Free CHFI v11 Practice Exam (2026)

Your score by topic

Get a free CHFI v11 study plan on WhatsApp See CHFI v11 Training with pass guarantee

Review answers Only my mistakes Retake

Question 1Digital Evidence⚑ Flag

A first responder at Harbor Freight Logistics finds a compromised Linux web server still running and connected to the network. Policy lets the responder collect only one item at a time. Following the RFC 3227 order of volatility, which item should be collected FIRST?

ALogs held on the remote syslog server BContents of the /tmp temporary file system CThe ARP cache and routing table DA bit-stream image of the system disk

Correct answer: C. The ARP cache and routing table
RFC 3227 ranks the routing table and ARP cache above temporary file systems, disks and remote logs because network state changes within seconds. The /tmp directory is volatile too, but it lasts longer than cached network entries and comes later in the order.

Question 2Procedures & Methodology⚑ Flag

Lakeview Forensics just upgraded its disk imaging software to a new major version. An examiner wants to use it tomorrow to acquire a drive in an active fraud case. What should the lab manager require before the new version is used on case evidence?

AAsk a second examiner to watch the acquisition and sign the notes BTest it against a known reference data set and document the results CCheck the vendor release notes to confirm no bugs were reported DUse it on the case drive and compare results with the old version later

Correct answer: B. Test it against a known reference data set and document the results
A new tool version must be validated on known data before case use so the lab can show it works as expected. Vendor release notes are useful, but they are not independent testing and prove nothing about how the tool performs in your lab.

Question 3Digital Forensics⚑ Flag

An investigator at Harlow Logistics exports the UserAssist Count subkeys from a suspect's NTUSER.DAT. The value names look like unreadable strings such as "P:\Hfref\wfzvgu\Qbjaybnqf\jvcre.rkr". What should the investigator do to interpret these entries?

ADecrypt them with the user's DPAPI key BConvert the strings from Base64 to ASCII CParse them as little-endian FILETIME values DDecode the value names with ROT13

Correct answer: D. Decode the value names with ROT13
UserAssist value names are obfuscated with ROT13, so a simple letter rotation reveals the program paths. DPAPI protects secrets such as saved credentials, not UserAssist names, and FILETIME parsing applies to timestamps in the value data, not to the names.

Question 4Digital Forensics⚑ Flag

An investigator at Harlow Logistics has a packet capture from a server that was used to stage stolen data. She needs to read the full exchange of commands and replies between the server and an external FTP host in order. What should she do in the protocol analyzer?

AFollow the TCP stream for that session BFilter the capture to show only ICMP traffic CExport the capture as a NetFlow summary DSort all packets by source port number

Correct answer: A. Follow the TCP stream for that session
Following the TCP stream reassembles the segments of one connection and shows both sides of the conversation in order. Sorting by port groups packets but does not rebuild the dialogue, and a NetFlow summary drops the payload entirely.

Question 5Forensic Science⚑ Flag

An examiner at Harlow Logistics shows that an employee's personal USB drive was used on a company workstation. The workstation registry holds the drive's serial number, and the drive holds a folder created by the workstation's user profile. Which principle best explains finding traces on both devices?

AThe best evidence rule for digital copies BLocard's exchange principle CThe order of volatility in collection DChain of custody documentation

Correct answer: B. Locard's exchange principle
Locard's exchange principle states that every contact leaves a trace, and digital contact often leaves artifacts on both systems involved. Order of volatility guides what to collect first, not why traces exist on both devices.

Question 6Tools & Programs⚑ Flag

A lab analyst at Ridgeway County Sheriff's Office must image a suspect's SATA drive from a Linux workstation using a command-line tool. Her supervisor wants the tool to compute hashes during acquisition, show progress, and write a session log without extra scripting. Which tool fits BEST?

Adc3dd Bdd Ctcpdump Dscalpel

Correct answer: A. dc3dd
dc3dd is a patched version of GNU dd from the DoD Cyber Crime Center that adds on-the-fly hashing, progress reporting and logging. Plain dd copies the drive bit for bit, but hashing and logging must be handled separately. tcpdump captures network traffic and scalpel carves files.

Question 7Regulations & Ethics⚑ Flag

Examiner Dana Ruiz of Corvane Logistics recovered a contract file from a forensic image of a suspect's laptop and printed it for trial. Opposing counsel objects that only the physical hard drive is the 'original' and the printout cannot be used. Under the Federal Rules of Evidence, how is the printout MOST likely treated?

AAs inadmissible, because the best evidence rule requires producing the physical drive BAs admissible only if the jury is also given the original hard drive to inspect CAs secondary evidence that may be used only after the drive is proven destroyed DAs an original, because an accurate printout of stored data counts as an original

Correct answer: D. As an original, because an accurate printout of stored data counts as an original
Under the best evidence rule in the Federal Rules of Evidence, any printout or other output readable by sight that accurately reflects electronically stored information is treated as an original. The rule does not require bringing the physical drive into court, so the objection fails.

Question 8Digital Evidence⚑ Flag

A prosecutor asks examiner Dana Reyes why she is presenting an E01 image rather than the seized laptop drive itself. Under the best evidence rule as applied to digital evidence, what MOST supports using the image in court?

AHash values showing the image matches the drive BA statement that the drive was too fragile to move CScreenshots of key files taken during the analysis DProof that the imaging software is commercially licensed

Correct answer: A. Hash values showing the image matches the drive
Courts generally accept an accurate duplicate in place of the original when its fidelity can be shown, and matching hash values prove the image is a bit-for-bit copy. Screenshots show selected content but do not prove the copy is complete and unaltered.

Question 9Procedures & Methodology⚑ Flag

A first responder at Harborline Credit finds a suspect's laptop powered on and logged in. A full disk encryption icon is visible in the system tray. The case requires the drive contents. What should the responder do FIRST after photographing the screen?

APull the power cord so the encrypted volume locks in its current state BShut it down normally so the encryption keys are written to disk CCapture a memory image with a trusted tool before powering off DRemove the drive immediately and attach it to a write blocker

Correct answer: C. Capture a memory image with a trusted tool before powering off
With full disk encryption, the decryption keys and unlocked data may exist only in RAM while the system runs, so memory must be captured first. Pulling the power or shutting down would lock the volume and may make the drive contents unreadable without the key.

Question 10Forensic Science⚑ Flag

A defense expert at a different lab images the same drive with a different validated tool and reaches the same findings as the state examiner. Which property of a sound forensic method does this outcome demonstrate?

AReproducibility of the results BFalsifiability of the hypothesis CAdmissibility under hearsay rules DRepeatability of the method

Correct answer: A. Reproducibility of the results
Reproducibility means a different examiner, using different equipment or settings, obtains the same result. Repeatability is narrower and refers to the same examiner getting the same result with the same method and equipment.

Question 11Digital Forensics⚑ Flag

A forensic examiner at Brightwater County Sheriff's Office must list every USB mass storage device ever attached to a seized Windows 10 desktop, including vendor, product and serial number. Which registry location should be examined FIRST?

ANTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 BSYSTEM\CurrentControlSet\Services\USBSTOR\Parameters CSOFTWARE\Microsoft\Windows Portable Devices\Devices DSYSTEM\CurrentControlSet\Enum\USBSTOR

Correct answer: D. SYSTEM\CurrentControlSet\Enum\USBSTOR
The Enum\USBSTOR key holds subkeys for each USB storage device class, built from vendor, product and revision, with the device serial number below them. MountPoints2 shows volumes a specific user saw, but it does not give a full device inventory with serial numbers.

Question 12Digital Forensics⚑ Flag

While reviewing proxy logs for Brightwater Credit Union, an analyst sees one workstation connecting to the same external IP address about every 60 seconds, day and night. Each connection sends a few hundred bytes and receives a similar small reply. What is the most likely explanation?

AA user streaming video during work hours BMalware beaconing to a command server CA failed DHCP lease renewal on the host DRoutine Windows Update download traffic

Correct answer: B. Malware beaconing to a command server
Small, regular, round-the-clock connections to one destination are a classic sign of command-and-control beaconing. Update and streaming traffic move much larger volumes on irregular schedules, and DHCP renewals go to the local DHCP server, not an external IP.

Question 13Tools & Programs⚑ Flag

An examiner at Harlow Insurance needs to image a 2 TB laptop drive for a fraud case. She wants the image file to carry case details such as examiner name and evidence number, include built-in CRC checks per block, and support compression. Which output format should she choose?

AVirtual disk (VHDX) BRaw dd image (.001) CEnCase E01 format DISO 9660 disc image

Correct answer: C. EnCase E01 format
The E01 (Expert Witness) format stores case metadata in its header, adds CRC checks across data blocks, embeds an acquisition hash, and supports compression. A raw dd image is a plain bit-for-bit copy with no embedded metadata or compression, so case notes and hashes must be kept in separate files.

Question 14Digital Evidence⚑ Flag

An HR complaint alleges that an employee at Crestline Bank deleted spreadsheets before resigning. The IT team offers to copy the user's profile folder to a USB drive for the investigator. Why should the investigator insist on a bit-stream image instead?

AA logical copy would change the file names on the original BOnly a bit-stream image captures unallocated space and slack CA logical copy cannot preserve files larger than 4 GB DOnly a bit-stream image can be opened by forensic suites

Correct answer: B. Only a bit-stream image captures unallocated space and slack
A bit-stream image copies every sector, including unallocated clusters and slack where deleted spreadsheet data may remain. A logical copy brings over active files only, and the claim that forensic suites cannot open logical copies is false.

Question 15Procedures & Methodology⚑ Flag

Officers executing a search at a small office find a desktop computer that is switched off. A junior team member suggests turning it on to check whether it is the right machine. What is the MOST appropriate action?

ABoot it briefly in safe mode to confirm the user account names BPower it on and capture memory, since RAM may still hold recent data CTurn it on only long enough to photograph the desktop wallpaper DLeave it off, then document, label and package it for transport

Correct answer: D. Leave it off, then document, label and package it for transport
A powered-off system should stay off because booting it changes timestamps, logs and other data on the drive. Powering on to capture memory gains nothing, since RAM loses its contents when power is removed and booting writes new data.

Question 16Regulations & Ethics⚑ Flag

At Quillstone Bank, help desk staff type a ticket for each security incident as it is handled, as part of their normal duties. A prosecutor wants to use these tickets to show when a breach was first reported, and the defense raises a hearsay objection. What foundation BEST supports admitting the tickets?

ATestimony from the lead investigator that the tickets appear genuine and complete BA custodian showing the tickets were made at the time, in the regular course of business CProof that the tickets were stored on a password-protected server with daily backups DA statement from the bank's attorney that auditors routinely rely on the ticket records

Correct answer: B. A custodian showing the tickets were made at the time, in the regular course of business
The business records exception covers records made at or near the time by someone with knowledge, kept in the regular course of a regularly conducted activity, and shown by a custodian, other qualified witness or proper certification. Server security and backups help with authenticity but do not answer the hearsay objection.

