CHFI General MCQ 4

Question 1

Which artifact on a Windows system records the first and last execution time of applications along with a run count?

Accepted Answer

Registry UserAssist key

Answer

The UserAssist registry key in HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist records application execution counts and timestamps in ROT13-encoded format.

Question 2

What is the role of the 'slack space' in a forensic disk investigation?

Accepted Answer

Space between end of a file and end of its last cluster

Answer

File slack space is the area between the logical end of a file and the end of the last cluster allocated to it, which may contain remnant data.

Question 3

A CHFI investigator discovers an encrypted TrueCrypt/VeraCrypt container. Which approach is legally and forensically sound?

Accepted Answer

Image the container and attempt password attacks in a lab environment

Answer

The correct approach is to image the encrypted container and perform password/brute-force attacks against the copy in a controlled lab to avoid altering the original.

Question 4

Which Windows artifact is a binary file created by the OS to speed up application launches and can reveal execution history?

Accepted Answer

Prefetch files (.pf)

Answer

Prefetch files (.pf) are created by Windows to speed up application loading and contain metadata about the last run times and file paths accessed.

Question 5

During cloud forensics, which type of data is most difficult to acquire due to multi-tenancy and shared infrastructure?

Accepted Answer

RAM and live memory of running cloud instances

Answer

Live memory of cloud instances is extremely difficult to acquire forensically due to shared physical hardware, hypervisor isolation, and lack of investigator access to the host.

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI General MCQ 4