EC-Council CHFI (312-49) Certification Exam — Questions and Answers

Question 1: In NTFS, which metadata file records changes to the file system including file creation, modification, and deletion, and is essential for timeline analysis?

$LogFile
$Bitmap
$UsnJrnl:$J (Correct answer)
$Boot

Correct answer: $UsnJrnl:$J

The NTFS Change Journal ($UsnJrnl:$J) records file system changes with USN (Update Sequence Number) entries, enabling chronological reconstruction of file activity.

Question 2: During a forensic investigation, what does 'chain of custody' documentation primarily ensure?

That evidence is encrypted during transport
That evidence has not been tampered with and its handling is traceable (Correct answer)
That the suspect cannot contest the evidence in court
That only law enforcement can access the evidence

Correct answer: That evidence has not been tampered with and its handling is traceable

Chain of custody documents every person who handled the evidence and every action taken, ensuring its integrity and admissibility.

Question 3: Which acquisition method captures only the allocated, in-use clusters on a drive rather than every sector?

Live acquisition
Targeted acquisition
Sparse acquisition
Logical acquisition (Correct answer)

Correct answer: Logical acquisition

Logical acquisition copies only the active file system contents (allocated clusters), not unallocated space or slack space.

Question 4: During a web attack investigation, you find the string `' OR '1'='1` in server logs. What type of attack does this indicate?

SQL injection (Correct answer)
Cross-site scripting (XSS)
Command injection
Directory traversal

Correct answer: SQL injection

The string `' OR '1'='1` is a classic SQL injection payload used to bypass authentication by making a WHERE clause always evaluate to true.

Question 5: Which tool is specifically designed for reconstructing TCP streams from packet captures to recover transferred files?

NetworkMiner (Correct answer)
Nmap
Metasploit
Aircrack-ng

Correct answer: NetworkMiner

NetworkMiner passively captures packets and automatically reassembles TCP streams to extract transferred files, credentials, and messages from network traffic.

Question 6: A CHFI examiner wants to determine the exact time a specific user last logged into a Windows workstation interactively. Which is the most reliable forensic source?

The creation date of the user's profile directory
HKLM\SAM\SAM\Domains\Account\Users metadata
The user's NTUSER.DAT last-modified timestamp
Security event log event ID 4624 with Logon Type 2 or 10 (Correct answer)

Correct answer: Security event log event ID 4624 with Logon Type 2 or 10

Event ID 4624 with Logon Type 2 (interactive) or Type 10 (remote interactive/RDP) provides the precise timestamp and workstation name for each user logon.

Question 7: What does the MFT entry attribute $DATA contain in NTFS?

The file's security descriptor and ACL
The actual file content or data runs pointing to the file's data clusters (Correct answer)
The parent directory reference
The file's MAC timestamps

Correct answer: The actual file content or data runs pointing to the file's data clusters

The $DATA attribute in an MFT entry either contains the file's data directly (resident) or data runs that map to the clusters holding the file's content (non-resident).

Question 8: Which of the following is a legal concern when collecting evidence from a cloud storage provider?

Cloud data cannot be used as forensic evidence
Cloud evidence is always admissible without authentication
Jurisdiction and the need for legal process such as subpoenas or mutual legal assistance treaties (Correct answer)
Cloud providers are required to hand over data without any legal process

Correct answer: Jurisdiction and the need for legal process such as subpoenas or mutual legal assistance treaties

Cloud data may reside in foreign jurisdictions, requiring subpoenas, court orders, or mutual legal assistance treaties (MLATs) to obtain legally.

Question 9: Cloud forensics are divided into nine main groups, according to NIST.

True
False (Correct answer)

Correct answer: False

This statement is false. NIST (National Institute of Standards and Technology) has published extensive guidelines and frameworks for cloud computing and forensics, but they do not categorize cloud forensics into a specific number like 'nine main groups.' NIST documents typically define cloud deployment models, service models, and outline challenges and principles for cloud forensics, rather than a fixed number of groups.

Question 10: A web attack investigation reveals the server was sending `HTTP 301` redirects to users visiting certain pages. What should the forensic analyst check?

Whether the redirect destination was altered by an attacker post-compromise (Correct answer)
TLS handshake logs
User-Agent string mismatches
Database connection pool settings

Correct answer: Whether the redirect destination was altered by an attacker post-compromise

Attackers who gain server access sometimes inject 301 redirects in web configs or CMS settings to redirect users to phishing or malware delivery sites.

Question 11: Which field in an IIS web server log records the action method used in an HTTP request (GET, POST, PUT, etc.)?

cs-bytes
cs-method (Correct answer)
sc-status
cs-uri-stem

Correct answer: cs-method

The `cs-method` field in IIS W3C logs records the HTTP method (verb) used in the client's request.

Question 12: A suspect's drive shows a partition type code of 0x07 in the MBR partition table. What file system does this typically indicate?

Linux ext4
NTFS or exFAT (Correct answer)
FAT32
Linux swap

Correct answer: NTFS or exFAT

Partition type code 0x07 is assigned to NTFS (and exFAT) partitions in the MBR partition table scheme.

Question 13: During an intrusion investigation, which log source on a Windows system would best reveal successful and failed login attempts?

Application Event Log
System Event Log
Security Event Log (Correct answer)
PowerShell Operational Log

Correct answer: Security Event Log

The Windows Security Event Log records authentication events including successful logins (Event ID 4624) and failed attempts (Event ID 4625).

Question 14: During a Windows forensic investigation, an examiner identifies event ID 7045 in the System log. What does this event signify?

A new service was installed on the system (Correct answer)
A user account was locked out after repeated failed logon attempts
A removable disk was safely removed from the system
Windows Defender detected and quarantined malware

Correct answer: A new service was installed on the system

Event ID 7045 ('A new service was installed in the system') is a key indicator of malware or attacker persistence via malicious service installation.

Question 15: Which forensic recovery method is specifically used to recover files subjected to anti-forensic deletion by searching for file headers and footers in raw disk data?

File carving (data carving) (Correct answer)
Event log analysis
Hash verification
Live network traffic capture

Correct answer: File carving (data carving)

File carving recovers files by scanning raw disk data for known file headers and footers, bypassing file system structures that may have been manipulated, deleted, or corrupted.

Question 16: In Windows forensics, what does the acronym LNK file refer to and why is it forensically significant?

A Windows shortcut file that records metadata about accessed files including original path and timestamps (Correct answer)
A linked database file used by SQL Server to store transaction logs
A locked file handle record created when a file is opened exclusively
A network configuration file storing linked DNS resolver entries

Correct answer: A Windows shortcut file that records metadata about accessed files including original path and timestamps

LNK (shortcut) files automatically created in Recent Items contain metadata about accessed files including MAC times, file size, and original volume serial number.

Question 17: An investigator recovers a Windows system where the attacker cleared the Security event log. Which artifact may still contain evidence of the log clearing action?

The Application event log — event ID 1102
Both the System log (1074) and Application log (1000)
The Setup event log — event ID 2
The System event log — event ID 104 (Correct answer)

Correct answer: The System event log — event ID 104

Event ID 104 in the System log records when the Security log was cleared, and event ID 1102 in the Security log records the same action if any entries remain.

Question 18: What is the Host Protected Area (HPA) on a hard disk drive?

A special partition created by Windows for recovery files
The first track reserved for the MBR and partition table
A hidden area at the end of the disk that is excluded from normal OS disk size reporting (Correct answer)
An encrypted volume used to store credentials

Correct answer: A hidden area at the end of the disk that is excluded from normal OS disk size reporting

The HPA is a hidden region defined by ATA standard SET MAX ADDRESS commands that the BIOS and OS cannot normally detect, commonly used to hide data from forensic tools.

Question 19: What does the 'Date' field in an email header represent, and why must investigators treat it with caution?

The date the email was scanned by antivirus
The date set by the sender's email client, which can be manipulated by the sender (Correct answer)
The date the email was backed up
The date the email was received by the destination server, which is always accurate

Correct answer: The date set by the sender's email client, which can be manipulated by the sender

The Date header is set by the sender's mail client and can be manually altered, so investigators should corroborate it against 'Received' header timestamps from mail servers.

Question 20: If a crime is committed in a cloud environment, identify the specific offense that was committed there.

Cloud as a tool
Cloud as a subject (Correct answer)
Cloud as an object

Correct answer: Cloud as a subject

When a crime is committed *in* a cloud environment, meaning the cloud itself is the target or location of the criminal activity (e.g., data theft from a cloud server, unauthorized access to cloud resources), it is categorized as 'Cloud as a Subject.' This distinguishes it from using the cloud as a tool to commit a crime elsewhere or the cloud being the object of a crime (e.g., the cloud provider itself being attacked).