Question 17Forensic Science⚑ Flag

Before reviewing a laptop image, an analyst at Corwin County Sheriff's Office is told the suspect already confessed. The analyst then focuses only on artifacts that support guilt. What practice would best reduce this risk in future cases?

ARunning a second automated parsing tool BIncreasing the hash algorithm strength CBlind verification by a second examiner DShortening the case review timeline

Correct answer: C. Blind verification by a second examiner
Exposure to case details invites confirmation bias, and blind verification by an examiner who lacks that context counters it. A second parsing tool checks tool output but does not address the analyst's biased selection of evidence.

Question 18Digital Forensics⚑ Flag

Investigators at Corvane Health only have NetFlow records from the core router for the week of a suspected leak. No full packet capture exists. Which conclusion can the NetFlow data support?

AHow much data a host sent to an outside IP and when BRoutine Windows Update downloads running in the background CThe text of commands typed by the attacker DThe username that was logged in at the time

Correct answer: A. How much data a host sent to an outside IP and when
NetFlow records metadata such as source, destination, ports, timestamps and byte counts, so it can show volume and timing of a transfer. It does not keep payload, so file names and typed commands require full packet capture or host evidence.

Question 19Digital Forensics⚑ Flag

During a breach review at Corvane Health, an analyst finds Security event 4624 entries for a domain admin account at 2:14 AM. The Logon Type field is 10, and the source network address is an external VPN pool IP. What does this logon type indicate?

AA scheduled task starting under a batch logon BA network logon to a shared folder over SMB CAn unlock of a workstation that was already logged in DA Remote Desktop session using RemoteInteractive logon

Correct answer: D. A Remote Desktop session using RemoteInteractive logon
Logon type 10 is RemoteInteractive, which is recorded for Remote Desktop sessions. Type 3 is a network logon such as SMB access, and type 7 is a workstation unlock, so neither fits a value of 10.

Question 20Digital Evidence⚑ Flag

Which statement BEST describes a sparse acquisition?

AIt collects selected files plus related deleted fragments BIt captures file system metadata without any file content CIt copies only active files visible to the operating system DIt copies every sector but compresses long runs of zeros

Correct answer: A. It collects selected files plus related deleted fragments
A sparse acquisition targets specific files of interest and also gathers fragments of deleted data tied to them. Copying only active files is a logical acquisition, which leaves out unallocated data entirely.

Question 21Procedures & Methodology⚑ Flag

A responder has finished capturing volatile data from a running Windows desktop in a theft investigation. There is no full disk encryption and no business need to keep the machine running. How should the responder power the system down?

AUnplug the power strip at the wall outlet behind the desk BUse the Start menu shutdown so all open files close cleanly CPull the power cord from the back of the computer case DHold the power button until the system reboots into the BIOS

Correct answer: C. Pull the power cord from the back of the computer case
Pulling the cord at the back of the case stops the system instantly and avoids shutdown routines that write to the disk and can trigger cleanup scripts. Unplugging at the wall may fail if a UPS sits between the outlet and the computer, and a normal shutdown alters data.

Question 22Tools & Programs⚑ Flag

While analyzing a Windows 10 memory image with Volatility 3, an investigator at Coastline Logistics wants to list TCP and UDP endpoints, including recently closed connections, along with the owning process. Which plugin should he run?

Awindows.malfind Bwindows.hivelist Cwindows.pslist Dwindows.netscan

Correct answer: D. windows.netscan
windows.netscan scans memory for network objects and reports local and remote addresses, ports, state and owning process, and it can find closed connections whose structures remain in memory. windows.pslist lists processes, not network endpoints.

Question 23Forensic Science⚑ Flag

A lab manager updates the evidence intake policy to require SHA-256 in place of MD5 for verifying forensic images. What is the main technical reason for this change?

ASHA-256 is faster to compute on all hardware BMD5 cannot hash images larger than 4 GB CMD5 output is too short to store in reports DPractical MD5 collisions now exist

Correct answer: D. Practical MD5 collisions now exist
Researchers have produced practical MD5 collisions, so two different inputs can share a hash, which weakens integrity claims. SHA-256 is generally slower than MD5, not faster, so speed is not the reason for the change.

Question 24Digital Forensics⚑ Flag

An investigator reviewing a file server at Pellston Manufacturing notices the Security log only begins at 11:52 PM on the night of the incident. The first record in the log is event ID 1102. What does this record tell the investigator?

AThe Security log reached its maximum size and wrapped BThe Security audit log was cleared by a user account CThe audit policy was changed by an administrator DThe event log service was shut down normally

Correct answer: B. The Security audit log was cleared by a user account
Event 1102 means the audit log was cleared, and it records the account that performed the clearing. Normal log wrapping does not create a 1102 record, so a log that starts with 1102 points to deliberate clearing.

Question 25Digital Forensics⚑ Flag

During live response on a workstation at Pinecrest Manufacturing, an investigator dumps the ARP cache. The default gateway IP and another internal host's IP both map to the same MAC address, which belongs to a desktop in the warehouse. What does this most strongly indicate?

AA normal result of DHCP address reuse BA misconfigured VLAN trunk on the switch CARP spoofing by the warehouse desktop DA DNS cache poisoning of the workstation

Correct answer: C. ARP spoofing by the warehouse desktop
When the gateway IP resolves to an ordinary desktop's MAC, that desktop is likely answering ARP requests falsely to intercept traffic. DNS poisoning affects name resolution, not IP-to-MAC mappings, and DHCP reuse would not make two live IPs share one MAC.

Question 26Digital Evidence⚑ Flag

Examiner Luis Ortega at a county crime lab receives a SATA hard drive removed from a powered-off desktop. He plans to image it on a Windows forensic workstation. What should he do BEFORE connecting the drive?

ARun a quick antivirus scan of the drive through a USB dock BConnect the drive and hash it before any files are opened CDisable automount in the registry and connect it directly DPlace a hardware write blocker between drive and workstation

Correct answer: D. Place a hardware write blocker between drive and workstation
A hardware write blocker physically intercepts write commands and does not depend on the workstation's operating system settings. Disabling automount reduces some writes, but it is a software control that can fail or be bypassed.

Question 27Regulations & Ethics⚑ Flag

Which statement BEST describes the purpose of Federal Rule of Evidence 902(14)?

AIt allows a judge to admit digital evidence without any showing that it is relevant to the case BIt requires every forensic examiner to testify in person before any digital copy is admitted CIt lets data copied from a device be self-authenticated by a certified hash verification DIt excludes any digital copy that was made without a court order authorizing the acquisition

Correct answer: C. It lets data copied from a device be self-authenticated by a certified hash verification
Rule 902(14) allows data copied from an electronic device, storage medium or file to be self-authenticated through a certification by a qualified person, typically showing that hash values match. Its purpose is to avoid calling a witness only to authenticate the copy, so in-person testimony is not required for that purpose.

Question 28Procedures & Methodology⚑ Flag

A first responder arrives at a workstation where a suspected insider was working. The monitor shows an open email client and several USB devices are attached. What should the responder do before touching anything?

ADisconnect the USB devices so no more data can be copied BPhotograph the screen, connections and surrounding work area CClose the email client to stop new messages from syncing DUnplug the network cable to prevent remote wiping of the system

Correct answer: B. Photograph the screen, connections and surrounding work area
Documenting the scene by photograph comes before any physical interaction, so the original state can be shown later. Network isolation can be a valid later step, but changing the setup before it is recorded leaves no proof of how the scene looked.

Question 29Digital Forensics⚑ Flag

A malware analyst at Tessaro Bank opens a suspicious executable in a PE viewer. Two sections show entropy close to 8, the import table lists only LoadLibraryA and GetProcAddress, and almost no readable strings appear. What is the best conclusion?

AThe file was corrupted during acquisition BThe file is a signed Microsoft system driver CThe binary is likely packed or encrypted DThe sample is a plain-text script file

Correct answer: C. The binary is likely packed or encrypted
Near-maximum entropy, a tiny import table and few strings are typical of packed or encrypted code that unpacks itself at runtime. Corruption would not usually produce a valid PE with a minimal but coherent import list.

Question 30Forensic Science⚑ Flag

An examiner faces 900,000 files on a seized server and wants to quickly remove standard operating system and application files from review. Which resource is designed for this purpose?

AThe NIST NSRL Reference Data Set BA Volume Shadow Copy snapshot list CThe Windows prefetch file index DA list of known malware hash values

Correct answer: A. The NIST NSRL Reference Data Set
The NSRL Reference Data Set contains hashes of known software files, letting examiners filter them out and focus on user content. A malware hash list flags known bad files but does not remove the large volume of ordinary system files.

Question 31Digital Evidence⚑ Flag

An examiner at Calloway Freight receives a laptop that was shut down normally before seizure, so no RAM capture exists. Hibernation was disabled on the system. Which file on the system drive is MOST likely to hold fragments of memory such as chat text or decrypted data?

AC:\Windows\System32\config\SAM BC:\pagefile.sys CC:\hiberfil.sys DC:\$Extend\$ObjId

Correct answer: B. C:\pagefile.sys
Windows moves memory pages out to pagefile.sys when RAM runs short, and the file usually persists after a normal shutdown unless it is set to be cleared. Because hibernation was disabled, hiberfil.sys would not hold a memory snapshot from this system.

Question 32Digital Forensics⚑ Flag

A suspect at Oakridge Credit Union deleted a password dumping tool named DUMPR.EXE from his workstation. The investigator needs evidence that the tool actually ran, how many times, and when it last ran. Which artifact BEST answers all three points?

AThe DUMPR.EXE-XXXXXXXX.pf file in C:\Windows\Prefetch BThe $I file for DUMPR.EXE in the Recycle Bin CA Zone.Identifier stream attached to the download DThe thumbcache database in the user's profile

Correct answer: A. The DUMPR.EXE-XXXXXXXX.pf file in C:\Windows\Prefetch
Prefetch files record the executable name, a run count and recent run times (up to eight on Windows 8 and later), even after the program is deleted. A $I file only shows the deletion time and original path, which proves deletion but not execution.

Question 33Procedures & Methodology⚑ Flag

Which set of details is MOST essential in each chain of custody entry when evidence changes hands?

AThe case theory, suspect name and the expected trial date BThe make and model of the forensic workstation used to examine it CNames and signatures of both parties, date, time and reason for transfer DThe file system type, partition layout and number of user accounts on the drive

Correct answer: C. Names and signatures of both parties, date, time and reason for transfer
Each custody entry must show who released and who received the item, when it happened and why, so every moment of possession is accounted for. Technical details like the file system describe the evidence itself, not its custody.

Question 34Tools & Programs⚑ Flag

A responder at Pinegate Hosting must capture the RAM of a running Ubuntu web server before it is shut down. The capture tool needs to work as a loadable kernel module and write the memory to disk or over the network. Which tool is the BEST choice?

