CHFI General 3 — Questions and Answers
Question 1: Which Windows registry hive stores user-specific settings and is critical for forensic investigations of user activity?
- HKEY_LOCAL_MACHINE
- HKEY_CLASSES_ROOT
- HKEY_CURRENT_USER (Correct answer)
- HKEY_PERFORMANCE_DATA
Correct answer: HKEY_CURRENT_USER
HKEY_CURRENT_USER (backed by the NTUSER.DAT hive) stores settings and activity data specific to the logged-in user.
Question 2: In network forensics, what does the term 'full packet capture' refer to?
- Capturing only packet headers and metadata
- Recording complete network packet content including payloads (Correct answer)
- Logging failed connection attempts only
- Mirroring traffic exclusively to an IDS sensor
Correct answer: Recording complete network packet content including payloads
Full packet capture records entire network packets, including headers and payload data, enabling comprehensive traffic reconstruction.
Question 3: What is the significance of the MFT (Master File Table) in NTFS forensics?
- It stores the system BIOS settings
- It contains metadata for every file and directory on the volume (Correct answer)
- It holds encryption keys for BitLocker volumes
- It manages page file allocation for virtual memory
Correct answer: It contains metadata for every file and directory on the volume
The MFT is the core database of an NTFS volume, containing attributes including timestamps, file size, and data location for every object.
Question 4: Which anti-forensic technique involves hiding data within ordinary-looking files such as images or audio?
- Log tampering
- Steganography (Correct answer)
- Data wiping
- Timestamp manipulation
Correct answer: Steganography
Steganography conceals secret data within innocuous carrier files, making detection challenging without specialized tools.
Question 5: What is the purpose of the 'dd' command in Unix-based forensic investigations?
- To analyze network traffic in real time
- To create a bit-for-bit image of a storage device (Correct answer)
- To decrypt encrypted volumes
- To parse Windows event logs
Correct answer: To create a bit-for-bit image of a storage device
The dd command copies data at the bit level, enabling forensic duplication of drives while preserving every byte including deleted data.
Question 6: Which artifact found on Windows systems records recently accessed files and application launch history?
- Prefetch files (Correct answer)
- Shadow copies
- Page file
- Hibernation file
Correct answer: Prefetch files
Windows Prefetch files cache application launch data to speed startup and record execution timestamps and file access patterns.
Question 7: In the context of CHFI investigations, what does the term 'volatile data' refer to?
- Data stored in encrypted containers
- Data that exists only while a system is powered on and is lost at shutdown (Correct answer)
- Data overwritten by file system operations
- Data hidden in slack space
Correct answer: Data that exists only while a system is powered on and is lost at shutdown
Volatile data resides in RAM, CPU registers, and running processes, and is immediately lost when the system is powered off.
CHFI General 3
Which Windows registry hive stores user-specific settings and is critical for forensic investigations of user activity?