I85PREP
⌘ K
CHFI study materials
CHFI study resources

CHFI practice questions

One question at a time. Build your CHFI understanding.

First 50 of 190 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Filesystem, memory, network and timeline evidence

Which file is a primary forensic source for identifying programs that ran on a Windows system, including timestamps and run counts?

  1. %SystemRoot%\Prefetch\*.pf files Correct answer.
  2. C:\Boot.ini
  3. C:\Windows\System32\drivers\etc\services
  4. C:\Recovery\WinRE.wim

Explanation

Prefetch files can support relevant execution-related inferences under the actual Windows version and configuration. Availability, recorded fields and retention vary; they are not an infallible record of every program on every workstation or server. Correlate other artifacts and timestamp semantics before concluding who ran what.

Question 2Filesystem, memory, network and timeline evidence

What happens to a file's MFT record on NTFS when it is deleted from the Recycle Bin?

  1. The MFT record and clusters are immediately wiped to zero
  2. The record is marked as not in use and the clusters are flagged free, but the data remains until overwritten Correct answer.
  3. Windows keeps a permanent backup automatically
  4. The deletion is rolled back after 7 days

Explanation

On Recycle Bin emptying, NTFS marks the file's MFT entry as unallocated (the in-use bit is cleared) and frees the data-run clusters in the $Bitmap. The actual record contents and cluster data persist until reused, which is why undelete and file-carving tools can often recover them - and why anti-forensic wipers must overwrite to be effective.

Question 3Filesystem, memory, network and timeline evidence

Which anti-forensic technique hides data inside the unused space of legitimate files such as images or audio?

  1. Encryption
  2. Steganography Correct answer.
  3. Compression
  4. Disk wiping

Explanation

Steganography conceals data within carrier files (LSB embedding in BMP/WAV, JPEG DCT coefficient manipulation, HTML whitespace, DNS payloads). Detection tools include StegDetect, OpenStego, and statistical analysis (chi-square, RS analysis). Unlike encryption, steganography hides the existence of the secret message itself.

Question 4Filesystem, memory, network and timeline evidence

An NTFS file has an Alternate Data Stream (ADS) attached. From a Windows command prompt, how can an investigator list ADS for a file?

  1. type filename.ext
  2. dir /R filename.ext Correct answer.
  3. attrib filename.ext
  4. fc filename.ext

Explanation

Since Windows Vista, 'dir /R' lists alternate data streams alongside main filenames (e.g., 'malware.txt:hidden.exe'). PowerShell's Get-Item -Stream * also enumerates ADS. ADS are commonly abused to hide executables behind innocent-looking files because Explorer typically does not display them. The :Zone.Identifier ADS marks files downloaded from the internet.

Question 5Filesystem, memory, network and timeline evidence

Which Volatility plugin lists currently running processes from a Windows memory image?

  1. windows.pslist Correct answer.
  2. windows.netstat
  3. windows.handles
  4. windows.modules

Explanation

windows.pslist (Volatility 3) walks the doubly-linked _EPROCESS list from PsActiveProcessHead and prints PID, PPID, ImageFileName, and creation time. Companion plugins include pstree (parent/child tree), psscan (scans for unlinked _EPROCESS - useful against rootkits), and dlllist (loaded DLLs).

Question 6Filesystem, memory, network and timeline evidence

During a network forensic investigation, an analyst sees thousands of TCP packets with the SYN flag set, no SYN-ACK responses completed, and source IPs spread across many addresses. This pattern MOST likely indicates which attack?

  1. ARP poisoning
  2. TCP SYN flood (DoS) Correct answer.
  3. DNS cache poisoning
  4. Bluetooth pairing abuse

Explanation

A SYN flood opens many half-open TCP connections - the attacker sends SYN, the victim replies SYN-ACK and waits, the attacker never completes with ACK. Source IPs are typically spoofed or distributed across a botnet. Investigators detect SYN floods in tcpdump/Wireshark by searching tcp.flags.syn==1 && tcp.flags.ack==0 with high counts toward a single destination.

