CHFI General MCQ 2 — Questions and Answers
Question 1: Which file system artifact records the last time a file was accessed on an NTFS volume?
- $MFT entry timestamps (Correct answer)
- $LogFile journal
- Volume Shadow Copy
- Prefetch files
Correct answer: $MFT entry timestamps
The $MFT (Master File Table) entry stores MACB timestamps, including last access time, for every file on an NTFS volume.
Question 2: During a live forensic acquisition, an investigator wants to capture volatile memory. Which tool is most appropriate?
- FTK Imager
- Volatility
- WinPmem (Correct answer)
- Autopsy
Correct answer: WinPmem
WinPmem is a memory acquisition tool used to dump live RAM to a file on Windows systems.
Question 3: What is the primary purpose of the 'chain of custody' document in digital forensics?
- Record all software used during analysis
- Track evidence handling to preserve admissibility (Correct answer)
- List all suspects involved in the case
- Document the network topology of the crime scene
Correct answer: Track evidence handling to preserve admissibility
Chain of custody tracks who handled evidence, when, and how to ensure it remains unaltered and legally admissible.
Question 4: An investigator finds a file with a .jpg extension but its hex header shows '50 4B 03 04'. What is the actual file type?
- JPEG image
- PDF document
- ZIP archive (Correct answer)
- PNG image
Correct answer: ZIP archive
The magic bytes '50 4B 03 04' are the signature for ZIP archive files, regardless of the file extension.
Question 5: Which Windows registry hive stores user-specific settings and is loaded from the user's profile directory?
- HKEY_LOCAL_MACHINE
- HKEY_CURRENT_USER (NTUSER.DAT) (Correct answer)
- HKEY_CLASSES_ROOT
- HKEY_LOCAL_MACHINE\SYSTEM
Correct answer: HKEY_CURRENT_USER (NTUSER.DAT)
HKEY_CURRENT_USER maps to NTUSER.DAT in the user's profile folder and stores user-specific configuration.
Question 6: What does the term 'write blocker' refer to in digital forensics?
- Software that encrypts evidence drives
- Hardware or software that prevents modification of source media (Correct answer)
- A tool that blocks write access to the forensic workstation
- A network device that filters write traffic
Correct answer: Hardware or software that prevents modification of source media
A write blocker prevents any write operations to the evidence drive, ensuring the original data is not altered during acquisition.
Question 7: In network forensics, which protocol is analyzed to reconstruct email communications sent over an unencrypted channel?
- HTTPS
- SMTP (Correct answer)
- DNS
- FTP
Correct answer: SMTP
SMTP (Simple Mail Transfer Protocol) is used for sending emails and can be captured and reconstructed in packet captures when unencrypted.
CHFI General MCQ 2
Which file system artifact records the last time a file was accessed on an NTFS volume?