Question 21: In database forensics, what information can be extracted from the MySQL ibdata1 file?

Only index data
Only table schemas
InnoDB tablespace data including deleted records not yet purged (Correct answer)
Only stored procedures

Correct answer: InnoDB tablespace data including deleted records not yet purged

The ibdata1 file is the InnoDB shared tablespace and contains table data, indexes, and potentially deleted records that have not yet been purged by InnoDB's background purge process.

Question 22: An investigator finds that an attacker used `UNION SELECT NULL, username, password FROM users--` in a web request. What is this technique called?

Error-based SQL injection
Time-based SQL injection
Blind SQL injection
UNION-based SQL injection (Correct answer)

Correct answer: UNION-based SQL injection

UNION-based SQL injection appends a UNION SELECT statement to extract data from other database tables into the application's response.

Question 23: In a PostgreSQL forensic investigation, which directory contains the server log files by default?

$PGDATA/global
$PGDATA/pg_wal
$PGDATA/pg_stat
$PGDATA/log (Correct answer)

Correct answer: $PGDATA/log

PostgreSQL writes server log files to the $PGDATA/log directory by default, recording connections, errors, and optionally all SQL statements.

Question 24: What does the NTFS $LogFile record, and why is it forensically valuable?

User login events and failed authentication attempts
Transactional metadata changes to the file system, allowing reconstruction of recent file operations (Correct answer)
Content of recently opened documents
Network connections associated with file transfers

Correct answer: Transactional metadata changes to the file system, allowing reconstruction of recent file operations

The NTFS $LogFile is a circular transaction log that records metadata changes; forensic tools can parse it to reconstruct file creation, deletion, and renaming events even after file system operations.

Question 25: What network forensics technique involves correlating traffic across multiple capture points to trace the path of an attacker through the network?

Packet carving
Protocol decoding
Traffic path reconstruction (Correct answer)
Deep packet inspection

Correct answer: Traffic path reconstruction

Traffic path reconstruction correlates timestamps and connection metadata from multiple network taps or logs to trace how an attacker moved laterally through network segments.

Question 26: What does Windows event ID 4688 record and why is it forensically valuable?

A file was deleted from the Recycle Bin
A new process was created, including the process name and parent process (Correct answer)
A user account password was changed
A shared network resource was accessed remotely

Correct answer: A new process was created, including the process name and parent process

Event ID 4688 logs process creation events with executable path and parent PID, enabling investigators to reconstruct attacker command execution chains.

Question 27: Which protocol allows forensic examiners to extract data from older iPhones by exploiting vulnerabilities in the DFU mode?

Cellebrite UFED premium
iCloud backup extraction
GrayKey hardware method
checkm8 bootrom exploit (Correct answer)

Correct answer: checkm8 bootrom exploit

The checkm8 bootrom exploit targets an unpatchable vulnerability in Apple's A5-A11 chips, enabling DFU-mode extraction of encrypted data.

Question 28: In investigating a Twitter/X account for evidence, which API does law enforcement reference for legal data requests to the platform?

Twitter Developer API v2 public endpoints
WHOIS API
Google Safe Browsing API
Twitter's Legal Request Submission portal under the Stored Communications Act (Correct answer)

Correct answer: Twitter's Legal Request Submission portal under the Stored Communications Act

Law enforcement submits legal requests for Twitter/X user data through Twitter's official legal request portal, following the Stored Communications Act framework for subpoenas and warrants.

Question 29: During investigation of a web compromise, the analyst finds `/etc/passwd` content in a server response. Which vulnerability was likely exploited?

Open redirect
Local file inclusion (LFI) (Correct answer)
Insecure deserialization
Cross-site request forgery (CSRF)

Correct answer: Local file inclusion (LFI)

Local File Inclusion (LFI) allows an attacker to read arbitrary files on the server, such as `/etc/passwd`, by manipulating file path parameters.

Question 30: What is the primary purpose of using 'segment files' (e.g., E01.E01, E01.E02...) during forensic acquisition?

To allow parallel hashing of each segment separately
To encrypt each segment with a different key for security
To allow different examiners to work on separate segments simultaneously
To accommodate file system size limits and enable splitting across multiple storage media (Correct answer)

Correct answer: To accommodate file system size limits and enable splitting across multiple storage media

Forensic image segmentation splits large images into manageable chunks to work within file system limitations (e.g., FAT32's 4GB limit) or to span multiple storage devices.

Question 31: What is the Device Configuration Overlay (DCO) on ATA hard drives?

The error correction code area on each track
A diagnostic partition created by the manufacturer
A hidden area similar to HPA that restricts features and capacity visible to the OS and BIOS (Correct answer)
A firmware update mechanism for hard drives

Correct answer: A hidden area similar to HPA that restricts features and capacity visible to the OS and BIOS

DCO is an ATA feature that allows manufacturers or users to permanently hide disk capacity and features; like HPA, it requires special ATA commands to detect.

Question 32: In database forensics, which log file type records every transaction and database modification for SQL Server?

Error log
Transaction log (.ldf) (Correct answer)
Audit log
Event log

Correct answer: Transaction log (.ldf)

The SQL Server transaction log (.ldf) records all transactions and database modifications, making it critical for forensic timeline reconstruction.

Question 33: A CHFI is conducting dynamic analysis of a suspected ransomware sample in an isolated, sandboxed environment. Which of the following actions would be the primary focus of the analyst's monitoring to confirm the malware's classification and behavior?

Checking for an increase in CPU usage and memory consumption by the suspicious process.
Analyzing the PE header of the file to determine the compile time and linked libraries.
Observing rapid and widespread file read/write/rename operations, especially with a new file extension being added. (Correct answer)
Extracting all embedded strings from the binary to look for keywords like 'encrypt'.

Correct answer: Observing rapid and widespread file read/write/rename operations, especially with a new file extension being added.

Dynamic analysis focuses on observing the malware's behavior at runtime. The defining characteristic of ransomware is its encryption of user files. Therefore, monitoring for high-volume file system I/O, particularly operations that involve reading original files and writing newly encrypted versions (often with a specific extension), is the most direct way to observe and confirm its malicious intent.

Question 34: Which Volatility 3 plugin would an investigator use to extract network connections (including those in CLOSE_WAIT and TIME_WAIT states) from a Windows memory image?

windows.connections
windows.sockets
windows.netscan (Correct answer)
windows.netstat

Correct answer: windows.netscan

windows.netscan scans memory pools for network structures and recovers connections in various TCP states including those that windows.netstat would miss.

Question 35: An analyst examining a compromised web server finds an `.htaccess` file modified to redirect all traffic to an external malicious site. What type of attack occurred?

SQL injection
DNS poisoning
Web server configuration tampering / malicious redirect (Correct answer)
Denial of service

Correct answer: Web server configuration tampering / malicious redirect

Modifying `.htaccess` to redirect visitors to a malicious site is a web defacement/compromise technique used after gaining write access to the server.

Question 36: Which artifact from a Windows system BEST helps determine what files were recently accessed by malware running under a specific user account?

NTUSER.DAT RecentDocs and OpenSave MRU keys (Correct answer)
Prefetch file execution counts
Amcache.hve entries
Event Log ID 4688 entries

Correct answer: NTUSER.DAT RecentDocs and OpenSave MRU keys

The RecentDocs and OpenSave MRU registry keys in NTUSER.DAT record files recently opened or saved by the user account, revealing malware file access patterns.

Question 37: Which anti-forensic technique involves hiding data within ordinary-looking files such as images or audio?

Log tampering
Data wiping
Timestamp manipulation
Steganography (Correct answer)

Correct answer: Steganography

Steganography conceals secret data within innocuous carrier files, making detection challenging without specialized tools.

Question 38: In which location does Microsoft Outlook store emails, contacts, and calendar data in a local file format?

.pst or .ost file (Correct answer)
.mbox file
.msg file
.eml file

Correct answer: .pst or .ost file

Outlook stores local email data in Personal Storage Table (.pst) files for local storage and Offline Storage Table (.ost) files for cached Exchange mailbox data.

Question 39: Which of the following phases does the aforementioned duties take place in when performing the many phases of cloud forensics, one of which involves resolving functional, operational, and security issues in the cloud ecosystem?

Troubleshooting (Correct answer)
Investigation
Lof Monitoring
Data and system Recovery

Correct answer: Troubleshooting

The troubleshooting phase in cloud forensics involves identifying and resolving various issues that can arise within the complex cloud ecosystem. This includes addressing functional problems, operational inefficiencies, and security vulnerabilities that might impact the integrity of data or the forensic investigation itself. It's a proactive and reactive process to ensure the cloud environment is stable and secure for forensic activities and to overcome challenges in evidence collection.