Question 7Filesystem, memory, network and timeline evidence

Which Wireshark display filter shows only HTTP traffic that contains a SQL injection signature like a single-quote followed by 'OR'?

  1. ip.src == 192.168.1.1
  2. tcp.port == 80
  3. http and frame contains "' OR" Correct answer.
  4. dns.qry.name

Explanation

Wireshark's 'frame contains' operator searches packet bytes for a literal string. Combining it with 'http' restricts to HTTP traffic. 'http.request.uri contains "' OR"' is even more targeted. Investigators use such filters to surface SQL-injection attempts in raw PCAPs during web-app forensics.

Question 8Filesystem, memory, network and timeline evidence

Which Linux file in /proc allows an investigator to read a specific running process's executable image while the process is running?

  1. /proc/<pid>/exe (a symbolic link to the original executable) Correct answer.
  2. /proc/<pid>/passwd
  3. /proc/<pid>/uname
  4. /proc/<pid>/iface

Explanation

/proc/<pid>/exe is a symlink to the binary file the process was started from. Even if the original file on disk has been deleted (a common malware tactic), reading /proc/<pid>/exe still recovers the executable. Companion entries include /proc/<pid>/maps (memory mappings), /proc/<pid>/cmdline, and /proc/<pid>/fd/* (open file descriptors).

Question 9Filesystem, memory, network and timeline evidence

What is the primary purpose of a YARA rule in malware forensics?

  1. Encrypting forensic images
  2. Pattern-matching to identify and classify samples based on textual or binary signatures Correct answer.
  3. Generating SSL certificates
  4. Bypassing UAC

Explanation

YARA is a rule-based pattern-matching engine for files and processes. Rules consist of strings (text/hex) plus a Boolean condition. Investigators use YARA to scan suspect images for known malware families (e.g., Emotet, Cobalt Strike beacons), classify samples into families, and share IoCs across teams.

Question 10Filesystem, memory, network and timeline evidence

An analyst is examining a suspicious Word document that uses macros to download a payload. Which technique is BEST for safe analysis?

  1. Open it on the production user workstation
  2. Use a sandboxed virtual machine, isolated network, and tools such as oledump.py and olevba Correct answer.
  3. Email it to all colleagues to test their AV
  4. Print the document to PDF

Explanation

Static analysis with oledump.py or olevba reveals embedded macros without executing them; dynamic analysis runs the document in a sandboxed VM with internet faking (INetSim or FakeNet-NG) so the payload reveals itself but cannot reach real C2. Production execution is dangerous and a violation of forensic protocol.

Question 11Filesystem, memory, network and timeline evidence

Which registry path is commonly abused for malware persistence, executing programs at every user logon?

  1. HKLM\Software\Microsoft\Windows\CurrentVersion\Run and HKCU\Software\Microsoft\Windows\CurrentVersion\Run Correct answer.
  2. HKLM\Hardware\Description\System
  3. HKLM\Sam
  4. HKCU\Console

Explanation

The Run keys (HKLM and HKCU) execute their value-data programs at logon for all users (HKLM) or the current user (HKCU). RunOnce, AppInit_DLLs, Image File Execution Options Debugger, and Scheduled Tasks are other classic persistence vectors. CHFI v11 lists registry-based persistence as a core malware-forensics objective.

Question 12Filesystem, memory, network and timeline evidence

What is a 'rogue access point'?

  1. An AP that has the latest firmware patches
  2. An unauthorized wireless access point connected to a network, often by an insider or attacker, that bypasses security controls Correct answer.
  3. A wired switch port
  4. A captive portal

Explanation

Rogue APs are unauthorized wireless access points plugged into the corporate LAN (insider) or operated nearby (attacker, e.g., 'evil twin' with the same SSID). They bypass NAC and let attackers harvest credentials or pivot. Detection uses wireless IDS, RF surveys, and switch CDP/LLDP/MAC analysis.

Question 13Filesystem, memory, network and timeline evidence

Which web-attack vector occurs when an application includes user input in a system-shell call without sanitization?