AMagnet RAM Capture BVolatility CDumpIt DLiME

Correct answer: D. LiME
LiME (Linux Memory Extractor) is a loadable kernel module that acquires volatile memory from Linux and Android systems and can save it locally or send it over a TCP port. DumpIt and Magnet RAM Capture are Windows acquisition tools, and Volatility analyzes memory images rather than capturing them.

Question 35Regulations & Ethics⚑ Flag

A defense expert challenges examiner Lee Park's method for attributing deleted chat fragments to a specific user in a federal case. The judge holds a Daubert hearing to decide whether the method is reliable. Which consideration is part of that analysis?

AHow many prior cases the examiner has testified in as an expert BWhether the examiner's own employer has used the method before CWhether the examiner's tool is sold commercially by a major vendor DThe known or potential error rate of the technique being used

Correct answer: D. The known or potential error rate of the technique being used
Daubert factors include whether the technique can be and has been tested, peer review and publication, the known or potential error rate, the existence of standards, and general acceptance. Commercial availability of a tool may feel reassuring, but it is not a reliability factor on its own.

Question 36Digital Evidence⚑ Flag

A responder creates a raw dd image of a USB drive for a partner agency that uses a different forensic suite. What is the MAIN drawback of choosing the raw format?

AIt holds no internal case metadata or hash BIt skips unallocated clusters unless told otherwise CIt forces the image into 2 GB segment files DFew suites other than the source tool can read it

Correct answer: A. It holds no internal case metadata or hash
Raw images contain only sector data, so hashes, notes and case details must travel in separate files. Broad compatibility is actually the main strength of the raw format, not a weakness.

Question 37Digital Forensics⚑ Flag

An investigator at Northgate Insurance suspects an attacker ran obfuscated PowerShell commands on a file server. Script block logging was enabled by group policy. Which log entry should she review to see the deobfuscated script content?

ASystem log, Event ID 7045 BPowerShell Operational log, Event ID 4104 CApplication log, Event ID 1000 DSecurity log, Event ID 4624 for logons

Correct answer: B. PowerShell Operational log, Event ID 4104
Event ID 4104 in the Microsoft-Windows-PowerShell/Operational log records script blocks, including code after deobfuscation. Event 4624 records logons and 7045 records new services, so neither shows the script text.

Question 38Procedures & Methodology⚑ Flag

During case review, an examiner at Pinecrest Analytics realizes a seized drive sat on her desk overnight and the handoff to her was never logged. The drive's hash still matches the acquisition hash. What should she do?

AIgnore the gap since the matching hash value proves nothing was altered BRe-acquire the drive so a fresh custody record can be started CAdd a back-dated entry so the custody form shows no gap DDocument the gap in a signed memo and disclose it in the report

Correct answer: D. Document the gap in a signed memo and disclose it in the report
Gaps must be documented honestly and disclosed, which lets the court weigh them alongside the matching hash. Back-dating creates a false record that could destroy the examiner's credibility and the evidence's admissibility.

Question 39Forensic Science⚑ Flag

Investigators at Meridian Health seize a powered-off corporate laptop protected by BitLocker. The employee refuses to cooperate. What is the most practical lawful next step to access the volume?

ABrute force the 48-digit recovery key BImage the drive and search for the key in slack CGet the recovery key from Active Directory DBoot the laptop from a live USB to bypass BitLocker

Correct answer: C. Get the recovery key from Active Directory
Domain-joined machines often escrow BitLocker recovery keys in Active Directory, giving authorized investigators a lawful path in. Brute forcing a 48-digit recovery key is not feasible, and booting from live media does not decrypt the volume.

Question 40Digital Forensics⚑ Flag

An examiner at Tamsin Legal finds a file named $IK3P9QZ.docx in C:\$Recycle.Bin\S-1-5-21-...-1107. A matching $RK3P9QZ.docx sits in the same folder. What information will the $I file provide?

AThe full document content as it was before deletion BThe original path, file size and deletion timestamp CThe name of the program that last opened the file DThe list of users who had read access to the file

Correct answer: B. The original path, file size and deletion timestamp
The $I file is a small metadata record that stores the original file path, its size and the time it was deleted. The $R file holds the actual content, so the content itself is not in the $I file.

Question 41Digital Evidence⚑ Flag

Examiner Priya Nair hashes a healthy suspect drive through a write blocker, images it, and finds that the image's SHA-256 value does not match the source value. The drive shows no read errors. What should she do NEXT?

AAnalyze the original drive directly since the image failed BProceed with analysis and note the mismatch in the report CTreat the image as unverified, check the setup and re-acquire DRehash the image with MD5, since SHA-256 often misreports

Correct answer: C. Treat the image as unverified, check the setup and re-acquire
A mismatch on a healthy drive means the image cannot be shown to be an exact copy, so she must find the cause, such as a faulty blocker or cable, and acquire again. Analyzing the original directly would risk altering the best evidence.

Question 42Tools & Programs⚑ Flag

An analyst at Brightwater Bank needs to prove that a program named sync_helper.exe ran on a Windows 10 workstation, and she wants its run count and last run times. She has exported the C:\Windows\Prefetch folder. Which Eric Zimmerman tool should she use to parse it?

APECmd BMFTECmd CRECmd DLECmd

Correct answer: A. PECmd
PECmd parses Windows prefetch (.pf) files and reports the executable name, run count, last run times and files referenced during loading. LECmd parses LNK shortcut files, which can show a file was opened but do not record execution counts the way prefetch does.

Question 43Procedures & Methodology⚑ Flag

A technician at Ridgeway Labs is packaging three seized hard drives for storage in the evidence room. What packaging is MOST appropriate?

AStandard zip-lock plastic bags labeled with the case number BAnti-static bags labeled with case and item numbers CPadded paper envelopes taped shut and stored in a filing cabinet DBubble wrap secured with packing tape inside a cardboard box

Correct answer: B. Anti-static bags labeled with case and item numbers
Anti-static bags protect drive electronics from static discharge, and clear labels tie each item to its case record. Ordinary plastic bags and bubble wrap can build up static charge that may damage the drive.

Question 44Forensic Science⚑ Flag

An analyst builds a timeline from a Windows laptop's NTFS system drive and a FAT32 thumb drive. The thumb drive's times appear several hours off from related NTFS events. What is the most likely explanation?

AFAT32 uses local time while NTFS uses UTC BFAT32 records timestamps only in whole minutes CNTFS converts every timestamp to the BIOS time zone DThe thumb drive was wiped and its times were reset

Correct answer: A. FAT32 uses local time while NTFS uses UTC
FAT file systems store timestamps in local time, while NTFS stores them in UTC, so tools must apply the correct offset to each. FAT32 write times have 2-second resolution, not minute resolution, so that does not explain a several-hour shift.

Question 45Digital Forensics⚑ Flag

At Crestline Engineering, an investigator suspects a user downloaded a malicious invoice.xlsm from a webmail site rather than receiving it from a USB stick. The file sits on an NTFS volume. Which artifact attached to the file can BEST support the download theory?

AThe $FILE_NAME attribute in the file's MFT entry BThe $LogFile entries covering the file's creation CThe Zone.Identifier alternate data stream with ZoneId=3 DThe $Secure:$SDS security descriptor for the file

Correct answer: C. The Zone.Identifier alternate data stream with ZoneId=3
Browsers and mail clients add a Zone.Identifier alternate data stream to downloaded files, and ZoneId=3 marks the Internet zone, often with HostUrl or ReferrerUrl fields. The $FILE_NAME attribute holds names and timestamps but says nothing about where the file came from.

Question 46Digital Forensics⚑ Flag

Forensic analysts at Elmstead College find no malicious files on disk, yet a host keeps launching an encoded PowerShell command shortly after each boot. No new services, Run keys or scheduled tasks were found. Which artifact should they examine next?

AThe pagefile for leftover clipboard data BWMI event filter and consumer bindings CThe NTFS $LogFile for recent renames DThe browser cache of the logged-on user

Correct answer: B. WMI event filter and consumer bindings
Fileless persistence often uses a WMI event subscription, where a filter, a consumer and a binding stored in the WMI repository launch a command on a trigger such as startup. The $LogFile and browser cache would not explain a recurring launch with no visible autostart entry.

Question 47Regulations & Ethics⚑ Flag

Marisol, an investigator at privately owned Tenbury Software, is told by HR to image a company-issued laptop used by an engineer suspected of leaking source code. The engineer's lawyer claims the imaging violated the Fourth Amendment because no warrant was obtained. Which response is MOST accurate?

AThe claim is valid unless the engineer was present and watched the imaging happen BThe Fourth Amendment applies, but the company can cure it by notifying police afterward CThe claim is valid, because any search of an employee's work area requires a warrant DThe Fourth Amendment limits government actors, not a private employer acting alone

Correct answer: D. The Fourth Amendment limits government actors, not a private employer acting alone
The Fourth Amendment restricts searches by the government and its agents, so a private company examining its own equipment for its own purposes is not bound by the warrant requirement. Company policy and other laws still matter, but the lack of a warrant is not the problem the lawyer claims.

Question 48Digital Evidence⚑ Flag

While imaging a suspect's aging laptop drive with dd, the process stops at a read error about 40 percent of the way through the disk. What is the MOST appropriate way to continue?

ASkip and zero-fill bad sectors, logging each one BRestart dd from the start until it finishes cleanly CSwitch to a logical copy of the readable partitions DRun chkdsk on the drive to repair bad sectors first

Correct answer: A. Skip and zero-fill bad sectors, logging each one
Options such as noerror and sync in dd, or tools like dc3dd and ddrescue, keep imaging past bad sectors, pad them with zeros to keep offsets aligned and record what was lost. Running chkdsk writes to the evidence drive and can destroy data.

Question 49Procedures & Methodology⚑ Flag

An analyst receives a verified forensic image and the original drive in a harassment case. She needs to run keyword searches and carve deleted files. Which approach is MOST appropriate?

ARun the searches on the original drive behind a write blocker BWork on a verified copy of the image and keep the original sealed CMount the original drive read-only on her workstation and search it DSearch the master image directly since it was already hash verified

Correct answer: B. Work on a verified copy of the image and keep the original sealed
Analysis should be done on a verified working copy so the original and the master image stay untouched. Even with a write blocker, repeated handling of the original adds risk and wear with no investigative benefit.

Question 50Tools & Programs⚑ Flag

A detective at Fairmont Police receives 300 JPEG photos seized from a suspect's phone. He needs to check whether the images contain GPS coordinates, camera model and original capture dates. Which tool is BEST suited for reading this embedded information?

APhotoRec BHxD Chashdeep DExifTool

Correct answer: D. ExifTool
ExifTool reads metadata embedded in image files, including EXIF GPS coordinates, camera make and model, and capture timestamps, and it can process large batches. PhotoRec recovers deleted files from storage, but it is not a metadata reader.

Question 51Forensic Science⚑ Flag

On an NTFS volume, a document shows a creation time of March 14 and a last modified time of February 2 of the same year. No timestomping tools are found. What is the most likely benign explanation?