Question 40: During investigation, an analyst finds that a system sent a DHCP request claiming to be a different device's MAC address. This attack is called:

MAC spoofing (Correct answer)
DHCP starvation
IP spoofing
Rogue DHCP server attack

Correct answer: MAC spoofing

MAC spoofing involves changing the source MAC address in frames to impersonate another device, which can be detected by comparing DHCP requests against switch MAC address tables.

Question 41: An examiner acquires a drive and calculates an MD5 hash that differs from the hash taken by the first responder. What is the MOST likely conclusion?

The file system was journaled, causing automatic hash changes
The evidence was altered or the chain of custody was broken between acquisitions (Correct answer)
The forensic tool used a different sector size
The hash mismatch is expected because MD5 is non-deterministic

Correct answer: The evidence was altered or the chain of custody was broken between acquisitions

A hash mismatch between acquisition points indicates that data changed, suggesting evidence tampering or a broken chain of custody.

Question 42: What is the purpose of analyzing the 'Bcc' (Blind Carbon Copy) field in email forensics investigations?

Bcc prevents the email from being forwarded
Bcc recipients are hidden from other recipients but may appear in server logs or sender's sent folder, revealing hidden communication parties (Correct answer)
Bcc is always visible in email headers and easy to read
Bcc encrypts the email content

Correct answer: Bcc recipients are hidden from other recipients but may appear in server logs or sender's sent folder, revealing hidden communication parties

While Bcc recipients are invisible to To/Cc recipients, mail server logs, the sender's sent items, and mail server transaction logs may reveal who received Bcc copies.

Question 43: In CHFI investigations of web attacks, what is the PRIMARY purpose of hashing web server log files upon collection?

To ensure the integrity of log evidence and detect any post-collection tampering (Correct answer)
To compress the logs for storage efficiency
To encrypt the logs from unauthorized access
To index the logs for faster searching

Correct answer: To ensure the integrity of log evidence and detect any post-collection tampering

Hashing log files (e.g., with SHA-256) at the time of collection creates a verifiable integrity record, proving the evidence has not been altered since acquisition.

Question 44: A forensic investigator notices repeated POST requests to `/wp-login.php` with hundreds of different passwords. What attack type is this?

Credential stuffing
Password spraying
Dictionary attack
Brute-force attack (Correct answer)

Correct answer: Brute-force attack

Repeated login attempts against a single account with many passwords characterizes a brute-force attack.

Question 45: When investigating a social media account on Facebook, which legal process in the US must law enforcement typically follow to obtain private user data from Meta?

Subpoena, court order, or search warrant depending on the data type (Correct answer)
Informal request via email to Meta
FOIA request
DNS lookup

Correct answer: Subpoena, court order, or search warrant depending on the data type

Under the Stored Communications Act (SCA), law enforcement must use a subpoena for basic subscriber info, a court order for non-content records, and a search warrant for private message content.

Question 46: Which of the following scenarios REQUIRES a live acquisition rather than a static (dead-box) acquisition?

A running database server with encrypted volumes that will lock on shutdown (Correct answer)
A powered-off laptop found at a crime scene
A drive connected to a decommissioned workstation
A USB drive found in a suspect's bag

Correct answer: A running database server with encrypted volumes that will lock on shutdown

Encrypted volumes are only accessible while the system is running and the keys are loaded in memory; shutting down would lock the encrypted data.

Question 47: Which of the following is a PRIMARY advantage of using EnCase's E01 format over a raw dd image?

E01 images are always smaller due to mandatory compression
E01 images can be mounted natively by all Linux distributions
E01 format does not require a write blocker during acquisition
E01 embeds case metadata and a hash for integrity verification within the file (Correct answer)

Correct answer: E01 embeds case metadata and a hash for integrity verification within the file

The E01 (Expert Witness) format stores case metadata, examiner notes, and MD5/SHA-1 hashes inside the image container itself for built-in integrity verification.

Question 48: What is 'passive OS fingerprinting' in network forensics?

Examining installed patches on a target system
Sending probe packets to determine a remote system's OS
Identifying operating systems by analyzing characteristics of traffic they generate without sending probes (Correct answer)
Scanning open ports to match known OS signatures

Correct answer: Identifying operating systems by analyzing characteristics of traffic they generate without sending probes

Passive OS fingerprinting identifies remote operating systems by analyzing observable TCP/IP stack characteristics (TTL values, TCP window sizes, flag combinations) in captured traffic without generating any probe traffic.

Question 49: A web application firewall (WAF) log shows a block event for a request containing `SLEEP(5)` in a parameter. What attack technique was attempted?

Time-based blind SQL injection (Correct answer)
HTTP response splitting
Remote file inclusion
Reflected XSS

Correct answer: Time-based blind SQL injection

Time-based blind SQL injection uses functions like `SLEEP()` to cause database delays, inferring information based on response time when no data is returned directly.

Question 50: A forensic investigator needs to determine which USB devices were ever connected to a Windows system. Which registry key is the primary source?

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR (Correct answer)
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2
HKLM\SYSTEM\CurrentControlSet\Enum\USB

Correct answer: HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR

HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR logs all USB storage devices ever connected, including vendor and product IDs.

Question 51: What is the significance of the SQL Server 'default trace' in a forensic investigation?

It monitors network bandwidth usage
It logs all SELECT queries by default
It monitors CPU usage by queries
It captures database object changes, login failures, and DBCC events by default without configuration (Correct answer)

Correct answer: It captures database object changes, login failures, and DBCC events by default without configuration

SQL Server's default trace automatically captures key security and administrative events like object creation/deletion, login failures, and DBCC commands without requiring manual configuration.

Question 52: Which Oracle audit trail type stores audit records in OS files rather than within the database itself?

OS audit trail (Correct answer)
Fine-grained auditing
Unified auditing
Database audit trail

Correct answer: OS audit trail

The OS audit trail writes audit records to the operating system audit log, making them harder for a compromised DBA to tamper with.

Question 53: When analyzing a suspect's network traffic, an investigator observes large ICMP packets with payloads containing structured data. This suggests:

ICMP tunneling for covert data exfiltration (Correct answer)
Fragmentation reassembly issues
Normal network diagnostics
IPv6 transition mechanism

Correct answer: ICMP tunneling for covert data exfiltration

ICMP tunneling embeds data inside ICMP echo request/reply payloads, exploiting protocols often allowed through firewalls to create a covert communication channel.

Question 54: A CHFI investigator recovers a file from a Linux system that has been deleted but whose inode has not yet been reallocated. Which command can recover the file content using its inode number?

extundelete --restore-inode <inode> /dev/sdX
grep -a <inode> /dev/sdX
fsck -r <inode> /dev/sdX
debugfs -R 'cat <inode>' /dev/sdX (Correct answer)

Correct answer: debugfs -R 'cat <inode>' /dev/sdX

debugfs is an ext2/3/4 filesystem debugger that can read data blocks associated with a specific inode, enabling direct recovery of deleted file content.

Question 55: Which SQL Server feature, when enabled, records all login attempts including failed ones, and is critical for forensic investigations?

SQL Server Audit (Correct answer)
Replication
Change Data Capture
Database Mirroring

Correct answer: SQL Server Audit

SQL Server Audit tracks and logs SQL Server and database-level events including successful and failed login attempts, providing a forensic audit trail.

Question 56: Which log file on a Linux Apache server would contain evidence of a PHP web shell being executed?

/var/log/kern.log
/var/log/auth.log
/var/log/apache2/error.log and access.log (Correct answer)
/var/log/syslog

Correct answer: /var/log/apache2/error.log and access.log

Apache's access.log records every request including to uploaded PHP shells, while error.log may show PHP execution errors triggered by the attacker.

Question 57: A forensic investigator finds that attacker requests used chunked transfer encoding with abnormal chunk sizes. What might this indicate?

An attempt to evade WAF/IDS signature detection by obfuscating the payload (Correct answer)
Normal CDN behavior
An HTTP/2 protocol upgrade
A legitimate compression technique

Correct answer: An attempt to evade WAF/IDS signature detection by obfuscating the payload

Attackers sometimes use chunked transfer encoding to split malicious payloads across chunks, evading WAF and IDS signatures that inspect full request bodies.

Question 58: An investigator is analyzing a Windows 10 system to determine which external storage devices have been previously connected. Which Registry hive and key would provide the most direct evidence of USB devices, including vendor and product IDs?

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\TypedURLs
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR (Correct answer)
HKEY_LOCAL_MACHINE\SAM\Domains\Account\Users

Correct answer: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR

The `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR` registry key is specifically designed to enumerate USB Mass Storage Devices that have been connected to the system. It contains subkeys for each unique device, which in turn store details like the device's vendor ID, product ID, and unique serial number.