  1. Cross-Site Scripting (XSS)
  2. Command Injection Correct answer.
  3. Cross-Site Request Forgery (CSRF)
  4. Insecure Deserialization

Explanation

Command injection (also called OS command injection) lets an attacker append shell metacharacters (;, &&, |) to user input that is concatenated into a system() or exec() call. Investigators look for these payloads in web-server logs and WAF events. Mitigations include parameterized APIs and strict allow-lists.

Question 14Filesystem, memory, network and timeline evidence

Which Python library is commonly used in DFIR Python scripts to parse Windows Registry hives offline?

  1. pandas
  2. python-registry (or yarp / Registry) Correct answer.
  3. matplotlib
  4. flask

Explanation

python-registry (Willi Ballenthin), yarp, and Registry-related libraries parse offline Windows Registry hives (NTUSER.DAT, SYSTEM, SOFTWARE, SAM, SECURITY) without mounting them. CHFI v11 introduced 'Perform Digital Forensics using Python' as a topic, including registry, malware, and email forensics with Python.

Question 15Filesystem, memory, network and timeline evidence

When investigating a suspected DNS hijacking incident, which artifact is MOST useful for identifying which DNS resolver a Windows host was using?

  1. The Recycle Bin
  2. Network adapter settings (registry Tcpip\Parameters\Interfaces) and ipconfig /displaydns output Correct answer.
  3. Pagefile alone
  4. EXIF metadata of recent photos

Explanation

Static DNS server settings live in HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\<adapter>\NameServer. The current cache is visible via ipconfig /displaydns (live) or by parsing the DNS Resolver service memory. PCAPs and DHCP logs help confirm the resolver actually queried.

Question 16Filesystem, memory, network and timeline evidence

An analyst captures a memory dump of a suspect Windows machine. Which open-source framework is the de facto standard for analyzing it?

  1. Volatility Correct answer.
  2. Nmap
  3. Burp Suite
  4. Hashcat

Explanation

Volatility (versions 2 and 3) is the open-source framework for memory forensics across Windows, Linux, and macOS. Plugins parse processes, network connections, registry hives in memory, malware injection, and many more. CHFI v11 explicitly covers Volatility as a core memory-forensics tool.

Question 17Filesystem, memory, network and timeline evidence

What is the primary purpose of file carving during forensic analysis?

  1. Recovering files from unallocated space based on header/footer signatures when file-system metadata is missing or destroyed Correct answer.
  2. Encrypting the file system
  3. Compressing files to save disk space
  4. Hashing files for inventory

Explanation

File carving reconstructs files from raw disk images by scanning for known file signatures (e.g., FF D8 FF for JPEG) and footers, regardless of file-system metadata. Tools like PhotoRec, Foremost, and Scalpel are used when MFT entries have been cleared or on raw unformatted media. Carving is essential against anti-forensic file deletion.

Question 18Filesystem, memory, network and timeline evidence

Which mobile-OS feature can hinder forensic acquisition by encrypting all user data with a key tied to the device hardware?

  1. Notification center
  2. File-based encryption (Android FBE) and Apple Data Protection (iOS Secure Enclave) Correct answer.
  3. Screen autorotation
  4. AirDrop

Explanation

Modern Android (FBE since 7.0) and iOS (Data Protection since iOS 4) encrypt user data with keys derived from the user passcode and a hardware-fused secret in the Secure Enclave / Keymaster. Without the passcode, even physical chip-off recovers only ciphertext. Investigators rely on legal compulsion, exploit-based unlock (e.g., GrayKey, Cellebrite Premium), or BFU/AFU collection states.

Question 19Filesystem, memory, network and timeline evidence

Cookie poisoning attacks generally target which web application weakness?

  1. Trust placed in client-supplied session or identity values stored in cookies Correct answer.
  2. DNS resolver caches
  3. Bluetooth pairing
  4. Local file inclusion

Explanation

Cookie poisoning modifies cookie values (e.g., user_id, role, cart) that the application trusts without server-side validation. Investigators look for sudden role changes, signed-cookie integrity failures, or session-token reuse. Mitigations include HMAC-signed/encrypted cookies, the Secure/HttpOnly/SameSite flags, and server-side session storage.

