CHFI Cheat Sheet 2026

The 30 highest-yield CHFI facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. An investigator finds evidence of a deleted photo on an iPhone. Which iOS artifact might still contain thumbnail references to the deleted image? → Photos.sqlite
2. Which Oracle database view provides information about all currently connected sessions and can help identify unauthorized access? → V$SESSION
3. When imaging a solid-state drive (SSD), which characteristic makes forensic acquisition more challenging than with HDDs? → Wear leveling and TRIM commands can overwrite deleted data, reducing recoverability
4. A forensic examiner needs to acquire a 4TB drive but only has 2TB of available storage. Which approach is MOST appropriate? → Use compressed forensic imaging (e.g., E01 with compression)
5. During a web attack investigation, you find the string `' OR '1'='1` in server logs. What type of attack does this indicate? → SQL injection
6. Which tool is built into Windows and can be used to view the detailed security permissions and audit settings on registry keys? → regedit.exe with 'Permissions' dialog
7. What term describes the area between the last partition and the end of the disk that is not allocated to any partition? → Unpartitioned space
8. A forensic investigator finds a file with a .txt extension but the file header shows 'FF D8 FF E0'. What does this indicate? → The file extension has been changed to hide a JPEG image
9. What is the primary goal of the 'containment' step when a forensic investigation overlaps with an active incident response? → Stop the spread of the incident while minimizing disruption and preserving evidence
10. During an intrusion investigation, which log source on a Windows system would best reveal successful and failed login attempts? → Security Event Log
11. Which open-source full disk encryption tool is considered a major challenge for digital forensic investigators due to its strong encryption? → VeraCrypt
12. An investigator needs to prove that a forensic image is an exact copy of the original drive. Which two hash values are typically computed and compared? → MD5 and SHA-1
13. What information is stored in the Windows Prefetch files located in C:\Windows\Prefetch? → Executable run count, last run time, and files/directories referenced during execution
14. Which anti-forensic technique involves hiding data within ordinary-looking files such as images or audio? → Steganography
15. Which log file on a Linux Apache server would contain evidence of a PHP web shell being executed? → /var/log/apache2/error.log and access.log
16. What disk regions, not normally reported by the OS, can be used to hide data as an advanced anti-forensics technique? → Host Protected Area (HPA) and Device Configuration Overlay (DCO)
17. A forensic examiner is analyzing a suspect's browser history. Which SQLite database file stores Chrome's browsing history? → History
18. During a network forensics investigation, an analyst notices many short-duration flows to a single external IP. This pattern is most consistent with: → Beaconing malware behavior
19. Which SQL Server system database stores metadata about all other databases on the SQL Server instance? → master
20. Which of the following actions would be performed during the Analysis phase of a digital forensic investigation? → Searching for keywords, recovering deleted files, and building a timeline of events.
21. In network forensics, which protocol is analyzed to reconstruct email communications sent over an unencrypted channel? → SMTP
22. What is the primary goal of anti-forensics techniques? → To prevent, destroy, or obfuscate digital evidence
23. Which Windows artifact can reveal evidence of a program execution even if the executable has since been deleted, by tracking compatibility telemetry data? → Application Compatibility Cache (Shimcache) in the registry
24. In web attack forensics, what does the presence of `%2e%2e%2f` in a URL request indicate? → URL-encoded directory traversal (`../`)
25. Which standard governs the handling of digital evidence in mobile forensics to ensure admissibility in US courts? → NIST SP 800-101
26. Which hashing algorithm is commonly used in CHFI to verify the integrity of forensic disk images? → MD5 or SHA-1
27. Which of the following best describes steganography in the context of digital forensics? → Hiding data within another file or medium
28. An investigator notices that a malware sample modifies the SSDT (System Service Descriptor Table). This is an indicator of which malware category? → Kernel-mode rootkit
29. What does a high number of RST packets from a single source typically indicate during forensic analysis? → A port scan where the scanner receives RST responses from closed ports
30. During an email forensics investigation, what does a missing or broken DMARC alignment indicate? → The email may be a phishing attempt or spoofed to impersonate a legitimate domain