Question 59: A malware sample achieves persistence by adding an entry under HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run using a living-off-the-land binary. Which binary would be LEAST expected in this context?

taskmgr.exe (Correct answer)
wscript.exe
regsvr32.exe
mshta.exe

Correct answer: taskmgr.exe

taskmgr.exe is the Task Manager and is not a LOLBin commonly abused for script execution or payload loading; regsvr32, mshta, and wscript are classic LOLBins used for persistence.

Question 60: What type of attack involves inserting malicious SQL code into a query to extract or manipulate database data, and is commonly investigated in CHFI database forensics?

Cross-site scripting
Buffer overflow
ARP poisoning
SQL injection (Correct answer)

Correct answer: SQL injection

SQL injection attacks insert malicious SQL statements into input fields to manipulate database queries, often leaving traces in web server logs and database logs.

Question 61: What is 'slack space' and which two types are relevant to NTFS forensics?

Unused sectors at the disk end; types are disk slack and partition slack
Unused space within the last cluster of a file and unused bytes in the last sector of that cluster; file slack and RAM slack (Correct answer)
Padding in directory entries and padding in MFT records; directory slack and record slack
Free space in the MFT and free space in unallocated clusters; MFT slack and cluster slack

Correct answer: Unused space within the last cluster of a file and unused bytes in the last sector of that cluster; file slack and RAM slack

File slack is the unused space between the end of a file's logical data and the end of its last allocated cluster; RAM slack (within the sector) may contain remnant memory data, both can hold hidden or residual data.

Question 62: Which type of forensic acquisition captures only the allocated (active) files and directories rather than the entire disk image?

Bit-stream image
Sparse acquisition
Physical acquisition
Logical acquisition (Correct answer)

Correct answer: Logical acquisition

Logical acquisition copies only the active file system contents, missing deleted files and unallocated space.

Question 63: Which Windows registry hive stores the most recently accessed files and applications, useful for establishing user activity timelines?

HKEY_USERS\.DEFAULT
HKEY_LOCAL_MACHINE\SYSTEM
HKEY_LOCAL_MACHINE\SAM
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs (Correct answer)

Correct answer: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

The RecentDocs registry key tracks files recently opened by the user in Windows Explorer, providing a timeline of file access.

Question 64: A Windows system was shut down abruptly. Which file can help a forensic investigator recover the contents of RAM at the time of shutdown?

pagefile.sys
bootmgr
swapfile.sys
hiberfil.sys (Correct answer)

Correct answer: hiberfil.sys

hiberfil.sys stores a compressed image of RAM when the system hibernates, allowing recovery of memory contents including running processes and open files.

Question 65: An analyst captures traffic and notices that HTTP responses contain an unusually large number of Set-Cookie headers with random-looking values. This may indicate:

Normal CDN cache-control behavior
Cookie-based data exfiltration or C2 channel using HTTP (Correct answer)
A standard e-commerce session management system
HTTP/2 server push functionality

Correct answer: Cookie-based data exfiltration or C2 channel using HTTP

Malware can use HTTP cookies to smuggle data and commands between compromised hosts and C2 servers, with encoded payloads embedded in seemingly legitimate cookie values.

Question 66: A forensic examiner uses write-blockers when imaging a hard drive. What is the main reason for using a write-blocker?

To prevent any modification to the original evidence drive (Correct answer)
To decrypt encrypted partitions
To verify the hash of the cloned image
To speed up the imaging process

Correct answer: To prevent any modification to the original evidence drive

Write-blockers prevent any write operations from reaching the original drive, maintaining its forensic integrity.

Question 67: What forensic technique involves comparing database schema versions to identify unauthorized structural changes?

Schema diffing (Correct answer)
Query profiling
Log tailing
Index fragmentation analysis

Correct answer: Schema diffing

Schema diffing compares two versions of a database schema to detect unauthorized additions, modifications, or deletions of tables, columns, or stored procedures.

Question 68: In FTK Imager, what does the 'Verify images after they are created' option do?

Re-images the drive a second time to compare both images
Checks the image for file system errors using chkdsk
Reads the completed image and recalculates the hash to confirm it matches the acquisition hash (Correct answer)
Submits the image hash to an online verification database

Correct answer: Reads the completed image and recalculates the hash to confirm it matches the acquisition hash

FTK Imager's post-acquisition verification reads the completed image file and recalculates its hash, confirming it matches the hash computed during acquisition.

Question 69: Which forensic evidence would confirm that a VPN tunnel was established between two hosts, even if the tunneled content is encrypted?

ICMP echo-reply messages
TCP RST packets between the hosts
HTTP GET requests in cleartext
Presence of encapsulating protocols such as GRE, ESP, or OpenVPN's UDP traffic on known VPN ports (Correct answer)

Correct answer: Presence of encapsulating protocols such as GRE, ESP, or OpenVPN's UDP traffic on known VPN ports

VPN protocols leave identifiable traces such as ESP (IPsec), GRE encapsulation headers, or UDP traffic on well-known VPN ports (e.g., 1194 for OpenVPN, 500/4500 for IKE) even when payload is encrypted.

Question 70: When a hacker utilizes one compromised cloud to attack additional accounts, they are using the cloud as a tool.

True (Correct answer)
False

Correct answer: True

This statement is true. When a hacker leverages a compromised cloud environment (e.g., using a compromised virtual machine or cloud account) to launch attacks against other targets, the cloud infrastructure is serving as an instrument or means to facilitate the crime. In this scenario, the cloud is not the victim or the location of the crime, but rather the 'tool' used by the perpetrator to achieve their malicious goals.

Question 71: What is 'forensic soundness' in the context of data acquisition?

Completing acquisition within a legally required time window
Ensuring the acquisition process does not alter original evidence and can be independently verified (Correct answer)
Using only government-approved forensic software
The absence of audio data from the acquired image

Correct answer: Ensuring the acquisition process does not alter original evidence and can be independently verified

Forensic soundness means the acquisition method preserves original evidence without modification and produces results that can be independently repeated and verified.

Question 72: What is the purpose of the $MFT file in NTFS forensics?

It contains the Windows boot sector and partition layout
It logs all file access timestamps in real time
It is the Master File Table containing metadata for every file and directory on the volume (Correct answer)
It stores encrypted file system keys

Correct answer: It is the Master File Table containing metadata for every file and directory on the volume

The $MFT (Master File Table) is the core NTFS structure storing file name, size, timestamps, and data location for every file.

Question 73: Which tool would a CHFI investigator use to detect anti-forensic timestomping performed by malware on a Windows NTFS system?

Comparing $STANDARD_INFORMATION and $FILE_NAME timestamps in the MFT (Correct answer)
Running sigcheck on the affected files
Checking Windows Event Log ID 4663
Comparing file hashes against known-good databases

Correct answer: Comparing $STANDARD_INFORMATION and $FILE_NAME timestamps in the MFT

Timestomping modifies $STANDARD_INFORMATION timestamps but often leaves $FILE_NAME timestamps untouched, so comparing both MFT attributes reveals manipulation.

Question 74: What does a high number of RST packets from a single source typically indicate during forensic analysis?

Normal TCP session termination
A busy web server handling many requests
A port scan where the scanner receives RST responses from closed ports (Correct answer)
Successful SSL handshakes

Correct answer: A port scan where the scanner receives RST responses from closed ports

TCP RST packets in response to connection attempts indicate closed ports; many RSTs from one target in response to one scanner suggest a port scanning probe.

Question 75: In a GPT-partitioned disk, where is the backup copy of the partition table stored?

At the end of the disk (Correct answer)
In the MBR protective partition
In the EFI System Partition
In the first partition's VBR

Correct answer: At the end of the disk

GPT stores a secondary (backup) copy of the partition table at the last sectors of the disk to allow recovery if the primary GPT header is damaged.

Question 76: A suspect's laptop uses full-disk BitLocker encryption and is found powered ON. What is the BEST immediate action to preserve decrypted data?

Perform a live RAM acquisition before powering off (Correct answer)
Remove the drive and image it in a write blocker
Shut it down immediately to prevent data changes
Wait for BitLocker to time out and re-encrypt

Correct answer: Perform a live RAM acquisition before powering off

Performing a live RAM acquisition captures the BitLocker encryption keys stored in volatile memory before the machine is powered off.

Question 77: During malware analysis, you observe that the sample reads from HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options. What capability does this suggest?

DLL search order hijacking
Persistence via debugger hijacking (Correct answer)
UAC bypass technique
Registry-based keylogging

Correct answer: Persistence via debugger hijacking

The Image File Execution Options (IFEO) registry key can be abused to redirect execution of a target program to a malicious binary using the Debugger value.

Question 78: What is 'email spoofing' and what forensic technique helps identify it?

