Free CHFI Practice Questions

Question 1

An examiner with authority to collect a laptop's contents finds it running with an unlocked, fully encrypted volume. No recovery key is available. Network isolation is already in place, no destructive activity is occurring, and validated live-acquisition tools are available. Which collection sequence preserves the best opportunity to examine the contents?

Accepted Answer

Capture RAM first, then collect accessible plaintext while the encrypted volume remains unlocked.

Answer

Shut down normally, then image the drive through a validated write blocker.

Answer

Image the encrypted drive, then restart the laptop from trusted forensic media.

Answer

Enable hibernation, power off, and acquire the hibernation file from the drive.

Question 2

The Security log on FILE-SRV contains a Microsoft-Windows-Security-Auditing event with these fields:
Event ID: 4624
SubjectUserName: FILE-SRV$
TargetUserName: j.ross
LogonType: 10
IpAddress: 10.20.4.18
What activity does this record identify?

Accepted Answer

j.ross established a remote-interactive session on FILE-SRV.

Answer

j.ross authenticated to an SMB file share without opening an interactive session.

Answer

j.ross signed in at FILE-SRV's local console using the workstation's keyboard.

Answer

FILE-SRV$ established a remote-interactive session, with j.ross as the reporting account.

Question 3

A write-blocked drive was acquired into a compressed E01 image without read errors. Independent verification confirms that the decoded image data and the source sectors have identical SHA-256 digests. Hashing the E01 container file produces a different digest. How should the examiner handle this discrepancy?

Accepted Answer

Document the different hash scopes and proceed with a verified working copy.

Answer

Reacquire as uncompressed E01 to eliminate the container-file hash difference.

Answer

Suspend examination until the E01 file and source-sector digests match.

Answer

Substitute the E01 file digest for the source-sector digest in the acquisition record.

Question 4

Static analysis of a suspicious executable reports Shannon entropy of 7.94 bits per byte for one section. The analyst writes, 'This section is encrypted malware.' Which replacement statement accurately describes what the measurement supports?

Accepted Answer

High entropy is consistent with compression or encryption, not proof of malware.

Answer

The section is encrypted; compression would produce lower entropy.

Answer

The section contains packed code whose packer has not yet been identified.

Answer

Deliberate byte randomization has defeated signature-based malware detection.

Question 5

Two laboratories calculate identical SHA-256 digests for a transferred raw disk image. The transfer log nevertheless contains a six-hour interval with no identified custodian. During review of the evidence, what can the examiner properly conclude?

Accepted Answer

The content matches at the two checks; custody during the gap remains undocumented.

Answer

The image must be reacquired because the custody gap invalidates its hashes.

Answer

The hashes authenticate the transfer, including who controlled the image during the undocumented interval.

Answer

The undocumented interval establishes tampering despite successful verification of the image's contents.

Question 6

A seized six-drive RAID 10 uses three striped mirror pairs: (A, B), (C, D), and (E, F). Each drive is 4 TiB. B and D are unreadable, but sector-complete images of the other four members are available and the array layout is known. Ignoring filesystem overhead, what logical capacity remains reconstructable, and why?

Accepted Answer

The full 12 TiB remains reconstructable: each mirror still has a readable member.

Answer

The full 16 TiB remains reconstructable from the four surviving member images.

Answer

Only 4 TiB remains reconstructable from the intact E-F mirror pair.

Answer

No logical volume can be reconstructed before at least one failed member is recovered.

Question 7

An XML upload defines an entity named host with the system identifier file:///etc/hostname. The response substitutes the server's hostname where &host; appears in the submitted document. Process telemetry attributes the file read to the XML parser, with no shell process created. Which attack mechanism accounts for these findings?

Accepted Answer

XML external entity expansion by the server-side parser.

Answer

Directory traversal through an unsafe relative path.

Answer

Command injection that makes a shell read the server's file.

Answer

Reflected cross-site scripting executed by the client's browser.

Question 8

A capture of plaintext FTP traffic shows an internal workstation issuing STOR clients.zip on TCP port 21. Passive-mode negotiation assigns server port 51080, and the corresponding data connection is present in the capture. Where should the examiner reconstruct the uploaded file's contents?

Accepted Answer

In the client-to-server side of the data connection negotiated on TCP 51080.

Answer

In the client's TCP 21 control stream.

Answer

In the server-to-client side of the data connection negotiated on TCP 51080.

Answer

In the server's TCP 21 control stream, using the reply that confirms transfer completion.

Question 9

During forensic response at a chemical plant, an operator reports loss of cooling and confirms that the site's emergency shutdown criteria have been met. Capturing memory from the suspect controller would delay the established safe-shutdown procedure. What takes priority?

Accepted Answer

Allow authorized plant staff to execute the emergency procedure without forensic delay.

Answer

Freeze controller communications before collecting volatile memory.

Answer

Capture the controller's RAM before allowing the shutdown.

Answer

Restart the controller from trusted firmware to restore safe operation.

Question 10

An Android phone using file-based encryption has rebooted and has not yet been unlocked. An authorized extraction obtains device-encrypted files but cannot read a messaging database stored in credential-encrypted storage. The handset is otherwise functioning normally. Which access limitation explains this result?

Accepted Answer

Device-encrypted data can be available while credential-encrypted data remains locked.

Answer

A completed boot restores the prior unlocked state, making deletion the likely explanation for the missing database.

Answer

Both storage classes share one access state, so a partially readable extraction indicates filesystem corruption.

Answer

Physical acquisition necessarily makes credential-encrypted databases readable without the user's credential.

Free CHFI Practice Questions

Domain 1: Forensic Science 15% of exam

Question 1

Question 2

Domain 2: Regulations, Policies and Ethics 10% of exam

Question 3

Domain 3: Digital Evidence 18% of exam

Question 4

Question 5

Question 6

Domain 4: Procedures and Methodology 17% of exam

Question 7

Domain 5: Digital Forensics 29% of exam

Question 8

Question 9

Question 10

The rest of the CHFI blueprint

That's 10 of 1,030