CHFI General MCQ 5 — Questions and Answers
Question 1: In the context of email forensics, which header field reveals the originating IP address of the sender's mail client?
- From:
- Reply-To:
- Received: (Correct answer)
- X-Mailer:
Correct answer: Received:
The 'Received:' header chain in an email message traces the path of the message and typically includes the originating IP address of the sending client.
Question 2: Which forensic framework provides a Python-based API for analyzing memory dumps, including support for Windows, Linux, and macOS profiles?
- Autopsy
- Volatility (Correct answer)
- Sleuth Kit
- EnCase
Correct answer: Volatility
Volatility is an open-source memory forensics framework with a plugin-based architecture for analyzing RAM dumps across multiple operating systems.
Question 3: An investigator needs to prove that a forensic image is an exact copy of the original drive. Which two hash values are typically computed and compared?
- CRC32 and Adler-32
- MD5 and SHA-1 (Correct answer)
- RIPEMD-160 and Tiger
- Whirlpool and SHA-512
Correct answer: MD5 and SHA-1
MD5 and SHA-1 are the two hash algorithms most commonly used together in forensic tools like FTK Imager to verify image integrity.
Question 4: What is a 'dead-box' forensic examination?
- Analysis of a powered-on system while it is running
- Forensic analysis of a powered-off device using an acquired image (Correct answer)
- Remote forensic investigation over a network connection
- Examination of a decommissioned server rack
Correct answer: Forensic analysis of a powered-off device using an acquired image
Dead-box forensics refers to examining a device that has been powered off, typically through analysis of a forensic disk image.
Question 5: Which artifact in Windows records recently opened files and folders and is used by the system to populate the 'Recent Items' list?
- Prefetch files
- LNK (shortcut) files (Correct answer)
- Thumbnail cache (thumbcache.db)
- Windows.edb search index
Correct answer: LNK (shortcut) files
LNK (shortcut) files are automatically created in the Recent Items folder and record metadata about files recently opened, including original file path and timestamps.
Question 6: During a network intrusion investigation, a forensic analyst captures packets and finds large amounts of DNS TXT record queries with encoded payloads. What attack technique does this suggest?
- ARP spoofing
- DNS tunneling (Correct answer)
- BGP hijacking
- ICMP flood
Correct answer: DNS tunneling
DNS tunneling encodes data within DNS query and response records (often TXT records) to covertly exfiltrate data or establish C2 communication.
Question 7: Under the US Federal Rules of Evidence, for digital evidence to be admissible it must meet which foundational requirement?
- It must be collected using open-source tools only
- It must be authenticated — shown to be what it is claimed to be (Correct answer)
- It must be encrypted during transport to court
- It must be analyzed by at least two independent examiners
Correct answer: It must be authenticated — shown to be what it is claimed to be
Under FRE Rule 901, digital evidence must be authenticated, meaning the proponent must produce evidence sufficient to support a finding that the item is what it is claimed to be.
CHFI General MCQ 5
In the context of email forensics, which header field reveals the originating IP address of the sender's mail client?