AThe file was renamed by the user on March 14 BThe file was moved within the same volume CThe file was opened and printed on March 14 DThe file was copied here on March 14

Correct answer: D. The file was copied here on March 14
When a file is copied on NTFS, the new copy gets a fresh creation time but keeps the source's modified time, so creation can postdate modification. A move within the same volume generally keeps the original creation time, so it would not produce this pattern.

Question 52Digital Forensics⚑ Flag

An analyst at Rivermark Energy needs to learn which domains a new malware sample contacts and which files it drops. The sample must not touch production systems. What is the most appropriate approach?

ADetonate it in an isolated, monitored sandbox BRun it on a spare production server overnight CUpload it to a public file sharing website DRename the file extension and open it in a viewer

Correct answer: A. Detonate it in an isolated, monitored sandbox
Dynamic analysis in an isolated sandbox lets the analyst observe network calls, file writes and registry changes safely. Running it on any production server risks spreading the infection, and renaming the file reveals nothing about runtime behavior.

Question 53Digital Forensics⚑ Flag

An analyst at Delmar Freight parses the MFT entry of a suspicious DLL. The $STANDARD_INFORMATION created time shows 2019, but the $FILE_NAME created time shows last Tuesday. The $STANDARD_INFORMATION timestamps also have all zeros in their sub-second values. What is the MOST likely conclusion?

AThe volume clock was set back during installation BThe DLL was copied from a FAT32 thumb drive CThe $STANDARD_INFORMATION times were timestomped DThe file was restored from a 2019 backup copy

Correct answer: C. The $STANDARD_INFORMATION times were timestomped
User-mode tools can easily change $STANDARD_INFORMATION timestamps, while $FILE_NAME times are normally updated only by the kernel. A $SI creation time far earlier than the $FN creation time, together with zeroed sub-second values, is a classic timestomping indicator.

Question 54Digital Evidence⚑ Flag

Investigators at Northgate Health must image a running file server across the corporate network to a forensic collection server in another building. Which practice BEST protects the integrity and confidentiality of the image in transit?

ASend the stream over an encrypted channel and hash both ends BUse plain netcat on a nonstandard port to avoid detection CCompress the stream so it spends less time on the network DCopy the server's shares to the collection server with robocopy

Correct answer: A. Send the stream over an encrypted channel and hash both ends
An encrypted channel such as cryptcat or an SSH tunnel keeps patient data private, and comparing hashes at the source and destination proves the stream arrived intact. A nonstandard port hides nothing from a sniffer and does not verify integrity.

Question 55Procedures & Methodology⚑ Flag

Two months after an examination, an examiner at Cobalt Insurance is asked how he located a key spreadsheet. He did not record the steps at the time and now relies on memory. Which practice would have BEST prevented this problem?

ASaving tool output reports to the case folder after the work BKeeping dated, timestamped notes of each step as it was done CWriting a detailed summary of the analysis once the case closed DRecording a screen video of the full examination for review

Correct answer: B. Keeping dated, timestamped notes of each step as it was done
Contemporaneous notes, written as each action occurs, are the most reliable record and are given weight in court. A summary written after the fact depends on memory and is easier to challenge.

Question 56Regulations & Ethics⚑ Flag

A detective at a county cyber unit is searching a seized laptop under a warrant limited to evidence of tax fraud. While opening spreadsheet folders, she sees an image that appears to be child sexual abuse material. What is the MOST appropriate next step?

AContinue searching the whole drive for similar images, since plain view now covers them BPause, document the find, and seek a new warrant before looking for more of it CDelete the image to protect the victims, then finish the tax fraud search as authorized DIgnore the image entirely, because it falls outside the crimes listed in the warrant

Correct answer: B. Pause, document the find, and seek a new warrant before looking for more of it
An item seen in plain view during a lawful search can be noted and seized, but actively hunting for more evidence of a different crime goes beyond the warrant. Getting a second warrant protects admissibility, while continuing under the original warrant risks suppression of everything found beyond its scope.

Question 57Forensic Science⚑ Flag

An investigator wants a single chronological view that merges file system times, registry key times, event logs and browser history from one image. What is this combined view called?

AA process memory map BA known-file hash set CA super-timeline DA file carve

Correct answer: C. A super-timeline
A super-timeline, often built with tools such as log2timeline and Plaso, merges many artifact sources into one ordered view. A hash set is a list of known file hashes and does not order events in time.

Question 58Digital Forensics⚑ Flag

An examiner at Quill Analytics recovers the full text of a 400-byte ransom note directly from a deleted $MFT record, even though no clusters on the volume contain it. Why was this possible?

AWindows keeps deleted file data inside $LogFile BThe small file was resident inside its MFT record CThe note was cached in the $Bitmap metadata file DThe text was stored in the $UsnJrnl change records

Correct answer: B. The small file was resident inside its MFT record
Very small files, usually under about 700 bytes, are stored as resident data inside the MFT record itself, so their content can survive in the record after deletion. $Bitmap only tracks which clusters are allocated and never holds file content.

Question 59Digital Forensics⚑ Flag

Reviewing an Apache access log for Lakeview Retail, an investigator finds a run of requests to /product.php with URL-encoded UNION SELECT strings in the id parameter. Most return status 500, but a few return 200. Which log field best helps judge whether data was actually returned?

AThe client source port of each request BThe request method used CThe HTTP protocol version DThe response size in bytes

Correct answer: D. The response size in bytes
A 200 response that is much larger than the normal page size suggests the injected query returned extra rows. The protocol version and source port say nothing about the content sent back to the client.

Question 60Digital Evidence⚑ Flag

Detectives at Granger County seize a locked iPhone that is powered on and already isolated from all networks. The owner unlocked it with his passcode earlier that day. Why should the examiner avoid letting the phone restart or power off before extraction?

AA restart puts most user data back behind passcode encryption BA restart deletes every photo stored in the phone's camera roll CA restart wipes the SIM card's stored subscriber identifiers DA restart permanently disables the phone's Lightning data port

Correct answer: A. A restart puts most user data back behind passcode encryption
After the first unlock since boot, iOS keeps many data protection keys available, so an extraction can reach much more user data. A restart returns the phone to the before-first-unlock state, where most user files stay encrypted until the passcode is entered. A restart does not erase SIM identifiers or delete photos.

Question 61Procedures & Methodology⚑ Flag

An examiner is drafting a report for an internal theft case. She found that a file was copied to a USB drive at 2:14 AM. A manager tells her the employee probably did it to sell the data to a rival. How should she handle the motive in her report?

AMention the motive as background and cite the manager by name BPresent the motive as a finding since it fits the evidence CReport the copy as fact and leave the unsupported motive out DInclude the motive in the summary as the likely explanation

Correct answer: C. Report the copy as fact and leave the unsupported motive out
Reports should present facts the evidence supports and keep unsupported speculation out, especially about motive the data cannot show. Labeling a manager's theory as a finding blurs fact and opinion and invites attack in court.

Question 62Tools & Programs⚑ Flag

An examiner at Granite Federal Credit Union has a 1 TB disk image and needs a fast pass that pulls out every email address, URL and credit card number, even from unallocated space and compressed fragments. The tool should ignore the file system and scan raw bytes using multiple threads. Which tool fits BEST?

Abulk_extractor BRegistry Explorer Cscalpel DMagnet AXIOM

Correct answer: A. bulk_extractor
bulk_extractor scans raw disk data without parsing the file system and writes features such as email addresses, URLs and credit card numbers to feature files, using multiple threads. scalpel also ignores the file system, but it carves whole files by header and footer rather than reporting these features.

Question 63Digital Evidence⚑ Flag

A volume uses 4,096-byte clusters. A file of exactly 9,000 bytes is saved to it. How many clusters are allocated, and how much total file slack exists?

A3 clusters with 1,240 bytes of slack B18 clusters with 216 bytes of slack C2 clusters with 808 bytes of slack D3 clusters with 3,288 bytes of slack

Correct answer: D. 3 clusters with 3,288 bytes of slack
Two clusters hold only 8,192 bytes, so a third is needed, giving 12,288 bytes allocated and 3,288 bytes of slack. The figure of 216 bytes comes from counting 512-byte sectors instead of clusters.

Question 64Regulations & Ethics⚑ Flag

Kestrel Freight's network shows a logon banner stating that systems are monitored, users have no expectation of privacy, and activity may be disclosed to law enforcement. An employee later argues that reviewing his work email was an invasion of privacy. What is the MAIN effect of the banner in this situation?

AIt weakens any expectation of privacy and supports consent to monitoring BIt makes all monitoring lawful in every country where the company has staff CIt gives the company full rights to search the employee's personal phone and home computer DIt replaces the need for any written acceptable use policy in the employee handbook

Correct answer: A. It weakens any expectation of privacy and supports consent to monitoring
A clear logon banner gives notice that work systems are monitored, which undercuts a reasonable expectation of privacy and supports implied consent. It does not reach personal devices the company does not control, and it does not override stricter laws in other jurisdictions.

Question 65Digital Forensics⚑ Flag

An investigator needs the default web server logs from a Windows Server running IIS 10 that hosts a single site. Where should she look first?

AC:\ProgramData\Microsoft\Network\Logs BC:\Users\Default\AppData\Local\Temp CC:\inetpub\logs\LogFiles\W3SVC1 DC:\Windows\System32\winevt\Logs

Correct answer: C. C:\inetpub\logs\LogFiles\W3SVC1
By default IIS writes W3C access logs under %SystemDrive%\inetpub\logs\LogFiles in a W3SVC folder named by site ID, so the first site uses W3SVC1. The winevt folder holds Windows event logs, which do not contain per-request web access entries.

Question 66Digital Forensics⚑ Flag

A Westbrook University investigator needs to show that a folder of research files was renamed and then deleted on an NTFS volume three days ago. The files are no longer present. Which NTFS artifact records these change events with reason codes such as RENAME_NEW_NAME and FILE_DELETE?

AThe $Boot file at the start of the volume BThe $AttrDef attribute definition table CThe $MFTMirr backup of the first MFT records DThe $UsnJrnl:$J change journal stream

Correct answer: D. The $UsnJrnl:$J change journal stream
The USN change journal in $UsnJrnl:$J logs file system changes with reason flags, including renames and deletions, often for days or weeks. $MFTMirr is only a backup of the first few MFT records and does not track changes over time.

Question 67Forensic Science⚑ Flag

An examiner at Brookline Mutual suspects an employee set his workstation clock back to make a set of edited spreadsheets look older. Auditing of system events was enabled. Which Security log event would MOST directly record that the clock was changed?

AEvent ID 4624, an account logged on successfully BEvent ID 4634, an account was logged off CEvent ID 4688, a new process was created DEvent ID 4616, the system time was changed

Correct answer: D. Event ID 4616, the system time was changed
Event 4616 records the previous and new system time along with the account and process that made the change, which directly supports a backdating theory. Event 4688 might show a time-setting program running, but it does not record the old and new time values.

