the last time a file was accessed on an NTFS volume?

Accepted Answer

$MFT entry timestamps

Answer

The $MFT (Master File Table) entry stores MACB timestamps, including last access time, for every file on an NTFS volume.

Question 2

During a live forensic acquisition, an investigator wants to capture volatile memory. Which tool is most appropriate?

Accepted Answer

WinPmem

Answer

WinPmem is a memory acquisition tool used to dump live RAM to a file on Windows systems.

Question 3

What is the primary purpose of the 'chain of custody' document in digital forensics?

Accepted Answer

Track evidence handling to preserve admissibility

Answer

Chain of custody tracks who handled evidence, when, and how to ensure it remains unaltered and legally admissible.

Question 4

An investigator finds a file with a .jpg extension but its hex header shows '50 4B 03 04'. What is the actual file type?

Accepted Answer

ZIP archive

Answer

The magic bytes '50 4B 03 04' are the signature for ZIP archive files, regardless of the file extension.

Question 5

Which Windows registry hive stores user-specific settings and is loaded from the user's profile directory?

Accepted Answer

HKEY_CURRENT_USER (NTUSER.DAT)

Answer

HKEY_CURRENT_USER maps to NTUSER.DAT in the user's profile folder and stores user-specific configuration.

CHFI - Computer Hacking Forensic Investigator Practice Test