Question 20Filesystem, memory, network and timeline evidence

A blockchain forensics investigation typically starts with which artifact?

  1. A wallet address (and associated transaction graph on the public ledger) Correct answer.
  2. The user's home Wi-Fi password
  3. A printer queue listing
  4. A barcode scanner log

Explanation

Public chains (Bitcoin, Ethereum) record every transaction openly. Investigators start from a known wallet address (from an exchange subpoena, ransom note, or seizure) and use clustering heuristics, mixer/tumbler analysis, and exchange KYC data to follow funds. Tools include Chainalysis, TRM Labs, and open-source explorers.

Question 21Filesystem, memory, network and timeline evidence

Which Volatility 3 plugin would help detect a malicious DLL injected into another process via classic CreateRemoteThread injection?

  1. windows.malfind Correct answer.
  2. windows.cmdscan
  3. windows.printkey
  4. windows.timeliner

Explanation

windows.malfind scans process memory for executable, RWX-protected, private-mapped regions that lack a matching disk file - a strong signal of injected code (CreateRemoteThread, process hollowing, reflective DLL). It dumps the suspicious bytes for further analysis (strings, IDA, YARA matching).

Question 22Filesystem, memory, network and timeline evidence

An attacker uses 'timestomping' to alter file MAC times. Which Windows artifact may still reveal the original timestamps?

  1. Notepad's recent files menu
  2. $STANDARD_INFORMATION vs $FILE_NAME attribute timestamp comparison in the MFT Correct answer.
  3. BIOS clock skew
  4. Quick Launch toolbar

Explanation

NTFS stores timestamps in two attributes: $STANDARD_INFORMATION (modifiable by user-mode APIs like SetFileTime) and $FILE_NAME (updated only by the kernel). Mismatches - e.g., $SI predates $FN - are a strong tell of timestomping. CHFI investigators routinely diff these attributes in tools like MFTECmd or Autopsy.

Question 23Filesystem, memory, network and timeline evidence

Which sniffer captures network packets in promiscuous or monitor mode for forensic analysis?

  1. Microsoft Word
  2. tcpdump / Wireshark / tshark Correct answer.
  3. Notepad++
  4. Excel

Explanation

tcpdump (CLI), Wireshark (GUI), and tshark (CLI of Wireshark) capture and decode packets from local or SPAN-mirrored interfaces. They use libpcap/Npcap. Putting an interface in promiscuous mode captures all frames seen on the wire (within the broadcast domain); monitor mode is the wireless equivalent that captures 802.11 frames without association.

Question 24Filesystem, memory, network and timeline evidence

When examining a TOR Browser left running on a suspect's machine, which Windows artifact is MOST likely to retain forensic traces of visited .onion sites?

  1. Prefetch and Pagefile/Memory dump (since TOR Browser disables disk caching) Correct answer.
  2. Default Internet Explorer history
  3. Clipboard manager exports
  4. Outlook autocomplete cache

Explanation

TOR Browser disables on-disk history, cache, and cookies by default. Useful traces remain in (1) prefetch (program execution proof), (2) RAM and pagefile.sys (URL strings, .onion hostnames, page fragments), and (3) registry/UserAssist (program-launch evidence). Memory acquisition while TOR is running yields the richest data.

Question 25Filesystem, memory, network and timeline evidence

An IoT smart speaker (Amazon Echo) is seized as evidence. Which company-side data source is MOST useful for reconstructing voice command history?

  1. Amazon Alexa cloud-stored voice history (subject to legal process) Correct answer.
  2. BIOS settings of the device
  3. Bluetooth controller firmware
  4. Echo's local clock battery

Explanation

Amazon Echo devices stream voice queries to the Alexa cloud, where transcripts and audio recordings are retained per account settings. Investigators serve legal process (warrant, subpoena) on Amazon to obtain voice history, device-pairing logs, skill activity, and timestamped commands. CHFI v11 lists Amazon Echo IoT forensics specifically.