Compressing email attachments; identified by file signatures
Encrypting emails; decrypted by checking certificates
Deleting sent emails; recovered by log analysis
Forging the From address to impersonate another sender; identified by analyzing Received headers and DKIM/SPF results (Correct answer)

Correct answer: Forging the From address to impersonate another sender; identified by analyzing Received headers and DKIM/SPF results

Email spoofing forges the From header to impersonate a trusted sender; investigators identify it by tracing Received headers to the true originating IP and checking DKIM/SPF authentication failures.

Question 79: An attacker uses timestomping to cover their tracks. What does this technique modify?

Network packet timestamps in PCAP files
Database transaction log timestamps
Windows event log timestamps
File system MACB timestamps on modified files (Correct answer)

Correct answer: File system MACB timestamps on modified files

Timestomping alters MACB (Modified, Accessed, Changed, Born) timestamps on files to obscure when they were created or modified.

Question 80: In social media forensics, what is the significance of metadata embedded in images posted on social platforms?

It only contains image resolution data
It only contains file size information
It may contain GPS coordinates, device model, and timestamp revealing the photo's origin (Correct answer)
It contains the user's password hash

Correct answer: It may contain GPS coordinates, device model, and timestamp revealing the photo's origin

EXIF metadata in images can include GPS coordinates, camera model, and capture timestamp, though many social platforms strip EXIF data — investigators must check if the platform preserves it.

Question 81: During a ransomware investigation on a Windows system, which registry artifact would help determine if the Volume Shadow Copies were deleted by the attacker?

HKLM\SYSTEM\CurrentControlSet\Services\VSS\Parameters
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
Security event log event ID 524 for shadow copy deletion
System event log combined with examining vssadmin.exe in the Shimcache or Amcache (Correct answer)

Correct answer: System event log combined with examining vssadmin.exe in the Shimcache or Amcache

Checking Shimcache/Amcache for vssadmin.exe or wmic.exe execution, combined with System log entries, reveals whether shadow copies were deliberately purged.

Question 82: An attacker injected `; ls -la` into a web form parameter that is passed to a system command. What type of attack is this?

OS command injection (Correct answer)
LDAP injection
SQL injection
XML injection

Correct answer: OS command injection

OS command injection occurs when user-supplied input is incorporated into a system shell command, allowing the attacker to execute arbitrary OS commands.

Question 83: Which of the following is considered the most common and forensically sound method for duplicating a storage device, as it creates an exact, bit-for-bit copy of the entire drive, including unallocated space and deleted files?

Logical file copy
Sparse imaging
Bit-stream disk-to-image file (Correct answer)
System backup and restore

Correct answer: Bit-stream disk-to-image file

Creating a bit-stream disk-to-image file is the standard forensic method for duplicating evidence. This process creates a file that is an exact, sector-by-sector copy of the source drive, ensuring that all data, including deleted files, file slack, and unallocated space, is preserved for analysis. This is often referred to as creating a 'forensic image'.

Question 84: Which forensic tool is widely used to parse and examine Outlook PST files during email investigations?

Kernel OST/PST Viewer or FTK with PST support (Correct answer)
Volatility
Nessus
Aircrack-ng

Correct answer: Kernel OST/PST Viewer or FTK with PST support

Tools like Kernel OST/PST Viewer and FTK's email module can parse PST/OST files to recover emails, deleted items, and metadata without requiring Outlook to be installed.

Question 85: Which analysis technique examines the timing intervals between network packets to identify covert communication channels even when content is encrypted?

Banner grabbing
Signature-based detection
Traffic timing analysis / inter-arrival time analysis (Correct answer)
Hash-based file carving

Correct answer: Traffic timing analysis / inter-arrival time analysis

Traffic timing analysis examines inter-packet arrival times to detect patterns that may indicate covert channels where timing itself encodes information, bypassing content-level inspection.

Question 86: Which of the following is the central and most critical metadata file in an NTFS file system, containing records for every file and directory on the volume?

$LogFile
$Boot
$MFT (Master File Table) (Correct answer)
$Bitmap

Correct answer: $MFT (Master File Table)

The Master File Table ($MFT) is the heart of the NTFS file system. It contains at least one entry for every file and directory on the volume, storing all their metadata, such as name, size, timestamps, and permissions. For small files, the data itself can even be stored directly within the MFT record.

Question 87: Which of the following is a commonly used Windows tool for secure file deletion that supports multiple overwrite passes?

Recuva
FTK Imager
Autopsy
Eraser (Correct answer)

Correct answer: Eraser

Eraser is a widely used Windows tool that performs secure file deletion by overwriting files with multiple passes of random data, making recovery infeasible.

Question 88: Which Windows artifact can reveal evidence of a program execution even if the executable has since been deleted, by tracking compatibility telemetry data?

Windows Installer logs in C:\Windows\Temp
Application Compatibility Cache (Shimcache) in the registry (Correct answer)
Driver store at C:\Windows\System32\DriverStore
Windows Error Reporting (WER) files in C:\ProgramData\Microsoft\Windows\WER

Correct answer: Application Compatibility Cache (Shimcache) in the registry

The Shimcache (AppCompatCache) registry key tracks executables that the Windows Application Compatibility engine has processed, persisting evidence of execution even after deletion.

Question 89: During a digital forensics investigation, which document provides a chronological paper trail of the seizure, custody, control, transfer, analysis, and disposition of evidence?

Chain of Custody (Correct answer)
Evidence Intake Form
Investigator's Notes
Case Summary Report

Correct answer: Chain of Custody

The Chain of Custody is a critical document that records the entire lifecycle of a piece of evidence. It meticulously tracks who handled the evidence, when, and for what purpose, ensuring its integrity and admissibility in legal proceedings. A broken chain of custody can render evidence inadmissible in court.

Question 90: Which Oracle database view provides information about all currently connected sessions and can help identify unauthorized access?

DBA_TABLES
V$DATAFILE
V$SESSION (Correct answer)
ALL_OBJECTS

Correct answer: V$SESSION

V$SESSION is a dynamic performance view in Oracle that displays information about all current database sessions including username, logon time, and program.

Question 91: Which tool is commonly used in Linux forensics to recover deleted files from an ext4 file system by scanning unallocated inode entries?

mkfs
blkid
extundelete (Correct answer)
fdisk

Correct answer: extundelete

extundelete is a Linux tool that analyzes ext3/ext4 journal and inode tables to recover deleted files from unallocated space.

Question 92: Which email header field is most important for tracing the originating IP address of an email message?

From
Reply-To
Message-ID
Received (Correct answer)

Correct answer: Received

The 'Received' headers form a chain of mail server hops and the earliest 'Received' header contains the originating IP address of the sender.

Question 93: What is the primary goal of the 'containment' step when a forensic investigation overlaps with an active incident response?

Shut down all affected systems immediately
Preserve all volatile data before it is lost
Stop the spread of the incident while minimizing disruption and preserving evidence (Correct answer)
Begin prosecuting the suspect

Correct answer: Stop the spread of the incident while minimizing disruption and preserving evidence

Containment aims to prevent further damage or spread of the incident while balancing the need to preserve as much forensic evidence as possible.

Question 94: A suspect claims to have only stored a few contacts on their SIM card and that the phone's internal memory is irrelevant. Why is this statement often misleading in the context of modern smartphone forensics?

Modern smartphones primarily store contacts, call logs, and extensive message histories on internal flash memory, not the SIM card. (Correct answer)
SIM cards are read-only and cannot be used to store any user-generated data like contacts.
The IMEI number of the phone is stored on the SIM card, linking all activity to the subscriber.
All data saved to a SIM card is automatically and permanently deleted after 30 days.

Correct answer: Modern smartphones primarily store contacts, call logs, and extensive message histories on internal flash memory, not the SIM card.

While older feature phones had limited capacity to store contacts and SMS messages on a SIM card, modern smartphones use their large internal flash memory to store vast amounts of data, including comprehensive contact details, call logs, and entire message conversations. The SIM card's role is primarily to store subscriber identity information.

Question 95: What is the forensic significance of the `Referer` HTTP header found in web server logs?

It records the attacker's operating system
It specifies the encryption cipher used in the connection
It identifies the server-side programming language used
It shows the URL from which the request originated, helping trace attack navigation paths (Correct answer)

Correct answer: It shows the URL from which the request originated, helping trace attack navigation paths

The Referer header shows what page or resource the request came from, helping investigators trace how an attacker navigated through an application.

Question 96: What is 'chain of custody' documentation required to include for a forensic image to be admissible in court?

