CHFI General MCQ 4 — Questions and Answers
Question 1: Which artifact on a Windows system records the first and last execution time of applications along with a run count?
- Windows event logs
- Prefetch files
- Registry UserAssist key (Correct answer)
- LNK files
Correct answer: Registry UserAssist key
The UserAssist registry key in HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist records application execution counts and timestamps in ROT13-encoded format.
Question 2: What is the role of the 'slack space' in a forensic disk investigation?
- Unallocated clusters at the end of the disk
- Space between end of a file and end of its last cluster (Correct answer)
- Free space on a newly formatted partition
- Space reserved for the file system metadata
Correct answer: Space between end of a file and end of its last cluster
File slack space is the area between the logical end of a file and the end of the last cluster allocated to it, which may contain remnant data.
Question 3: A CHFI investigator discovers an encrypted TrueCrypt/VeraCrypt container. Which approach is legally and forensically sound?
- Delete the container since it cannot be analyzed
- Image the container and attempt password attacks in a lab environment (Correct answer)
- Directly mount the container on the evidence drive
- Ask the suspect for the password verbally without documentation
Correct answer: Image the container and attempt password attacks in a lab environment
The correct approach is to image the encrypted container and perform password/brute-force attacks against the copy in a controlled lab to avoid altering the original.
Question 4: Which Windows artifact is a binary file created by the OS to speed up application launches and can reveal execution history?
- Pagefile.sys
- Prefetch files (.pf) (Correct answer)
- Hiberfil.sys
- Registry hive logs
Correct answer: Prefetch files (.pf)
Prefetch files (.pf) are created by Windows to speed up application loading and contain metadata about the last run times and file paths accessed.
Question 5: During cloud forensics, which type of data is most difficult to acquire due to multi-tenancy and shared infrastructure?
- Log files exported by the cloud provider
- Virtual machine disk images
- RAM and live memory of running cloud instances (Correct answer)
- Object storage bucket contents
Correct answer: RAM and live memory of running cloud instances
Live memory of cloud instances is extremely difficult to acquire forensically due to shared physical hardware, hypervisor isolation, and lack of investigator access to the host.
Question 6: What does the 'first responder' rule state regarding digital evidence at a crime scene?
- The first responder must immediately power off all running systems
- The first responder should document the scene before touching any device (Correct answer)
- The first responder must create a bit-stream image on-site
- The first responder should connect all devices to the network for remote analysis
Correct answer: The first responder should document the scene before touching any device
The first responder must photograph, sketch, and document the scene and device states before any evidence is collected or altered.
Question 7: Which anti-forensic technique involves overwriting free disk space with random data to prevent recovery of deleted files?
- Encryption
- Obfuscation
- Disk wiping / secure erase (Correct answer)
- Steganography
Correct answer: Disk wiping / secure erase
Disk wiping overwrites free space with random or zero data patterns to prevent forensic recovery of previously deleted files.
