Computer Hacking Forensic Investigator (CHFI v11) Free Sample Questions

Centralized logging with secure forwarding ensures that potential evidence (logs) is preserved in near real-time outside the compromised environment. This allows investigators to analyze events without needing to take critical business systems offline immediately for imaging, aligning with forensic readiness goals of minimizing disruption. Full-disk imaging daily is impractical for performance, and relying solely on local logs risks deletion by attackers.

Fileless malware using memfd_create() resides solely in RAM and does not have a persistent file on the disk. Pulling the plug (dead acquisition) would destroy the RAM and thus the evidence of the malware. A live memory acquisition is critical to capture the process memory where the payload resides.

According to RFC 3227, the order of volatility is: CPU Registers/Cache (most volatile) -> Routing Table/ARP Cache/Process Table/Kernel Statistics/Memory -> Temporary File Systems -> Disk -> Remote Logging and Monitoring Data -> Physical Configuration/Topology -> Archival Media (least volatile).

The Tor Browser is often portable and does not always install registry keys like standard software. However, Windows Prefetch files (.pf) in C:\Windows\Prefetch are created automatically when an application is executed. Finding tor.exe.pf or a firefox.exe.pf (since Tor is based on Firefox) running from a non-standard directory (like Desktop or USB) is a strong indicator of Tor usage.

JTAG forensics involves connecting to the Test Access Ports (TAPs) on the device's printed circuit board (PCB) to read the memory contents directly from the chip. This is a non-destructive method compared to 'Chip-off' (which involves desoldering) and allows acquisition when standard software ports are disabled or unavailable.

Email headers are added from bottom to top. The receiving server adds the topmost 'Received' header, which is generally trusted. However, attackers can inject fake 'Received' headers at the bottom of the chain to mislead investigators about the true origin. Investigators must analyze the chain from top to bottom to verify continuity.

This is a classic anti-forensic technique known as VM Detection or Anti-Sandboxing. Malware authors use it to prevent security researchers and automated sandboxes from analyzing the malware's behavior. If the malware detects it is running in a virtual environment (common for analysis labs), it stays dormant.

Cryptographic hashes (like MD5, SHA-1, SHA-256) act as a digital fingerprint. If a single bit of the data changes, the hash value changes completely. Matching hashes prove mathematically that the evidence has not been altered since acquisition.

The Best Evidence Rule states that the original writing, recording, or photograph is required to prove its content. In digital forensics, an accurate bit-stream duplicate (forensic image) is legally accepted as an 'original' under Federal Rules of Evidence (e.g., FRE 1001(d)), provided it is authenticated.

The GDPR imposes strict restrictions on the transfer of personal data of EU citizens to countries outside the EEA. Investigators must ensure mechanisms like Standard Contractual Clauses (SCCs) or mutual legal assistance treaties (MLATs) are in place before transferring evidence containing PII to the US.