Only the hash value of the image is legally required
The suspect's signature acknowledging the acquisition occurred
Identity of each person who handled the evidence, dates/times of transfer, and condition of evidence at each transfer (Correct answer)
A signed affidavit from the forensic tool vendor confirming software accuracy

Correct answer: Identity of each person who handled the evidence, dates/times of transfer, and condition of evidence at each transfer

Chain of custody records must document every person who handled the evidence, when transfers occurred, and the evidence's condition, establishing an unbroken accountability trail from collection to court.

Question 97: Which artifact would BEST help an investigator determine whether a rootkit has been hiding files on an NTFS volume?

Checking the registry hive HKLM\SYSTEM\CurrentControlSet\Services
Reviewing Windows Event Log ID 4688
Comparing $MFT entries with directory listings from a clean OS (Correct answer)
Analyzing Prefetch files for hidden binaries

Correct answer: Comparing $MFT entries with directory listings from a clean OS

Discrepancies between the raw $MFT (Master File Table) and what the running OS reports can reveal files hidden by a rootkit intercepting directory enumeration calls.

Question 98: In HTTPS traffic analysis, what information CAN be obtained without decrypting the traffic?

HTTP request headers
Cookie values
Server Name Indication (SNI) hostname (Correct answer)
POST request body content

Correct answer: Server Name Indication (SNI) hostname

SNI is transmitted in plaintext during the TLS handshake, revealing the target hostname even when payload content remains encrypted.

Question 99: Which forensic framework provides a Python-based API for analyzing memory dumps, including support for Windows, Linux, and macOS profiles?

Sleuth Kit
Autopsy
EnCase
Volatility (Correct answer)

Correct answer: Volatility

Volatility is an open-source memory forensics framework with a plugin-based architecture for analyzing RAM dumps across multiple operating systems.

Question 100: A forensic examiner finds a file with a .jpg extension but the hex viewer shows the magic bytes 'PK\x03\x04'. What does this indicate?

The file is a corrupted JPEG and cannot be recovered
The file is a Windows Portable Key certificate, not an image
The JPEG was compressed with PK encryption before storage
The file extension was deliberately changed to hide that it is a ZIP archive (Correct answer)

Correct answer: The file extension was deliberately changed to hide that it is a ZIP archive

Magic bytes 'PK\x03\x04' identify a ZIP archive; a mismatched extension indicates deliberate file masquerading to evade casual inspection.

Question 101: A CHFI is called to investigate a potential data breach. The first step taken is to interview stakeholders, identify potentially affected systems (laptops, servers, mobile devices), and define the scope of the investigation. Which phase of the forensic process does this activity represent?

Reporting
Analysis
Preservation
Identification (Correct answer)

Correct answer: Identification

The Identification phase is the initial step in the digital forensic process. It involves recognizing and determining what evidence is present, where it is stored, and what format it is in. This includes identifying all potential sources of digital evidence like computers, mobile devices, and cloud storage.

Question 102: Which technique allows a forensic investigator to recover deleted rows from a SQL Server database without a backup?

Schema comparison
Index scan
Log file analysis using transaction log parser (Correct answer)
Full-text search

Correct answer: Log file analysis using transaction log parser

Deleted rows remain in the transaction log until the log is truncated, allowing forensic tools like ApexSQL Log to reconstruct and recover deleted data.

Question 103: When an investigator testifies in court about forensic findings, what role does the investigator serve?

Character witness
Hearsay witness
Fact witness
Expert witness (Correct answer)

Correct answer: Expert witness

A forensic investigator testifies as an expert witness, allowed to provide opinions and interpretations based on specialized knowledge.

Question 104: What tool can a CHFI investigator use to read and analyze MySQL binary logs during a database forensic investigation?

mysqldump
mysqlcheck
mysqlbinlog (Correct answer)
mysql_upgrade

Correct answer: mysqlbinlog

The mysqlbinlog utility reads MySQL binary log files, allowing investigators to reconstruct all SQL statements executed on the server.

Question 105: During a network forensics investigation, an analyst notices many short-duration flows to a single external IP. This pattern is most consistent with:

Beaconing malware behavior (Correct answer)
File transfer protocol activity
VoIP communications
Normal web browsing

Correct answer: Beaconing malware behavior

Regular short-duration connections to a single external IP at consistent intervals are a hallmark of malware beaconing for command-and-control communication.

Question 106: A forensic examiner needs to acquire a 4TB drive but only has 2TB of available storage. Which approach is MOST appropriate?

Use compressed forensic imaging (e.g., E01 with compression) (Correct answer)
Partition the image across multiple 1TB raw files using dd split
Perform a logical acquisition of only allocated files
Skip acquisition and examine the original drive in-place

Correct answer: Use compressed forensic imaging (e.g., E01 with compression)

Compressed forensic image formats like E01 can significantly reduce storage requirements while maintaining forensic integrity and embedded hash verification.

Question 107: Which NTFS timestamp is NOT updated when a file is simply read (accessed) on a default Windows 10/11 system?

All timestamps are always updated on access
$STANDARD_INFORMATION last access time (Correct answer)
$FILENAME last access time
Only $MFT record change time updates

Correct answer: $STANDARD_INFORMATION last access time

By default, Windows disables updating of the $SI last access time (NtfsDisableLastAccessUpdate=1) to improve performance, so reading a file does not update it.

Question 108: Which disk partitioning scheme supports more than 2 TB volumes and up to 128 primary partitions on Windows?

APT
VBR
GPT (Correct answer)
MBR

Correct answer: GPT

GUID Partition Table (GPT) supports drives larger than 2 TB and allows up to 128 primary partitions, overcoming MBR limitations.

Question 109: During malware triage, an analyst finds a PE file whose .text section has an entropy value of 7.8 out of 8. This MOST likely indicates:

The code section is packed or encrypted (Correct answer)
The file is a legitimate compiled binary
The executable uses heavy compiler optimizations
The binary is a debug build with symbol tables

Correct answer: The code section is packed or encrypted

Entropy near 8.0 in a PE code section indicates highly randomized data, which is characteristic of packing, encryption, or compression applied to hide the true payload.

Question 110: A forensic image of a compromised host shows that the malware modified the hosts file to redirect antivirus update domains to 127.0.0.1. What is the forensic artifact path for the Windows hosts file?

C:\Windows\System32\drivers\etc\hosts (Correct answer)
C:\Windows\System32\etc\hosts
C:\Windows\SysWOW64\drivers\hosts
C:\ProgramData\Microsoft\Windows\hosts

Correct answer: C:\Windows\System32\drivers\etc\hosts

The Windows hosts file is located at C:\Windows\System32\drivers\etc\hosts and is a common target for malware to block security tool updates by overriding DNS resolution.

Question 111: In ext4, what is the 'journal' and what mode provides the strongest data integrity?

A file listing all user logins; enabled by setting mount option 'log=full'
A backup copy of the superblock; activated via tune2fs -j
A write-ahead log for file system metadata; 'data=journal' mode journals both metadata and data blocks (Correct answer)
A SMART monitoring log; enabled in BIOS settings

Correct answer: A write-ahead log for file system metadata; 'data=journal' mode journals both metadata and data blocks

ext4's journal records operations before committing them; 'data=journal' mode (writeback < ordered < journal) provides the highest integrity by journaling both data and metadata.

Question 112: A malware sample is found to create a service with a binary path pointing to a UNC path (\\server\share\evil.exe). What persistence mechanism does this represent?

Remote service execution for lateral movement (Correct answer)
Pass-the-hash persistence
Token impersonation persistence
DLL hijacking via UNC path

Correct answer: Remote service execution for lateral movement

Malware can create Windows services with UNC paths so that the payload is loaded from an attacker-controlled network share, enabling both persistence and lateral movement.

Question 113: A hardware write blocker fails to initialize with a specific NVMe SSD. What is the BEST alternative to preserve evidence integrity?

Proceed without a write blocker and document the decision
Image the drive without any write protection to save time
Boot the suspect machine from a trusted forensic Linux live CD with software write blocking enabled (Correct answer)
Remove the NVMe drive and attach it via a standard SATA adapter

Correct answer: Boot the suspect machine from a trusted forensic Linux live CD with software write blocking enabled

Booting from a trusted forensic live environment (e.g., CAINE or Tails with forensic mode) enables software write blocking for interfaces where hardware write blockers are not yet available.

Question 114: What does the term 'inode' refer to in Linux/ext4 file systems?

The journal entry for a file transaction
A data structure containing file metadata such as permissions, timestamps, and block pointers (Correct answer)
The directory entry linking a filename to data
The physical block where file data is stored

Correct answer: A data structure containing file metadata such as permissions, timestamps, and block pointers

An inode is a data structure in ext file systems that stores all metadata about a file except its name, including ownership, permissions, and pointers to data blocks.

Question 115: A forensic examiner is creating an image of a hard drive that uses the Master Boot Record (MBR) partitioning scheme. Which of the following correctly describes the structure and location of the MBR?