Question 68Procedures & Methodology⚑ Flag

What is the key difference between a fact witness and an expert witness in a digital forensics case?

AA fact witness may testify only at deposition, while an expert testifies at trial BA fact witness testifies to what they saw or did, while an expert may offer opinions CA fact witness must hold a certification, while an expert needs only work experience DA fact witness is paid by the court, while an expert is paid by one of the parties

Correct answer: B. A fact witness testifies to what they saw or did, while an expert may offer opinions
A fact witness describes what they personally observed or did, such as how they collected a drive. An expert witness is qualified by knowledge, skill or experience to give opinions that help the court understand technical evidence.

Question 69Digital Evidence⚑ Flag

Examiner Grace Lin reviews a 1 TB drive image. The partition table lists one NTFS partition that ends roughly 20 GB before the last sector, and no HPA or DCO is present. What is the MOST appropriate next step?

AReport that the suspect tampered with the drive BIgnore the gap, since it is normal unused space CExamine the unpartitioned area for hidden volumes DResize the partition in the image to reclaim space

Correct answer: C. Examine the unpartitioned area for hidden volumes
Space outside any listed partition can hold a deleted partition or deliberately hidden data, so it must be searched. Calling it tampering is premature, because a gap alone does not prove intent.

Question 70Tools & Programs⚑ Flag

A network analyst at Silverline Health has a large PCAP from a suspected data theft. She wants a passive tool that sorts the traffic by host and automatically pulls out transferred files, images and cleartext credentials into easy-to-browse tabs. Which tool is BEST suited for this?

Atcpdump BNetworkMiner CTCPView DZeek

Correct answer: B. NetworkMiner
NetworkMiner parses PCAP files and presents hosts, transferred files, images and credentials in a host-centric graphical view. Zeek produces detailed protocol logs and can extract files, but it is a command-line monitoring framework rather than a point-and-click artifact browser.

Question 71Digital Forensics⚑ Flag

An investigator at Saltmarsh Media reviews web logs from the night before a defacement. In ten minutes, one IP sent thousands of requests for paths such as /admin.bak and /cgi-bin/test, and every request carried a user agent string naming Nikto. What is the best interpretation?

AA search engine crawler indexing every page of the site BA user with a broken browser extension CAn automated vulnerability scan of the server DA content delivery network health check

Correct answer: C. An automated vulnerability scan of the server
High-volume probing for known risky paths with a scanner's user agent points to automated vulnerability scanning, often reconnaissance before an attack. Search crawlers follow links rather than guessing backup and CGI paths, and they identify as crawlers, not scanners.

Question 72Forensic Science⚑ Flag

A user claims he never deleted any project files. The examiner finds a prefetch file for SDELETE.EXE showing three runs, the last one the night before his resignation. What does this artifact indicate?

AThe prefetch data was planted by the examiner BThe wiping utility was executed on that system CThe files were encrypted before the resignation DThe utility was only downloaded, never launched

Correct answer: B. The wiping utility was executed on that system
Windows creates prefetch files when a program runs, and they record run counts and recent run times, so this shows SDelete was executed. A file that was only downloaded and never launched would not generate a prefetch entry.

Question 73Digital Forensics⚑ Flag

An investigator examining an Ubuntu web server at Sorrel Media wants to review failed SSH password attempts and sudo usage from the past week. Which log file is the BEST place to look?

A/var/log/dpkg.log B/var/log/wtmp C/var/log/auth.log D/var/log/boot.log

Correct answer: C. /var/log/auth.log
On Debian and Ubuntu systems, /var/log/auth.log records authentication events, including SSH logins, failures and sudo commands. The wtmp file records successful logins and logouts in binary form but does not log sudo activity or most failed attempts.

Question 74Procedures & Methodology⚑ Flag

A national police agency is writing its first procedures for how officers identify, collect, acquire and preserve digital evidence at scenes. Which international standard gives guidelines for exactly these activities?

AISO/IEC 27037 BISO/IEC 17025 CISO/IEC 27001 DISO/IEC 27035

Correct answer: A. ISO/IEC 27037
ISO/IEC 27037 provides guidelines for the identification, collection, acquisition and preservation of digital evidence. ISO/IEC 17025 covers the competence of testing and calibration labs, not how evidence is handled at a scene.

Question 75Regulations & Ethics⚑ Flag

A corporate investigator at Ardent Retail asks a public webmail provider to hand over the contents of a former employee's personal email account. The provider refuses. Under the Stored Communications Act, why is the refusal MOST likely correct?

AOnly messages older than 180 days can be released, and these messages are newer than that BThe provider can release contents only after the account has been closed for a full year CThe provider must first receive a written demand on letterhead signed by a corporate officer DPublic providers generally may not give message contents to private parties without consent

Correct answer: D. Public providers generally may not give message contents to private parties without consent
The Stored Communications Act generally bars providers of public email services from voluntarily disclosing message contents, with exceptions such as user consent. The 180-day distinction relates to the legal process the government must use, not to disclosure to a private company. The usual path is to get the content from the user through consent or civil discovery.

Question 76Digital Evidence⚑ Flag

Investigators image a Windows 11 laptop SSD two days after the user emptied the Recycle Bin. Carving the unallocated space returns almost nothing, and most of it reads as zeros. Which conclusion is BEST supported?

ATRIM let the drive erase the freed blocks after deletion BThe user ran a secure wiping program on the free space CThe SSD hides deleted data behind a host protected area DThe imaging tool failed to copy unallocated sectors

Correct answer: A. TRIM let the drive erase the freed blocks after deletion
With TRIM, the operating system tells the SSD which blocks are free, and the controller erases them, so deleted data often reads back as zeros. A wiping tool could cause this too, but zeroed free space on a modern SSD is normal and is not proof of wiping.

Question 77Procedures & Methodology⚑ Flag

During cross-examination, defense counsel asks an examiner whether a file's timestamps could have changed when the file was moved between volumes. She knows timestamps can change during some copy and move operations. What is the BEST response?

ASay she cannot recall and ask to review her notes before answering BDeny the possibility firmly so the jury does not doubt her work CAdmit it can happen and explain how she checked for it in this case DRefuse to answer since the question is outside the scope of her report

Correct answer: C. Admit it can happen and explain how she checked for it in this case
An expert should concede valid points honestly and explain the steps taken to address them, which protects credibility. Denying a known technical fact can be exposed by opposing experts and damage all of her testimony.

Question 78Forensic Science⚑ Flag

A suspect's vacation photo has the same dimensions and visual content as a copy found on a public website, but it is 40 percent larger and has a different hash. What should the examiner suspect first?

AThe suspect's camera used a higher color depth BThe hash tool produced an unreliable result CThe public copy was recompressed by the website DThe suspect's copy may hide embedded data

Correct answer: D. The suspect's copy may hide embedded data
An image identical in appearance to a known original but much larger, with a different hash, is a classic indicator of hidden embedded data. Website recompression could explain a hash difference, but it would not make the suspect's version of the same image so much larger.

Question 79Digital Forensics⚑ Flag

Police seize a running laptop in a narcotics case. Tor Browser is open on the screen with several tabs. The investigator knows Tor Browser does not save browsing history to disk by default. What should she do first to preserve evidence of the sites visited?

APull the power cord to stop any wiping BImage the hard drive and then check places.sqlite CClose the browser so its cache is flushed DCapture a full memory image of the laptop

Correct answer: D. Capture a full memory image of the laptop
Because Tor Browser keeps history in memory and discards it on exit, a RAM capture of the live system is the best chance to recover visited .onion addresses and page content. Pulling power or closing the browser destroys that volatile data, and places.sqlite will not hold the history.

Question 80Digital Forensics⚑ Flag

While reviewing /etc/passwd from a compromised Linux host at Gantry Systems, an investigator finds an entry named "sysupdate" with UID 0 and GID 0. No such account is part of the standard build. What is the MOST significant implication?

AThe account is a service account with no shell BThe account has full root-level privileges CThe account is locked until a password is assigned DThe account can only run system cron jobs

Correct answer: B. The account has full root-level privileges
On Linux, privilege is tied to the numeric UID, so any account with UID 0 has the same power as root no matter what it is named. An unexpected UID 0 account is a strong persistence indicator, and its password hash would be checked in /etc/shadow.

Question 81Tools & Programs⚑ Flag

An investigator reviewing output from a corporate Zeek sensor wants one record per network session showing source and destination IP, ports, duration and bytes sent each way. Which Zeek log should she open first?

Anotice.log Bconn.log Cdns.log Dhttp.log

Correct answer: B. conn.log
Zeek's conn.log records one entry per connection with endpoints, ports, protocol, duration, byte counts and connection state. dns.log and http.log cover only their own protocols, and notice.log holds alerts raised by Zeek scripts.

Question 82Digital Evidence⚑ Flag

A lab images a seized SSD twice through the same hardware write blocker, an hour apart. The two image hashes differ, though no one wrote to the drive. What is the MOST likely explanation?

AOne of the images was saved in a compressed format BThe SSD has an HPA that alternates between reads CThe write blocker allowed the host to write metadata DInternal garbage collection changed what the drive returned

Correct answer: D. Internal garbage collection changed what the drive returned
SSD controllers run garbage collection on their own whenever powered, so blocks pending erasure can change even when no host writes reach the drive. A failed blocker is possible and should be tested, but it does not explain change without any host writes as well.

Question 83Procedures & Methodology⚑ Flag

While examining a workstation image for a policy violation at a manufacturing firm, an examiner comes across files that appear to be child sexual abuse material. What should the examiner do NEXT?

AFinish the policy review first and then mention the files in the final report BDelete the files from the working copy and continue with the original task CStop, secure the evidence and report it to law enforcement via counsel DCopy the files to a separate drive so they are preserved for the HR team

Correct answer: C. Stop, secure the evidence and report it to law enforcement via counsel
Possessing or distributing such material is a crime, so the examiner should halt, preserve what exists and involve law enforcement, usually through legal counsel. Making extra copies, even for preservation, can itself be illegal and spreads contraband.

Question 84Regulations & Ethics⚑ Flag

An investigator for a US company needs to send forensic images of laptops used by staff in its French office to the US lab for analysis. The images contain personal data of EU employees. What should happen BEFORE the transfer?

AEncrypt the images, because strong encryption by itself satisfies all transfer rules BConfirm a lawful transfer mechanism, such as standard contractual clauses, is in place CNothing more is needed, because data on company-owned laptops falls outside the GDPR DGet an order from a US court, since a US order overrides any EU limits on data transfers

Correct answer: B. Confirm a lawful transfer mechanism, such as standard contractual clauses, is in place
The GDPR restricts transfers of personal data outside the EU unless there is an adequacy decision, appropriate safeguards such as standard contractual clauses, or a valid derogation. Encryption is a good security measure, but it does not by itself create a legal basis for the transfer.

Question 85Forensic Science⚑ Flag

A responder at Halden Aerospace reviews domain controller logs and finds one user account requesting Kerberos service tickets for 60 different service accounts within two minutes. Each Event ID 4769 shows ticket encryption type 0x17. What activity does this pattern MOST likely indicate?

APass-the-hash logons using stolen NTLM hashes BA golden ticket forged with a stolen krbtgt hash CKerberoasting to crack service account passwords DPassword spraying against many user accounts

Correct answer: C. Kerberoasting to crack service account passwords
Kerberoasting requests service tickets for many accounts with service principal names, often asking for RC4 encryption (type 0x17), so the tickets can be cracked offline. A golden ticket uses a forged ticket-granting ticket and would not need a burst of service ticket requests from one account.

Question 86Digital Forensics⚑ Flag

In a ransomware case, investigators have the bitcoin address that received the victim's payment. They want to identify a real person behind the funds. What is the most effective next step?

ATrace the funds on the public ledger to an exchange, then request its KYC records BAsk the bitcoin network operator to reveal who registered the wallet address CDecrypt the address with the private key stored on the victim's computer DSearch the victim's browser history for the attacker's home address

Correct answer: A. Trace the funds on the public ledger to an exchange, then request its KYC records
The bitcoin blockchain is public, so investigators can follow transactions until funds reach a regulated exchange, then use legal process to obtain that exchange's identity records. There is no central network operator that holds owner registrations for addresses.

Question 87Digital Forensics⚑ Flag

An Ubuntu server at Larkfield Energy keeps reopening an outbound connection every ten minutes, even after reboots. The investigator suspects a user-level scheduled job created by the account "deploy". Which location should be examined?

A/var/log/cron.d/deploy B/var/spool/cron/crontabs/deploy C/etc/cron.deny D/home/deploy/.profile.d/cron

Correct answer: B. /var/spool/cron/crontabs/deploy
On Debian and Ubuntu, per-user crontabs created with crontab -e are stored in /var/spool/cron/crontabs/ under the user's name. The cron.deny file only lists users who are blocked from using cron and does not contain job definitions.

Question 88Digital Evidence⚑ Flag

Examiner Omar Haddad has separate images of the two disks from a seized NAS configured as RAID 0. Neither image shows a usable file system on its own. What information does he need to rebuild the array virtually?

AThe stripe size, disk order and data start offset BOnly the serial numbers of both member disks CThe MAC address and admin password of the NAS DThe parity rotation pattern and the parity disk

Correct answer: A. The stripe size, disk order and data start offset
RAID 0 splits data into stripes across disks with no parity, so the stripe size, disk order and starting offset are needed to rebuild it. Parity rotation applies to RAID 5, not RAID 0.

Question 89Tools & Programs⚑ Flag

The digital forensics unit at Westbrook State Police needs a commercial mobile platform that supports logical, file system and, on supported devices, physical extractions across thousands of phone models, including recovery of deleted data. Which option fits BEST?

ALiME kernel module BMagnet RAM Capture CCellebrite UFED DAndroid Debug Bridge

Correct answer: C. Cellebrite UFED
Cellebrite UFED is a commercial mobile extraction platform that supports logical, file system and, where possible, physical extractions across a very wide range of devices. ADB can pull some data from Android phones, but it offers only limited logical access and works on Android alone.

Question 90Procedures & Methodology⚑ Flag

An HR manager at Westfield Logistics suspects an employee is stealing client lists. She plans to call him into a meeting this afternoon to ask about it, before IT has done anything with his laptop. What should the forensic investigator advise?

AAsk the employee to bring the laptop so IT can review it during the meeting BHave IT remotely delete the client lists from his laptop before the meeting CHold the meeting first so the employee has a fair chance to explain DPreserve the laptop and relevant logs before the employee is approached

Correct answer: D. Preserve the laptop and relevant logs before the employee is approached
Evidence should be secured before the subject is alerted, because a confronted employee may delete files or destroy devices. Holding the meeting first risks losing the very evidence needed to support or clear him.

Question 91Digital Evidence⚑ Flag

When validating a Master Boot Record in a hex editor, where should the examiner find the 0x55AA boot signature?

AAt offset 446, before the partition table BAt offsets 0 and 1 of sector 0 CIn the last two bytes of sector 1 DAt offsets 510 and 511 of sector 0

Correct answer: D. At offsets 510 and 511 of sector 0
The MBR occupies the first 512-byte sector, with boot code first, the partition table at offset 446 and the 0x55AA signature at offsets 510 and 511. Offset 446 marks the start of the partition table, not the signature.

Question 92Forensic Science⚑ Flag

Windows Explorer reports a text file on a suspect's NTFS drive as 2 KB, yet the volume shows far less free space than expected. Which check best tests whether data is hidden in alternate data streams?

AList its streams with a tool like dir /r BOpen the file in a hex editor at offset zero CCheck the file's $FILE_NAME timestamps DCompare the file's MD5 with the NSRL set

Correct answer: A. List its streams with a tool like dir /r
Alternate data streams do not count toward the size Explorer shows, so a stream-aware listing such as dir /r or a forensic suite is needed to reveal them. Viewing the main file in a hex editor shows only the primary stream, not the hidden ones.

Question 93Digital Forensics⚑ Flag

Security staff at Quarry Point Software find that an AWS security group was changed to allow SSH from anywhere, and they need to know which IAM identity made the change and from what IP. Which log source should the investigator query?

AS3 server access logs for the account BCloudTrail management events CCloudWatch CPU metrics for the instance DVPC Flow Logs for the affected subnet

Correct answer: B. CloudTrail management events
CloudTrail records API calls such as AuthorizeSecurityGroupIngress, including the calling identity, source IP and time. VPC Flow Logs show network connections, not who changed the configuration.

Question 94Digital Forensics⚑ Flag

An examiner at Riverton Police Department tries to undelete files from an ext4 image by following the block pointers in each deleted inode, but the tool recovers nothing useful. Why does this approach often fail on ext4?

Aext4 moves deleted inodes into a hidden lost+found Bext4 overwrites deleted data blocks with zeros at once Cext4 encrypts each inode once the file is unlinked Dext4 zeroes the extent data in the inode on deletion

Correct answer: D. ext4 zeroes the extent data in the inode on deletion
When ext4 deletes a file, it clears the extent information in the inode, so the pointers to the data blocks are gone even though the blocks may still hold data. Recovery then relies on older inode copies in the journal or on file carving, because the data blocks are not wiped immediately.

Question 95Regulations & Ethics⚑ Flag

A regional restaurant chain learns that card data may have been stolen from its point-of-sale systems. The card brands require a formal forensic investigation of the cardholder data environment. Who should perform it?

AThe Qualified Security Assessor who completed the chain's last annual assessment BThe chain's internal IT team, as long as they carefully document every action taken CA PCI Forensic Investigator approved by the PCI Security Standards Council DAny certified examiner, provided they hold a current vendor tool certification

Correct answer: C. A PCI Forensic Investigator approved by the PCI Security Standards Council
Card brand rules require that payment card breach investigations be done by a PCI Forensic Investigator (PFI) company approved by the PCI Security Standards Council. A QSA performs compliance assessments, which is a different role, and the PFI must be independent of the entity being investigated.

Question 96Procedures & Methodology⚑ Flag

A company's acceptable use policy allows monitoring and searching of company-owned devices. During an investigation, managers want the examiner to image an employee's personally owned phone that he brings to work. What should the examiner do?

AGet his written consent or legal advice before touching it BImage it secretly while the employee is at lunch to avoid conflict CTake it from his desk and keep it until he agrees to a search DImage it since the policy covers any device used at work

Correct answer: A. Get his written consent or legal advice before touching it
Company policy normally covers only company-owned assets, so a personal device needs the owner's consent or proper legal authority. Imaging it without authorization could violate privacy laws and make the evidence unusable.

Question 97Digital Evidence⚑ Flag

A suspect's 2 TB GPT disk will not mount, and the examiner finds the primary GPT header at LBA 1 overwritten with zeros. Where can the examiner MOST likely find a copy to rebuild the partition layout?

AIn the partition entry array starting at LBA 2 BIn the protective MBR at LBA 0 CIn the backup header at the disk's last LBA DIn the volume boot record of the first partition

Correct answer: C. In the backup header at the disk's last LBA
GPT keeps a backup header and backup partition entry array at the end of the disk for this kind of recovery. The protective MBR holds only a single 0xEE entry and does not describe the GPT layout.

Question 98Tools & Programs⚑ Flag

An examiner at Northpoint Legal is analyzing a messaging app's SQLite database pulled from a phone. Next to chat.db she finds a file named chat.db-wal. Why should she preserve and examine this second file?

AIt may hold recent or deleted records not yet merged into the main database BIt stores the encryption key the app uses to protect its main database file CIt is a temporary lock file that only shows which process had the database open DIt contains a compressed backup copy made each time the app is updated

Correct answer: A. It may hold recent or deleted records not yet merged into the main database
The write-ahead log (WAL) holds changes not yet checkpointed into the main database, so it can contain recent messages and older versions of edited or deleted records. Opening the database carelessly can trigger a checkpoint that merges or discards that data. It is not a lock file, since SQLite uses a separate -shm file for shared memory coordination.

Question 99Forensic Science⚑ Flag

A host laptop shows almost no browsing history, yet the examiner finds VirtualBox in the installed programs, a recently used .vdi file and prefetch entries for VirtualBoxVM.exe. What is the best next step?

AReport that no internet activity occurred BAcquire and examine the virtual disk file CReinstall VirtualBox to test its settings DRun a wiping check on the host page file

Correct answer: B. Acquire and examine the virtual disk file
The artifacts show a virtual machine was in use, so the guest's activity likely lives inside the .vdi file, which should be acquired and analyzed. Reporting no internet activity ignores clear evidence that the user worked inside a separate guest system.

Question 100Digital Forensics⚑ Flag

An investigator at Halcyon Design needs the exact URL from which a user downloaded a malicious disk image on a MacBook, along with the time and the app that downloaded it. Which artifact is the BEST source?

AThe QuarantineEventsV2 database in the user's Library BThe /.fseventsd folder at the volume root CThe ~/Library/Preferences/com.apple.finder.plist file DThe /private/var/db/receipts installer records

Correct answer: A. The QuarantineEventsV2 database in the user's Library
The com.apple.LaunchServices.QuarantineEventsV2 database stores quarantine events with the download URL, the downloading agent and a timestamp. FSEvents shows that a file was created but does not record the source URL.

Question 101Digital Forensics⚑ Flag

A company using a SaaS customer relationship platform suspects an insider exported client records. The investigator asks for a bit-stream image of the physical disk that hosts the company's data. Why is this request unlikely to succeed?

ACloud data cannot be used as evidence in court BThe customer may image any physical disk in the provider's data center at will CThe provider controls the hardware, so the customer relies on provider logs and exports DSaaS data is always stored on the user's laptop

Correct answer: C. The provider controls the hardware, so the customer relies on provider logs and exports
Under the shared responsibility model, a SaaS customer has no access to the provider's physical infrastructure, and disks are often shared across tenants. Investigators instead rely on audit logs, data exports and legal requests to the provider.

