CHFI General MCQ 5

Question 1

In the context of email forensics, which header field reveals the originating IP address of the sender's mail client?

Accepted Answer

Received:

Answer

The 'Received:' header chain in an email message traces the path of the message and typically includes the originating IP address of the sending client.

Question 2

Which forensic framework provides a Python-based API for analyzing memory dumps, including support for Windows, Linux, and macOS profiles?

Accepted Answer

Volatility

Answer

Volatility is an open-source memory forensics framework with a plugin-based architecture for analyzing RAM dumps across multiple operating systems.

Question 3

An investigator needs to prove that a forensic image is an exact copy of the original drive. Which two hash values are typically computed and compared?

Accepted Answer

MD5 and SHA-1

Answer

MD5 and SHA-1 are the two hash algorithms most commonly used together in forensic tools like FTK Imager to verify image integrity.

Question 4

What is a 'dead-box' forensic examination?

Accepted Answer

Forensic analysis of a powered-off device using an acquired image

Answer

Dead-box forensics refers to examining a device that has been powered off, typically through analysis of a forensic disk image.

Question 5

Which artifact in Windows records recently opened files and folders and is used by the system to populate the 'Recent Items' list?

Accepted Answer

LNK (shortcut) files

Answer

LNK (shortcut) files are automatically created in the Recent Items folder and record metadata about files recently opened, including original file path and timestamps.

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI General MCQ 5