It is a variable-sized structure stored within the first partition that defines the file system.
It is located at the end of the disk and contains a backup of the partition table.
It can be located anywhere on the disk and primarily contains user data.
It is located in the first 512-byte sector of the disk and contains the boot code and partition table. (Correct answer)

Correct answer: It is located in the first 512-byte sector of the disk and contains the boot code and partition table.

The Master Boot Record (MBR) is a critical data structure located in the very first 512-byte sector of a partitioned storage device. It contains the master boot code (which initiates the boot process), the partition table (which defines the primary partitions), and a boot signature.

Question 116: Which protocol is primarily analyzed when investigating DNS-based data exfiltration attacks?

HTTPS
SMTP
FTP
DNS (Correct answer)

Correct answer: DNS

DNS tunneling encodes data within DNS query/response payloads to exfiltrate data, making DNS traffic the primary focus of such investigations.

Question 117: During an email forensics investigation, what does a missing or broken DMARC alignment indicate?

The email was encrypted end-to-end
The email server is overloaded
The email may be a phishing attempt or spoofed to impersonate a legitimate domain (Correct answer)
The email was sent via a mobile device

Correct answer: The email may be a phishing attempt or spoofed to impersonate a legitimate domain

Failed DMARC alignment indicates that SPF and/or DKIM checks failed, suggesting the email may be spoofed or sent by an unauthorized server impersonating the domain.

Question 118: Which network forensics artifact would best help an investigator determine the exact time a specific external IP address first communicated with an internal host?

Firewall log timestamps for the first allowed session (Correct answer)
ARP cache entries
SNMP trap logs
Routing table entries

Correct answer: Firewall log timestamps for the first allowed session

Firewall logs record timestamped allow/deny decisions for every connection attempt, providing the most reliable record of when external communication with an internal host first occurred.

Question 119: What is the primary forensic value of the SQL Server msdb database?

Stores model database templates
Contains SQL Agent job history and backup/restore history (Correct answer)
Stores user data tables
Holds temporary objects

Correct answer: Contains SQL Agent job history and backup/restore history

The msdb database stores SQL Server Agent job history, backup and restore history, and Database Mail data, providing a timeline of automated activities.

Question 120: An investigator is analyzing a compromised Windows machine and needs to determine how a piece of malware achieves persistence across reboots. Which of the following is one of the most common registry keys an analyst should examine for malicious entries?

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
HKEY_USERS\.DEFAULT\Keyboard Layout
HKEY_CLASSES_ROOT\.dll
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services (Correct answer)

Correct answer: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

The `HKLM\SYSTEM\CurrentControlSet\Services` registry key is a fundamental location where Windows services are defined. Malware frequently creates a new service pointing to its executable to ensure it is launched automatically by the operating system at startup, often with high privileges. While other locations can be used for persistence, this is a primary and critical location to investigate.

Question 121: An investigator finds a file with a .jpg extension but its hex header shows '50 4B 03 04'. What is the actual file type?

PNG image
PDF document
JPEG image
ZIP archive (Correct answer)

Correct answer: ZIP archive

The magic bytes '50 4B 03 04' are the signature for ZIP archive files, regardless of the file extension.

Question 122: An investigator must examine a live server that cannot be shut down. Which approach is most appropriate?

Perform live forensic acquisition capturing RAM and volatile data first (Correct answer)
Remove the hard drive and image it offline
Request a court order to shut down the server
Immediately power off the server to prevent log tampering

Correct answer: Perform live forensic acquisition capturing RAM and volatile data first

Live forensic acquisition captures volatile memory and running process data from a system that must remain operational.

Question 123: A forensic examiner uses the 'dd' command to image a drive. What is the significance of the 'bs' (block size) parameter?

It specifies the number of bad sectors to skip
It determines the amount of data read and written per operation, affecting speed and sector alignment (Correct answer)
It defines the hash algorithm used for verification
It sets the encryption key length for the image

Correct answer: It determines the amount of data read and written per operation, affecting speed and sector alignment

The block size (bs) parameter controls how many bytes dd reads and writes at once; aligning it to the disk's sector size (512 or 4096 bytes) improves accuracy and performance.

Question 124: During malware analysis, you find that a sample uses atom bombing — writing shellcode to the global atom table and using callback functions to execute it. Which Windows mechanism does this abuse?

NtQueueApcThread with GlobalAddAtom for code injection without WriteProcessMemory (Correct answer)
Kernel callback table manipulation using atoms
AppInit_DLLs loading through atom table entries
COM object hijacking via the global atom table

Correct answer: NtQueueApcThread with GlobalAddAtom for code injection without WriteProcessMemory

Atom bombing injects code by writing shellcode into the global atom table and using NtQueueApcThread to queue an APC that copies and executes the atom data in the target process without calling WriteProcessMemory.

Question 125: An investigator wants to determine all websites visited by a user using only proxy server logs. Which log field is most critical for this analysis?

Client IP address
Bytes transferred
HTTP response code
Requested URL or CONNECT hostname (Correct answer)

Correct answer: Requested URL or CONNECT hostname

The requested URL or CONNECT hostname in proxy logs directly identifies which web resources the client accessed, making it the primary field for website visit reconstruction.

Question 126: What Android debug feature, when enabled, allows forensic tools to communicate with a device via USB for data extraction?

ADB (Android Debug Bridge) (Correct answer)
Developer Mode
Safe Mode
USB Tethering

Correct answer: ADB (Android Debug Bridge)

ADB (Android Debug Bridge) is a command-line tool that enables communication between a computer and an Android device for extraction and analysis.

Question 127: Which hashing algorithm is recommended by NIST for generating forensic integrity hashes of email evidence files such as PST archives?

MD5 alone
Base64 encoding
SHA-256 or SHA-3 (Correct answer)
CRC32

Correct answer: SHA-256 or SHA-3

NIST recommends SHA-256 or stronger algorithms for forensic evidence integrity verification, as MD5 and SHA-1 are considered cryptographically weak and vulnerable to collision attacks.

Question 128: A mobile malware sample on Android requests the READ_SMS and SEND_SMS permissions. From a forensic perspective, which threat category does this MOST indicate?

Ransomware seeking contact exfiltration
Banking trojan intercepting OTP SMS codes (Correct answer)
Adware generating click fraud revenue
Spyware recording microphone audio

Correct answer: Banking trojan intercepting OTP SMS codes

Banking trojans commonly abuse SMS permissions to intercept one-time passwords sent by banks for two-factor authentication, forwarding them to the attacker.

Question 129: When a cloud acts like an object, it is committing the crime of cloud as object.

False (Correct answer)
True

Correct answer: False

This statement is false. When a cloud acts as an object, it means the cloud itself is the victim of the crime, such as a denial-of-service attack against a cloud provider's infrastructure or data being stolen from cloud storage. The cloud is not 'committing' the crime; rather, it is the entity being acted upon by the criminal, suffering the impact of the malicious activity.

Question 130: Which dcfldd command option generates a hash of the acquired image simultaneously during the imaging process?

--verify
bs=hashmode
hashlog= (Correct answer)
conv=hash

Correct answer: hashlog=

dcfldd's 'hashlog=' option writes a running hash (MD5 or SHA-1) to a specified log file as the image is being created, enabling simultaneous acquisition and verification.

Question 131: Which of the following best describes the cloud deployment paradigm used for shared infrastructure between multiple enterprises with common concerns (security, compliance, jurisdiction, etc.)?

Public Cloud
Community Cloud (Correct answer)
Private Cloud
Hybrid Cloud

Correct answer: Community Cloud

A community cloud deployment model is designed for a specific community of organizations that share common concerns, such as security requirements, compliance regulations, or jurisdiction. It can be managed internally or by a third party and hosted either internally or externally. This model allows for shared infrastructure and resources while addressing the unique needs of the participating entities, offering a balance between public and private cloud benefits.

Question 132: A forensic investigator is analyzing a wireless packet capture and identifies a large number of deauthentication frames being broadcast. These frames appear to originate from the legitimate Access Point's MAC address but are targeting all connected clients, causing widespread disconnections. What is this specific type of attack called?

Wi-Fi Disassociation/Deauthentication Attack (Correct answer)
MAC Flooding
ARP Spoofing
Evil Twin Attack

Correct answer: Wi-Fi Disassociation/Deauthentication Attack

This scenario describes a Wi-Fi Disassociation or Deauthentication attack. In this attack, an adversary sends forged deauthentication or disassociation frames to clients, spoofing the MAC address of the Access Point. This tricks the clients into disconnecting from the network, causing a denial-of-service condition.

Question 133: What forensic information can be extracted from Windows Jump Lists located in AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations?