Question 102Procedures & Methodology⚑ Flag

The CISO at Brightwater Health wants to cut the cost and delay of future investigations. She asks what forensic readiness work should come first. What is the MOST appropriate starting point?

ABuy the most complete forensic suite on the market for the lab BIdentify likely incident scenarios and the evidence each one needs CHire an outside firm to image every laptop in the company each week DTrain all staff to collect evidence from their own systems if attacked

Correct answer: B. Identify likely incident scenarios and the evidence each one needs
Forensic readiness starts by defining likely scenarios and mapping where the needed evidence lives, so logging and retention can be set up in advance. Buying tools first does not ensure that the right data will exist when an incident happens.

Question 103Digital Evidence⚑ Flag

A seized drive's label lists 1,953,525,168 sectors, but the forensic workstation reports only 1,950,000,000 user-addressable sectors. The examiner suspects data is being hidden. What should the examiner check FIRST?

AWhether the file system uses 64 KB clusters BWhether TRIM is enabled on the workstation CWhether the partition table is MBR or GPT DWhether a host protected area is set

Correct answer: D. Whether a host protected area is set
An HPA lowers the maximum address the drive reports, hiding sectors from the operating system, and tools can detect it by comparing the reported maximum to the native maximum. Cluster size and partition style do not change how many sectors the drive itself reports.

Question 104Regulations & Ethics⚑ Flag

Jordan, a freelance forensic examiner, is hired by a law firm to image and analyze a laptop for a civil case in another US state. A colleague mentions that some states treat paid digital forensic work as private investigation. What should Jordan do FIRST?

ACheck that state's licensing rules and get a license or licensed partner if needed BProceed, because a recognized forensic certification replaces any state license CAsk the law firm to sign a waiver that releases Jordan from state licensing laws DProceed, because federal law preempts every state licensing rule for forensic work

Correct answer: A. Check that state's licensing rules and get a license or licensed partner if needed
Several US states require people who do digital forensic work for hire to hold a private investigator license or work under a licensed agency. Working unlicensed can bring penalties and give the other side grounds to challenge the evidence. A professional certification does not replace a state license.

Question 105Forensic Science⚑ Flag

Investigators need to show where a photo of stolen equipment was taken. The JPEG came straight from the suspect's phone. Which metadata field is most likely to help?

AThe JFIF version marker BThe EXIF GPS location tags CThe JPEG quantization table DThe NTFS file system creation time

Correct answer: B. The EXIF GPS location tags
Phones commonly write GPS coordinates into EXIF tags when location services are on, which can place the photo geographically. The quantization table describes compression settings and says nothing about location.

Question 106Digital Forensics⚑ Flag

An Amazon EC2 instance at Fernhill Analytics was compromised, and leadership wants the disk preserved before the instance is rebuilt. What is the most appropriate acquisition step for the instance's storage?

ACreate a snapshot of its EBS volume BReboot the instance and copy the logs CTerminate the instance to stop the attack DDownload the AMI catalog for the region

Correct answer: A. Create a snapshot of its EBS volume
An EBS snapshot captures the volume at a point in time and can be shared to a forensic account, turned into a volume and examined without altering the original. Terminating the instance can delete its root volume and destroy the evidence.

Question 107Digital Forensics⚑ Flag

A suspect at Marlow Biotech claims a confidential folder never existed on his Mac. The investigator wants records of file and folder creation, renaming and removal on the volume, including paths, even for items that are now gone. Which macOS artifact fits BEST?

AThe KnowledgeC database of app usage BThe Spotlight store in .Spotlight-V100 CThe com.apple.quarantine extended attribute DThe FSEvents logs stored in /.fseventsd

Correct answer: D. The FSEvents logs stored in /.fseventsd
FSEvents logs in /.fseventsd record file system changes such as create, rename and remove events along with the full path. KnowledgeC tracks app usage and device state, not file system changes.

Question 108Procedures & Methodology⚑ Flag

A forensic lab director wants formal recognition that the lab is technically competent and produces valid results. Which standard is MOST commonly used to accredit forensic testing laboratories?

AISO/IEC 17025 BISO/IEC 27037 CISO 9001 DISO/IEC 27001

Correct answer: A. ISO/IEC 17025
ISO/IEC 17025 sets requirements for the competence of testing and calibration laboratories and is the main basis for forensic lab accreditation. ISO/IEC 27037 gives guidelines for identifying and preserving digital evidence, but it is not a lab accreditation standard.

Question 109Tools & Programs⚑ Flag

An examiner at Ashworth Legal loads a Windows 10 NTUSER.DAT into a registry viewer and gets a warning that the hive is dirty. Recent user activity seems to be missing. The .LOG1 and .LOG2 files were collected with the hive. What should the examiner do?

ADelete the transaction logs so the viewer stops warning BReport the missing activity as proof the user cleared it CReplay the logs into a hive copy with Registry Explorer DRebuild the hive by importing it into the workstation registry

Correct answer: C. Replay the logs into a hive copy with Registry Explorer
Windows writes recent registry changes to the .LOG1 and .LOG2 transaction logs before flushing them to the hive, so a dirty hive can lack the newest data until the logs are replayed. Treating the gap as proof of clearing would be unsupported, since the data may be sitting in the logs.

Question 110Digital Evidence⚑ Flag

A suspect says a 6 GB video on his FAT32-formatted USB drive was stored as one file and later deleted. What should the examiner conclude from the file system alone?

AOne 6 GB file cannot exist on FAT32, so look for split parts BFAT32 compresses large videos, so the file shrank below 4 GB CThe data sits in the FAT itself, so check the second FAT copy DThe claim is plausible, since FAT32 volumes reach 2 TB

Correct answer: A. One 6 GB file cannot exist on FAT32, so look for split parts
FAT32 caps a single file at 4 GB minus 1 byte, so a 6 GB video had to be split or stored on another file system. The volume size limit is separate from the per-file limit.

Question 111Forensic Science⚑ Flag

An analyst reviewing an insurance claim photo runs error level analysis. One damaged car door shows a noticeably different error level than the rest of the image. How should this result be treated?

AAs evidence the camera sensor was faulty BAs proof the photo was taken at another time CAs conclusive proof the door was digitally altered DAs a lead that the region may have been edited

Correct answer: D. As a lead that the region may have been edited
Error level analysis highlights regions that recompress differently, which can signal editing, but it has known false positives and is not conclusive alone. Treating it as definitive proof overstates the method and ignores its limits.

Question 112Digital Forensics⚑ Flag

An investigator examines the full headers of a phishing email that passed through four mail servers. She wants to find the server that first received the message from the sender. Which Received header should she focus on?

AThe header just under the Subject line BThe bottommost Received header CThe header with the newest timestamp DThe topmost Received header

Correct answer: B. The bottommost Received header
Each mail server adds its Received header to the top, so the chain is read from the bottom up and the lowest header is the earliest hop. The topmost header was added by the final receiving server, which is why it also carries the newest timestamp.

Question 113Procedures & Methodology⚑ Flag

An accreditation assessor notes that a lab has validated its tools but has no way to show that individual examiners can still perform accurate examinations. What should the lab add to its quality program?

AA requirement for examiners to sign a statement of competence each quarter BExtra peer review limited to cases that go to trial in court CRegular proficiency tests on samples with known answers DA rule that every examiner must read the tool manual once each year

Correct answer: C. Regular proficiency tests on samples with known answers
Proficiency testing checks each examiner's performance against samples whose correct results are known, showing ongoing competence. A self-signed statement gives no objective measure of skill.

Question 114Digital Forensics⚑ Flag

In a memory image from a workstation at Norcross Bank, the Volatility psscan plugin shows a process named "svch0st.exe" that does not appear in pslist output. What is the MOST likely explanation?

AThe process belongs to a user who is now logged off BThe process was unlinked from the active process list CThe process is a 32-bit program on a 64-bit system DThe process was swapped out entirely to the pagefile

Correct answer: B. The process was unlinked from the active process list
pslist walks the doubly linked list of active processes, while psscan scans memory for process structures by pool tag. A process found only by psscan has either exited or been unlinked from the list, a hiding technique known as DKOM, and the odd name makes hiding likely.

Question 115Digital Evidence⚑ Flag

When a file is deleted on a FAT32 volume, what normally happens to its directory entry and data?

AThe entry is erased and the data clusters are overwritten with zeros BThe entry moves to a hidden folder until the volume is defragmented CThe name is kept, but its data clusters are marked as bad clusters DThe name's first byte becomes 0xE5 and its FAT chain is zeroed

Correct answer: D. The name's first byte becomes 0xE5 and its FAT chain is zeroed
FAT marks a deleted entry by replacing the first character of the name with 0xE5 and frees the clusters by zeroing their FAT entries, while the content stays until reused. The data clusters themselves are not zeroed.

Question 116Regulations & Ethics⚑ Flag

While examining a suspect's computer for a prosecutor's office, examiner Priya finds artifacts showing the suspect was logged in from another city at the time of the alleged intrusion. The case agent asks her to leave this out because it 'confuses the timeline.' What should Priya do?

ALeave it out, since the case agent decides which results are relevant to the case BInclude it in her report, since examiners must report all relevant findings CMention it verbally to the agent but keep it out of the final written report DDelete the artifacts from her working copy so they cause no future confusion

Correct answer: B. Include it in her report, since examiners must report all relevant findings
Examiners must report findings objectively, including those that help the defense, and prosecutors have legal duties to disclose exculpatory evidence. Leaving it out at an agent's request undermines the examiner's integrity and can lead to serious legal consequences for the case.

Question 117Tools & Programs⚑ Flag

During live triage of a Windows server at Lakeshore Utilities, a responder suspects malware has configured itself to start at boot. He wants one view of Run keys, services, scheduled tasks, drivers and other auto-start locations, with an option to hide signed Microsoft entries. Which Sysinternals tool should he use?

AProcess Explorer BTCPView CAutoruns DProcess Monitor

Correct answer: C. Autoruns
Autoruns lists programs configured to start automatically from Run keys, services, scheduled tasks, drivers, Winlogon entries and many other locations, and it can hide verified Microsoft entries. Process Explorer shows what is running right now, but it does not enumerate every persistence location.

Question 118Procedures & Methodology⚑ Flag

A responder is transporting seized drives from a field site back to the lab in a company vehicle on a hot summer day. Which precaution is MOST important?

AKeep them in the cooled cabin, away from magnets and radio gear BLock the drives in the trunk so they are out of view during the trip CLeave the drives in the car during lunch as long as the doors are locked DPlace the drives near the speakers so they stay cushioned during travel

Correct answer: A. Keep them in the cooled cabin, away from magnets and radio gear
Heat, strong magnetic fields and radio transmitters can damage media, so drives should ride in a climate-controlled area under the responder's control. A hot trunk can exceed safe temperatures for electronic media.