Question 26Filesystem, memory, network and timeline evidence

What is 'pagefile.sys' on Windows, and why is it forensically significant?

  1. A legacy boot file with no forensic value
  2. The virtual-memory paging file that may contain remnants of process memory, including passwords, URLs, and decrypted data Correct answer.
  3. An Office macro repository
  4. The Windows Update download cache

Explanation

pagefile.sys (and swapfile.sys / hiberfil.sys) backs Windows virtual memory. When RAM pressure forces pages out, sensitive process data - including plaintext passwords, encryption keys, browser pages, and document fragments - can be written to disk. Investigators carve pagefile.sys with strings, bulk_extractor, and Volatility (--save-pagefile).

Question 27Filesystem, memory, network and timeline evidence

Which header field in an SMTP email message is MOST useful for tracing the originating IP of a suspicious message?

  1. Subject
  2. Received: (the chain of MTAs added bottom-up) Correct answer.
  3. MIME-Version
  4. Content-Disposition

Explanation

Each MTA prepends a 'Received:' header showing 'from <claimed host> (<actual IP>) by <our host>'. Reading from the bottom up traces the path; the lowest Received header that is from a non-trusted source typically points to the originating IP. Investigators cross-check with SPF/DKIM/DMARC results in Authentication-Results headers.

Question 28Filesystem, memory, network and timeline evidence

Which suite of Eric Zimmerman tools is widely used in Windows forensic timeline analysis for parsing MFT, registry, and event logs?

  1. Eric Zimmerman's Tools (MFTECmd, RECmd, EvtxECmd, AmcacheParser, JLECmd, etc.) Correct answer.
  2. Apache OpenOffice
  3. GNU Privacy Guard
  4. Mozilla Thunderbird

Explanation

Eric Zimmerman's free .NET tools - MFTECmd (NTFS MFT/USN journal), RECmd (registry), EvtxECmd (event logs), AmcacheParser, JLECmd (jump lists), LECmd (LNK), PECmd (prefetch), ShellBagsExplorer - are the de facto Windows-artifact parsers in modern DFIR. They produce CSV output ideal for ingestion into Timeline Explorer or KAPE.

Question 29Filesystem, memory, network and timeline evidence

Which tool can detect alternate data streams (ADS) on NTFS file systems?

  1. Streams.exe (Sysinternals), LADS, or PowerShell Get-Item -Stream * Correct answer.
  2. Microsoft Edge
  3. Windows Photos
  4. Calculator

Explanation

Streams.exe (Mark Russinovich, Sysinternals) lists NTFS ADS recursively. LADS is a third-party alternative. PowerShell offers 'Get-Item -Stream *' (and 'dir /R' in cmd.exe since Vista). These are core CHFI tools because attackers commonly hide payloads in ADS like 'innocent.txt:hidden.exe'.

Question 30Digital evidence, acquisition and bounded forensic conclusions

Which RAID level provides striping with distributed parity, allowing single-disk failure recovery?

  1. RAID 0
  2. RAID 1
  3. RAID 5 Correct answer.
  4. RAID 10

Explanation

In the stated conventional RAID5 model with the remaining required members intact, distributed parity permits reconstruction after one drive fails. Acquisition and reconstruction require the actual layout, member order and metadata; one component disk generally does not represent a complete independently readable logical array.

Question 31Digital evidence, acquisition and bounded forensic conclusions

On a Windows system using NTFS, which file contains the metadata for every file and directory, including timestamps, permissions, and data attribute pointers?

  1. $Boot
  2. $MFT (Master File Table) Correct answer.
  3. pagefile.sys
  4. $LogFile

Explanation

The Master File Table ($MFT) is NTFS's central metadata structure. Each file and directory has an MFT record (typically 1024 bytes) containing standard information attributes (timestamps, flags), filename, security descriptors, and either resident data or pointers to non-resident data runs. Recovering deleted files often relies on parsing $MFT entries that have been marked free but not overwritten.