Browser history and cookie data for all installed web browsers
Recently and frequently accessed files per application, including files on removed media (Correct answer)
Cached passwords for recently used network shares and web sites
Scheduled task definitions and their last execution timestamps

Correct answer: Recently and frequently accessed files per application, including files on removed media

Jump Lists store per-application MRU entries (AppIDs) linking recently opened files, revealing what an application accessed even after files are deleted.

Question 134: What distinguishes a 'selective' acquisition from a 'full physical' acquisition?

Selective acquisition always produces a compressed output
Selective acquisition uses hardware write blockers exclusively
Selective acquisition targets specific files or folders based on relevance criteria (Correct answer)
Selective acquisition copies every bit of the drive including HPA

Correct answer: Selective acquisition targets specific files or folders based on relevance criteria

Selective acquisition collects only specific, forensically relevant files or directories rather than imaging the entire drive.

Question 135: During a database forensics investigation, an investigator finds rows in a SQL Server table with no matching audit records. What should be checked first?

Firewall logs
DNS logs
The transaction log for direct inserts (Correct answer)
Application event logs

Correct answer: The transaction log for direct inserts

Direct inserts bypassing the application layer appear in the transaction log even if application-level audit triggers did not fire.

Question 136: What is 'write blocking' and which layer does a software write blocker operate at?

Physically disconnects the write pin; operates at the SATA controller layer
Encrypts all writes to prevent data modification
Monitors SMART data to detect write operations
Intercepts write commands via OS driver or API interception before they reach the drive (Correct answer)

Correct answer: Intercepts write commands via OS driver or API interception before they reach the drive

Software write blockers intercept OS-level write commands (via drivers or system call hooks) before they reach the storage device, preventing data modification during examination.

Question 137: In FAT32, what is the maximum supported file size?

16 TB
4 GB minus 1 byte (Correct answer)
2 GB
8 GB

Correct answer: 4 GB minus 1 byte

FAT32 uses a 32-bit file size field, limiting individual files to 4 GB minus 1 byte (4,294,967,295 bytes).

Question 138: A forensic analyst discovers that malware is using DNS TXT records to receive commands. This is an example of which C2 technique?

Fast-flux DNS evasion
DNS tunneling for command-and-control (Correct answer)
Domain generation algorithm (DGA)
DNS cache poisoning

Correct answer: DNS tunneling for command-and-control

DNS tunneling encodes C2 commands and data within DNS query/response fields such as TXT records, allowing covert communication that often bypasses firewall rules permitting DNS traffic.

Question 139: What is the Device Configuration Overlay (DCO) and how does it differ from the HPA?

DCO is configured by the manufacturer or OEM to limit drive capacity; HPA is user-configurable (Correct answer)
DCO is set by the user; HPA is set by the manufacturer at the factory
DCO and HPA are different names for the same feature
DCO stores partition tables; HPA stores firmware

Correct answer: DCO is configured by the manufacturer or OEM to limit drive capacity; HPA is user-configurable

The DCO is typically set by manufacturers to standardize drive capacity across product lines, while the HPA can be set by the user or OS to hide data; both are invisible to the OS.

Question 140: Which artifact on a Windows system stores evidence of web-based email access (e.g., Gmail via browser) useful in email forensics?

Prefetch files only
Browser cache, history, and cookies (Correct answer)
Registry hives only
Windows Event Logs only

Correct answer: Browser cache, history, and cookies

Browser cache files may contain cached email content and attachments, browser history shows Gmail/webmail access timestamps, and cookies can reveal authenticated sessions.

Question 141: A forensic investigator needs to determine when a specific stored procedure was last modified in SQL Server. Which catalog view should they query?

sys.partitions
sys.indexes
sys.objects (Correct answer)
sys.columns

Correct answer: sys.objects

The sys.objects catalog view contains a modify_date column that records the last modification timestamp for all database objects including stored procedures.

Question 142: Which acquisition order principle, based on volatility, should guide what is collected FIRST during live forensic response?

Log files first because they will be overwritten by new events
CPU registers and cache, then RAM, then swap space, then disk (Correct answer)
Hard drive contents, then RAM, then network connections
Disk first because it is the most stable evidence

Correct answer: CPU registers and cache, then RAM, then swap space, then disk

The order of volatility (RFC 3227) dictates collecting the most transient data first: CPU/cache → RAM → swap → network state → running processes → disk → archival media.

Question 143: Which Windows artifact records the applications that were set to auto-start at system boot and can reveal persistence mechanisms used by malware?

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32
HKLM\SYSTEM\CurrentControlSet\Control\CrashControl
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run (Correct answer)

Correct answer: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

The Run key under both HKLM and HKCU is a common persistence location where programs are registered to execute automatically at every user login.

Question 144: A forensic analyst finds that an attacker sent an HTTP request with the header `X-Forwarded-For: 127.0.0.1`. What was the attacker trying to achieve?

Inject JavaScript into the response
Escalate HTTP to HTTPS
Spoof the source IP to appear as localhost and bypass IP-based access controls (Correct answer)
Exploit an open redirect vulnerability

Correct answer: Spoof the source IP to appear as localhost and bypass IP-based access controls

By forging the `X-Forwarded-For` header to `127.0.0.1`, attackers attempt to trick applications into treating the request as coming from localhost, bypassing IP allowlists.

Question 145: A ransomware sample generates a unique key per victim and sends it to a C2 server before encrypting files. If the C2 is taken down before the key is transmitted, what is the most likely forensic implication?

Backup shadow copies will remain intact
Decryption may be possible from memory artifacts (Correct answer)
The encryption key is permanently lost
The ransomware will fail to encrypt any files

Correct answer: Decryption may be possible from memory artifacts

If the key was generated in memory before transmission, forensic memory analysis may recover it from RAM dumps or hibernation files before it is overwritten.

Question 146: What does the term 'database carving' refer to in forensic investigations?

Partitioning a database for performance
Recovering database records from raw disk images without a live database (Correct answer)
Splitting a database across multiple servers
Encrypting database columns

Correct answer: Recovering database records from raw disk images without a live database

Database carving involves extracting database records and structures directly from raw disk images or unallocated space when the database system is unavailable.

Question 147: During a post-incident forensic review, investigators find that logs were overwritten before collection. Which process failure does this represent?

Lack of legal authorization
Improper chain of custody
Failure to preserve volatile evidence in time
Inadequate evidence identification (Correct answer)

Correct answer: Inadequate evidence identification

Overwritten logs indicate a failure in the identification phase — critical evidence sources were not identified quickly enough for preservation.

Question 148: A CHFI investigator is analyzing a Windows system and wants to identify all network connections that were active at the time of a memory dump. Which command-line tool output should be examined in the memory image?

ipconfig /all
arp -a
route print
netstat -ano (Correct answer)

Correct answer: netstat -ano

Netstat -ano output captured in memory shows all active TCP/UDP connections, their PIDs, and listening ports at the exact time of acquisition.

Question 149: What is the purpose of analyzing 'flow records' with a tool like nfdump in a network forensics investigation?

Reconstructing application-layer sessions from raw packets
Querying and filtering large volumes of NetFlow data to identify anomalous traffic patterns (Correct answer)
Decrypting captured TLS sessions
Mapping physical network device connectivity

Correct answer: Querying and filtering large volumes of NetFlow data to identify anomalous traffic patterns

nfdump is a command-line tool for reading, filtering, and aggregating NetFlow records stored by nfcapd, enabling investigators to query large traffic datasets for anomalous flows without processing full packet captures.

Question 150: An attacker sends the payload `<img src=x onerror=alert(1)>` in a comment field that is rendered on a public page. This is an example of which XSS variant?

Reflected XSS
Blind XSS
DOM-based XSS
Stored XSS (Correct answer)

Correct answer: Stored XSS

Stored (persistent) XSS occurs when malicious script is saved to the server (e.g., a database) and later rendered to other users.

Question 151: What are the following? cloud computing services that deliver hardware, operating systems, and virtual machines. Which a service API may be used to govern.

Infrastructure-as-a-Service (IaaS) (Correct answer)
Platform-as-a-Service (PaaS)
Platform-as-a-Service (PaaS)

Correct answer: Infrastructure-as-a-Service (IaaS)

Infrastructure-as-a-Service (IaaS) provides virtualized computing resources over the internet, including virtual machines, storage, networks, and operating systems. Users have control over the operating systems, applications, and middleware, while the cloud provider manages the underlying infrastructure. This model allows for significant flexibility and scalability, often managed through APIs for programmatic control.

EC-Council CHFI (312-49) Certification Exam

The EC-Council Computer Hacking Forensic Investigator (CHFI) v11 certification validates professionals in detecting cyberattacks, extracting digital evidence, and reporting cybercrime findings for legal proceedings.

150

Questions

240 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds