Free CHFI (312-49) Questions and Answers — Questions and Answers
Question 1: The Inspect Pane can be used to view the file content of evidence files. To display file content, the View pane offers a number of tabs. Which of these tabs offers native views of the formats that Oracle supports outside of its own technology?
- Doc tab (Correct answer)
- Text tab
- Hex tab
- Picture tab
Correct answer: Doc tab
The Doc tab in forensic tools like EnCase is designed to provide native views of various document formats, including those created by applications like Microsoft Office, Adobe PDF, and other common business software. It allows investigators to view these files as they would appear in their original applications, without needing the applications themselves. This functionality is crucial for examining a broad range of document types, including those that might be supported by or interact with Oracle technologies, but are not exclusively Oracle's proprietary format.
Question 2: You can access and examine a large portion of the Registry's data during live response, and all of it during post-mortem analysis. Which registry Hive in the system stores configuration data connected to the software that is used to open different file types?
- HKEY_CURRENT_CONFIG
- HKEY_USERS
- HKEY_CURRENT_USER
- HKEY_CLASSES_ROOT (Correct answer)
Correct answer: HKEY_CLASSES_ROOT
The HKEY_CLASSES_ROOT (HKCR) hive in the Windows Registry is crucial for defining file associations and OLE (Object Linking and Embedding) information. It stores data that tells the operating system which application should open a specific file type based on its extension, as well as information about COM objects. This hive is essential for the system to correctly launch programs when a user double-clicks a file, making it a key source for understanding software usage and file interactions.
Question 3: Which of the following is a hard disk's smallest allocation unit? Depending on the formatting system, a hard disk can have anywhere between 2 and 32 tracks and sectors.
- Cluster (Correct answer)
- Sector
- 4Platter
- Track
Correct answer: Cluster
A cluster is the smallest logical unit of disk space that the operating system can allocate to hold a file. While a sector is the smallest physical unit of storage on a disk, the operating system groups multiple sectors together to form a cluster. Files are stored in whole clusters, meaning even a tiny file will occupy at least one full cluster, leading to potential slack space which can contain remnants of previous data.
Question 4: The gathering, evaluation, and reporting of evidence are standard investigation procedures that are automated and streamlined using Source Processor. Which of these source processor modules can access the target computer's disks and memory?
- Personal Information Module
- File Processor Module
- Acquisition Module (Correct answer)
- Internet Artifacts Module
Correct answer: Acquisition Module
The Acquisition Module in forensic tools like Source Processor is specifically designed to perform the initial and critical step of data collection. Its primary function is to create forensically sound copies of data from target computers, including imaging hard drives (disks) and capturing volatile data from RAM (memory). This module ensures that evidence is gathered completely and without alteration, preserving its integrity for subsequent analysis.
Question 5: Which of these attack methods combines a dictionary attack and a brute-force attack to break a password?
- Rule-based Attack
- Hybrid Attack (Correct answer)
- Fusion Attack
- Syllable Attack
Correct answer: Hybrid Attack
A hybrid attack combines elements of both dictionary attacks and brute-force attacks to crack passwords more efficiently. It starts by using a dictionary of common words and phrases, then systematically adds variations such as numbers, symbols, or character substitutions (e.g., 'P@ssw0rd') to those dictionary words. This approach significantly expands the potential password space beyond a simple dictionary while being more targeted than a pure brute-force attack.
Question 6: Computer forensic investigator Carlo is. He was given an assignment by a company to look into a forensic case. The computer at the crime site was turned off when Carlo arrived at the company to investigate the location. What do you think Carlo ought to do in this situation?
- He should leave the computer off (Correct answer)
- He should turn on the computer
- He should turn on the computer and should start analyzing it
- He should turn on the computer and extract the data
Correct answer: He should leave the computer off
When a computer at a crime scene is found turned off, the best practice for a forensic investigator is to leave it off. Turning it on would alter the system's state, potentially overwriting volatile data in RAM and modifying timestamps or log files, thus compromising the integrity of potential evidence. The correct procedure is to transport the device to a forensic lab for a controlled examination, where a forensically sound acquisition can be performed without altering the original state.
Question 7: The link between the four panes of the EnCase interface reflects the cyclical nature of the process of reviewing obtained evidence. Which of the following panes displays an organized view of all acquired evidence in a folder hierarchy similar to Windows?
- Filter Pane
- Tree pane (Correct answer)
- Table Pane
- View Pane
Correct answer: Tree pane
The Tree pane in forensic software like EnCase provides a hierarchical, explorer-like view of all acquired evidence. It allows investigators to navigate through the logical and physical structure of the imaged drives, partitions, and folders, much like a standard file explorer. This organized view is essential for quickly locating and understanding the overall structure of the collected data, facilitating efficient evidence review.
Free CHFI (312-49) Questions and Answers
The Inspect Pane can be used to view the file content of evidence files.
To display file content, the View pane offers a number of tabs.
Which of these tabs offers native views of the formats that Oracle supports outside of its own technology?