Question 32Digital evidence, acquisition and bounded forensic conclusions

A Windows system shows boot manager 'bootmgr' loading from the EFI system partition. Which boot method is in use?

  1. BIOS-MBR
  2. UEFI-GPT Correct answer.
  3. PXE network boot
  4. ROM-BASIC

Explanation

UEFI firmware boots from a GPT-partitioned disk by loading the Windows Boot Manager (bootmgfw.efi) from the EFI System Partition (ESP). BIOS-MBR uses legacy 16-bit code in the Master Boot Record. CHFI v11 covers both methods because forensic disk imaging and partition recovery differ between MBR and GPT layouts.

Question 33Digital evidence, acquisition and bounded forensic conclusions

An investigator extracts a SIM card from a suspect's phone. Which artifact is MOST commonly stored on the SIM itself?

  1. Browser history and cookies
  2. IMSI, ICCID, and last-dialed numbers (LND) along with limited SMS storage Correct answer.
  3. Full photo library
  4. Application data for installed apps

Explanation

SIM cards store the ICCID (Integrated Circuit Card ID), IMSI (International Mobile Subscriber Identity), authentication keys, last-dialed numbers, and a limited set of SMS messages and contacts. Most user data - photos, app data, browser history - is stored on the device's internal flash, not the SIM.

Question 34Digital evidence, acquisition and bounded forensic conclusions

Which Windows event log ID indicates a successful interactive logon?

  1. 4624 Correct answer.
  2. 4625
  3. 4634
  4. 4688

Explanation

Event ID 4624 is logged in the Windows Security log on every successful logon, with a Logon Type field that distinguishes interactive (2), network (3), batch (4), service (5), unlock (7), RDP (10), and others. CHFI investigators rely on 4624 (and the failed-logon counterpart 4625) for authentication-event reconstruction.

Question 35Digital evidence, acquisition and bounded forensic conclusions

A web server is running Microsoft IIS. By default, where are the W3C-format access logs stored?

  1. C:\Windows\System32\LogFiles\W3SVC1\
  2. C:\inetpub\logs\LogFiles\W3SVCx\ (where x is the site ID) Correct answer.
  3. C:\ProgramData\Microsoft\IIS\AccessLog\
  4. /var/log/iis/

Explanation

Modern IIS (7+) writes W3C extended access logs to %SystemDrive%\inetpub\logs\LogFiles\W3SVC{siteId}\ by default, with each site getting its own subfolder. Older versions (IIS 6 and earlier) used %SystemRoot%\System32\LogFiles. Investigators should always confirm the path in the IIS Manager rather than assume defaults.

Question 36Digital evidence, acquisition and bounded forensic conclusions

An Apache web server stores access logs with entries in 'combined' log format. Which file typically holds them on a default Linux installation?

  1. /etc/apache2/access.log
  2. /var/log/apache2/access.log (Debian/Ubuntu) or /var/log/httpd/access_log (RHEL/CentOS) Correct answer.
  3. /usr/share/apache2/logs
  4. /proc/apache/access

Explanation

On Debian/Ubuntu Apache writes to /var/log/apache2/access.log; on RHEL/CentOS the package is httpd and logs go to /var/log/httpd/access_log. The combined log format adds Referer and User-Agent fields to the common format, which is critical for tracing browsers and referrers during web-attack investigations.

Question 37Digital evidence, acquisition and bounded forensic conclusions

A hex editor reports that a file begins with the bytes FF D8 FF E0. Which file format does this magic number identify?

  1. PNG
  2. JPEG (JFIF) Correct answer.
  3. PDF
  4. ZIP

Explanation

JPEG files begin with the SOI marker FF D8, and standard JFIF JPEGs follow with FF E0 (APP0 segment) containing the 'JFIF' identifier. PNG starts with 89 50 4E 47, PDF with 25 50 44 46 ('%PDF'), and ZIP with 50 4B 03 04 ('PK..'). Magic-number identification is a primary technique in file-extension-mismatch investigations.

