CHFI General MCQ 3 — Questions and Answers
Question 1: Which of the following best describes steganography in the context of digital forensics?
- Encrypting files with a strong cipher
- Hiding data within another file or medium (Correct answer)
- Wiping free disk space to hide deleted files
- Using anonymizing proxies to hide network activity
Correct answer: Hiding data within another file or medium
Steganography is the practice of concealing secret data within ordinary, non-secret files such as images or audio files.
Question 2: A forensic examiner is analyzing a suspect's browser history. Which SQLite database file stores Chrome's browsing history?
- Cookies
- History (Correct answer)
- Web Data
- Login Data
Correct answer: History
Chrome stores browsing history in an SQLite file named 'History' located in the user's Chrome profile directory.
Question 3: What is the standard hashing algorithm recommended by NIST for generating forensic hash values to verify evidence integrity?
- MD5
- SHA-1
- SHA-256 (Correct answer)
- CRC32
Correct answer: SHA-256
NIST recommends SHA-256 for generating forensic hash values as it provides stronger collision resistance than MD5 or SHA-1.
Question 4: During a CHFI investigation, an examiner needs to analyze Windows event logs for failed logon attempts. Which Event ID should they filter for?
- 4624
- 4625 (Correct answer)
- 4648
- 4720
Correct answer: 4625
Event ID 4625 is logged in the Windows Security event log for every failed account logon attempt.
Question 5: Which type of forensic acquisition captures only the allocated (active) files and directories rather than the entire disk image?
- Bit-stream image
- Sparse acquisition
- Logical acquisition (Correct answer)
- Physical acquisition
Correct answer: Logical acquisition
Logical acquisition copies only the active file system contents, missing deleted files and unallocated space.
Question 6: An attacker uses timestomping to cover their tracks. What does this technique modify?
- Network packet timestamps in PCAP files
- File system MACB timestamps on modified files (Correct answer)
- Database transaction log timestamps
- Windows event log timestamps
Correct answer: File system MACB timestamps on modified files
Timestomping alters MACB (Modified, Accessed, Changed, Born) timestamps on files to obscure when they were created or modified.
Question 7: In mobile forensics, what does a 'logical extraction' of an iOS device typically retrieve?
- A raw NAND flash dump
- Decrypted keychain data
- iTunes backup-level data including app data and media (Correct answer)
- Physical sector-by-sector copy of the device storage
Correct answer: iTunes backup-level data including app data and media
Logical extraction of iOS devices retrieves data equivalent to an iTunes backup, including app data, media, and settings.
CHFI General MCQ 3
Which of the following best describes steganography in the context of digital forensics?