Question 38Digital evidence, acquisition and bounded forensic conclusions

Which mobile-device data acquisition method recovers the FULL flash chip contents, including unallocated space and deleted records?

  1. Logical acquisition
  2. Manual acquisition (photographing the screen)
  3. Physical acquisition (chip-off or full-flash bit-by-bit image) Correct answer.
  4. Cloud backup acquisition

Explanation

Physical acquisition produces a bit-by-bit image of the device's flash storage, including unallocated space, file-system slack, and deleted records - comparable to a disk image. Logical acquisition pulls only allocated, file-system-visible data through APIs/AT commands. Manual acquisition relies on user navigation, and cloud acquisition retrieves backups but misses on-device deleted artifacts.

Question 39Digital evidence, acquisition and bounded forensic conclusions

What does the 'CDR' in a cellular investigation refer to?

  1. Cellular Data Repository
  2. Call Detail Record Correct answer.
  3. Centralized Device Registry
  4. CDMA Data Resource

Explanation

Call Detail Records are subscriber-call metadata produced by carriers, including originating and terminating numbers, call duration, start/end timestamps, cell tower (cell site) IDs, and signal-direction. Investigators subpoena CDRs from carriers to tie a subject's phone to a particular tower at a specific time during cell-site analysis.

Question 40Digital evidence, acquisition and bounded forensic conclusions

Which file system is native to modern macOS volumes and replaced HFS+ starting with macOS 10.13 High Sierra?

  1. exFAT
  2. APFS (Apple File System) Correct answer.
  3. NTFS
  4. ext4

Explanation

APFS (Apple File System) became the default for SSDs in macOS High Sierra (10.13, 2017) and was extended to all storage classes in 10.14+. It supports cloning, snapshots, and native encryption. Forensic tools such as Biskus APFS Capture and Cellebrite parse APFS structures; older HFS+ tools cannot read APFS volumes.

Question 41Digital evidence, acquisition and bounded forensic conclusions

Which Windows artifact stores user-level information about folders that have been browsed in Explorer, including remote shares and removable drives?

  1. Prefetch files
  2. ShellBags Correct answer.
  3. Pagefile
  4. Hosts file

Explanation

ShellBags are stored in NTUSER.DAT and UsrClass.dat under the Software\Microsoft\Windows\Shell\Bags and BagMRU keys. They record folder view preferences for every directory the user has opened in Explorer - including network shares and USB drives that have since been disconnected - making them invaluable for proving knowledge-of-folder evidence.

Question 42Digital evidence, acquisition and bounded forensic conclusions

An investigator opens a .lnk file in a Windows forensic suite. Which information is MOST likely embedded in the LNK file?

  1. Source code of the target program
  2. Original target path, MAC times of the target, and volume serial number Correct answer.
  3. User's saved passwords
  4. Email contents

Explanation

Windows shortcut (.lnk) files contain the absolute target path, the target's modified/access/created timestamps at link-creation time, target file size, volume serial number, and (often) the NetBIOS name of the source machine. They are valuable for proving access to files that have since been deleted or that lived on a removed USB drive.

Question 43Digital evidence, acquisition and bounded forensic conclusions

Database evidence in a Microsoft SQL Server may include which of the following primary log files for transaction history?

  1. *.mdf data file
  2. *.ldf transaction log Correct answer.
  3. *.ndf secondary data file
  4. *.bak backup file

Explanation

SQL Server uses .mdf for the primary data file, .ndf for secondary data files, and .ldf for the transaction log. The transaction log captures every modification (INSERT/UPDATE/DELETE/DDL) and is the primary forensic source for reconstructing what changed and when, even if rows were later deleted from the data file.

Question 44Digital evidence, acquisition and bounded forensic conclusions

Why is a Web Application Firewall (WAF) considered evidence-bearing during a web-attack investigation?

  1. WAFs encrypt all evidence automatically
  2. WAFs log allowed and blocked HTTP transactions, including request payloads, that document attack attempts Correct answer.
  3. WAFs replace the need for Apache or IIS logs
  4. WAFs cannot store any forensic data

Explanation

WAFs (e.g., ModSecurity, AWS WAF, F5 ASM) log HTTP transactions at layer 7 with request bodies, headers, matched rule IDs, and action taken (block, log, challenge). These logs often capture attack payloads such as SQL injection or XSS attempts in detail superior to standard web-server logs, making them critical evidence in web-application forensics.

Question 45Digital evidence, acquisition and bounded forensic conclusions

Which SSD-specific feature can erase deleted blocks asynchronously and complicate forensic recovery of deleted files?

  1. TRIM (and ATA Secure Erase) Correct answer.
  2. Wear leveling alone
  3. S.M.A.R.T. monitoring
  4. Defragmentation

Explanation

The TRIM command tells an SSD that certain logical block addresses are no longer in use, allowing the controller to background-erase the corresponding NAND pages. After TRIM runs, traditional file-carving from unallocated space recovers nothing because blocks return zeros. Investigators must image SSDs as quickly as possible and consider chip-off when TRIM has run.

Question 46Digital evidence, acquisition and bounded forensic conclusions

What is the primary forensic value of the Windows Registry hive NTUSER.DAT?

  1. It stores network firewall rules
  2. It contains user-specific configuration including MRU lists, ShellBags, TypedPaths, and recent docs Correct answer.
  3. It holds the machine's BIOS firmware
  4. It logs Active Directory replication

Explanation

NTUSER.DAT (in C:\Users\<user>\) is the per-user registry hive, mounted at HKEY_CURRENT_USER at logon. It contains user-specific settings including RecentDocs, TypedPaths, RunMRU, OpenSavePidlMRU, and ShellBags - all goldmines for showing what files a user opened, where they typed paths, and which folders they browsed.

Question 47Digital evidence, acquisition and bounded forensic conclusions

Which of the following is a non-volatile data source that an investigator should image during dead acquisition?

  1. RAM contents
  2. Hard disk drives and SSDs Correct answer.
  3. Process list
  4. Network connection state

Explanation

Non-volatile data persists when power is removed, including disks (HDD/SSD), removable media, BIOS/UEFI configuration, and TPM-stored keys. Volatile data (RAM, processes, network state, clipboard) is lost on power-off and must be captured during live acquisition before shutdown.

Question 48Digital evidence, acquisition and bounded forensic conclusions

An investigator must determine the IP address that originated an SSH connection on a Linux host. Which log is the BEST source?

  1. /var/log/dmesg
  2. /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (RHEL/CentOS) Correct answer.
  3. /var/log/messages
  4. /etc/ssh/sshd_config

Explanation

The named distribution-specific authentication logs are relevant in the stated logging model, though systems may use a journal or other configured destinations. A recorded source IP identifies an observed network peer; intermediaries and shared accounts prevent treating it as automatic proof of the original human actor.

Question 49Digital evidence, acquisition and bounded forensic conclusions

When acquiring evidence from a running system, which data should an investigator collect FIRST in a typical CHFI workflow?

  1. Imaging the hard disk
  2. Collecting volatile data (RAM, processes, network state) before powering off Correct answer.
  3. Photographing the room
  4. Booting the system into Safe Mode

Explanation

When a system is running, the investigator captures volatile data first - RAM, running processes, network connections, logged-in users, mounted volumes - because these are lost on shutdown. After volatile data is preserved (with hashes), the disk is imaged either live or after a controlled shutdown depending on case requirements.

Question 50Digital evidence, acquisition and bounded forensic conclusions

What is the role of a 'first responder' in a digital crime scene?

  1. To analyze evidence in the lab
  2. To secure the scene, document conditions, identify volatile/perishable evidence, and prevent contamination Correct answer.
  3. To prosecute the suspect in court
  4. To write the final forensic report only

Explanation

The first responder secures the scene, documents physical conditions (photographs, sketches, witness statements), identifies powered-on systems requiring volatile capture, and prevents contamination by isolating devices from networks and untrained users. CHFI emphasizes common first-responder mistakes such as moving the mouse, plugging in unknown USB drives, or shutting down systems prematurely.