Question 119Forensic Science⚑ Flag

Under a valid warrant, an examiner must open a password-protected archive on a suspect's drive. The suspect will not provide the password. Which recovery approach is usually the most efficient first step?

AA request to the archive software vendor BA brute force attack across all characters CA rainbow table built for MD5 hashes DA dictionary built from the suspect's data

Correct answer: D. A dictionary built from the suspect's data
People often reuse words, names and old passwords, so a custom dictionary built from the suspect's own files and browser data is usually the fastest lawful approach. Pure brute force guarantees coverage in theory but can take impractically long for strong passwords.

Question 120Digital Forensics⚑ Flag

A finance clerk at Ashby Foods received a payment request that appears to come from the CEO's company address. The Authentication-Results header shows spf=fail and dmarc=fail for the From domain, and the sending IP belongs to an unrelated hosting provider. What is the best conclusion?

AThe sender address was most likely spoofed BThe mail server's clock was out of sync CThe message was delayed by greylisting DThe CEO sent it from a brand new company laptop

Correct answer: A. The sender address was most likely spoofed
Failing SPF and DMARC for the From domain, combined with a sending IP outside the company's authorized servers, strongly indicates the From address was forged. A new laptop would still send through the company's authorized mail servers and pass these checks.

Question 121Digital Evidence⚑ Flag

Examiner Ana Silva carves JPEG files from unallocated space using header and footer signatures. Many recovered images show the top portion intact, but the rest is garbled or shows parts of other pictures. What is the MOST likely cause?

AThe JPEG files were encrypted before they were deleted BThe drive used 512-byte sectors instead of 4K sectors CThe images were split across non-contiguous clusters DThe carving tool used the wrong JPEG header signature

Correct answer: C. The images were split across non-contiguous clusters
Basic header and footer carving assumes a file sits in contiguous clusters, so fragmented files pull in unrelated data after the first fragment. A wrong header signature would find no images at all rather than partial ones.

Question 122Digital Forensics⚑ Flag

An investigator at Pell Ridge Insurance examines a Windows 10 version 21H1 laptop. She wants records of which applications the user worked in, which documents they opened and the start and end times of that activity. Which artifact BEST fits this need?

AThe Prefetch folder under C:\Windows\Prefetch BThe AppCompatCache value in the SYSTEM hive CThe setupapi.dev.log file in C:\Windows\INF DThe Windows Timeline ActivitiesCache.db file

Correct answer: D. The Windows Timeline ActivitiesCache.db file
ActivitiesCache.db, stored under the user's AppData\Local\ConnectedDevicesPlatform folder, records application activity with start and end times and often the file or URL involved. Prefetch shows that a program ran and when, but it does not record how long it was used or which documents were open.

Question 123Procedures & Methodology⚑ Flag

A first responder seizes a powered-on smartphone during a fraud investigation. The suspect's associates may try to wipe it remotely. What should the responder do FIRST?

ARemove the SIM card and keep the phone on the charger BBrowse the messages quickly to note anything important CPower the phone off right away to stop all its network activity DPlace it in a signal-blocking Faraday bag and keep it charged

Correct answer: D. Place it in a signal-blocking Faraday bag and keep it charged
A Faraday bag blocks cellular, Wi-Fi and Bluetooth signals so remote wipe commands cannot reach the phone, while keeping it on preserves volatile data. Powering it off may enable a lock screen or encryption that blocks later extraction.

Question 124Regulations & Ethics⚑ Flag

Valerie, an independent examiner, is asked by a plaintiff's attorney to analyze a defendant company's servers. Two years ago she was a contractor for that same company and had access to its internal investigation files. What is the MOST appropriate action?

AAccept the case, since two years is long enough to end any possible conflict BDisclose the past work to the attorney and decline the engagement CAccept the case but avoid mentioning the prior work unless asked under oath DAccept the case and use her inside knowledge to focus the analysis faster

Correct answer: B. Disclose the past work to the attorney and decline the engagement
An examiner who had access to a party's confidential information has a clear conflict of interest and should disclose it and step aside. Hiding it or relying on the passage of time puts her objectivity and the case at risk, and using inside knowledge would breach confidentiality.

Question 125Digital Evidence⚑ Flag

During signature analysis of a suspect's documents folder, a file named Q3_forecast.xlsx begins with the bytes FF D8 FF E0. What is the BEST interpretation?

AIt is a damaged XLSX file that only needs repair BIt is a normal Excel file, since XLSX headers vary CIt is likely a JPEG image renamed as a spreadsheet DIt is an Excel workbook protected by a password

Correct answer: C. It is likely a JPEG image renamed as a spreadsheet
FF D8 FF is the JPEG signature, while a genuine XLSX file is a ZIP container that starts with 50 4B 03 04. A mismatch between extension and header is a classic sign of data hiding and should be examined.

Question 126Forensic Science⚑ Flag

An examiner's report lists a file hash written as 40 hexadecimal characters. Which algorithm most likely produced it?

ASHA-256 BSHA-512 CMD5 DSHA-1

Correct answer: D. SHA-1
SHA-1 produces a 160-bit digest, which is 40 hexadecimal characters. MD5 produces 128 bits, or 32 hex characters, so it would be shorter.

Question 127Digital Forensics⚑ Flag

Firewall logs at Westlake Clinic show that internal IP address 10.20.4.57 uploaded patient files at 1:40 AM three days ago. Workstations receive addresses dynamically, and the address now belongs to a different PC. Which source BEST identifies the machine that held the address at that time?

AThe ipconfig output from today's holder BThe current ARP table on the core switch CThe DHCP server's lease and audit logs DThe hostname now registered in DNS for it

Correct answer: C. The DHCP server's lease and audit logs
DHCP server logs record which MAC address and hostname leased each IP address and when, so they map the address to a machine for the past time in question. The current ARP table and today's ipconfig output only show who holds the address now.

Question 128Digital Forensics⚑ Flag

An examiner at Dorsey County parses the visits table in a Chrome History database and finds a visit_time value of 13350000000000000. How should she interpret this raw value?

A100-nanosecond intervals since 1601, UTC BMicroseconds since January 1, 1601, UTC CMilliseconds since January 1, 1970, UTC DSeconds since January 1, 1970, UTC

Correct answer: B. Microseconds since January 1, 1601, UTC
Chrome stores times in its SQLite databases as the number of microseconds since January 1, 1601, UTC, often called WebKit time. Windows FILETIME also starts in 1601 but counts 100-nanosecond intervals, so decoding with it would give a badly wrong date.

Question 129Tools & Programs⚑ Flag

The security team at Northfield Logistics has deployed Sysmon on its servers to support future investigations. An examiner wants the Sysmon event that records each new process with its command line, parent process and file hashes. Which event ID should she filter on?

AEvent ID 11 BEvent ID 22 CEvent ID 1 DEvent ID 3

Correct answer: C. Event ID 1
Sysmon Event ID 1 records process creation, including the command line, parent process and configured hashes of the image. Event ID 3 records network connections, which can be linked to a process but does not describe how it was launched.

Question 130Procedures & Methodology⚑ Flag

A new forensic lab is being built for a regional bank. Which physical control is MOST important for the evidence room?

ARestricted, logged entry for authorized staff only BLarge windows so supervisors can see activity from the hallway CA shared key kept at reception so any employee can retrieve items DOpen shelving near the break room for quick access by analysts

Correct answer: A. Restricted, logged entry for authorized staff only
Evidence areas must limit entry to authorized people and record every access, supporting chain of custody. A shared key at reception lets anyone reach the evidence without a record.

Question 131Digital Evidence⚑ Flag

In an HFS+ volume, which structure stores the hierarchy of files and folders along with their metadata?

AThe ext inode table BThe catalog file B-tree CThe master file table DThe file allocation table

Correct answer: B. The catalog file B-tree
HFS+ tracks files and folders in the catalog file, which is organized as a B-tree. The master file table is the equivalent structure in NTFS, not HFS+.

Question 132Digital Forensics⚑ Flag

An attacker deleted /var/log/auth.log on a compromised Ubuntu server at Carrow Media. The investigator still wants a list of successful login sessions with their start times, end times and source hosts. Which source should she check next?

A/var/log/wtmp, read with the last command B/var/log/btmp, read with the lastb command C/var/log/lastlog, read with the lastlog command D/etc/shadow, reviewed for password change dates

Correct answer: A. /var/log/wtmp, read with the last command
The binary wtmp file records login and logout sessions, along with reboots, and the last command displays them with times and source hosts. The btmp file holds failed login attempts, and lastlog keeps only each account's most recent login.

Question 133Digital Forensics⚑ Flag

An examiner at Tidewater Port Authority needs the SHA1 hash of an executable that was deleted from a Windows 10 host weeks ago, so the hash can be checked against threat intelligence. Which artifact is MOST likely to contain it?

AThe user's UserAssist Count subkey BThe Prefetch file for that executable CThe Amcache.hve file in C:\Windows\AppCompat\Programs DThe SYSTEM hive AppCompatCache value

Correct answer: C. The Amcache.hve file in C:\Windows\AppCompat\Programs
Amcache.hve stores details about executables, including path, size and a SHA1 hash, and these entries often remain after the file is deleted. Prefetch files record run counts and times but do not store a hash of the executable.

Question 134Forensic Science⚑ Flag

While searching a seized laptop under a warrant limited to local files, an examiner recovers saved credentials for the suspect's cloud email account. What should the examiner do before accessing that account?

AAsk the suspect's employer to grant access BUse the credentials only in a virtual machine CLog in at once before the password changes DObtain separate legal authority for the account

Correct answer: D. Obtain separate legal authority for the account
Remotely stored data is usually outside a warrant limited to the device, so separate legal authority is needed before using recovered credentials. Logging in at once might feel urgent, but it risks an unlawful search that could exclude the evidence.

Question 135Regulations & Ethics⚑ Flag

General counsel at Brightwater Plastics receives a demand letter threatening a lawsuit over leaked trade secrets. The company's email system automatically deletes messages after 90 days. What should the investigator recommend IMMEDIATELY?

AImage every device in the company before telling anyone about the demand letter BLet the 90-day policy run, since following a written policy prevents any sanctions CWait until a lawsuit is actually filed before changing any retention settings DIssue a legal hold and suspend auto-deletion for relevant custodians and systems

Correct answer: D. Issue a legal hold and suspend auto-deletion for relevant custodians and systems
The duty to preserve begins when litigation is reasonably anticipated, which a specific demand letter usually triggers. A legal hold must suspend routine deletion for relevant data. Relying on the normal retention policy after that point can be treated as spoliation.

Question 136Procedures & Methodology⚑ Flag

An examiner at Silverline Consulting finished a report that will go to outside counsel for litigation. The lab's procedures call for a quality step before release. What is the MOST appropriate step?

AHave a qualified peer review the methods, findings and conclusions BRun a spelling checker and then release it to counsel right away CAsk the opposing party to confirm the results before it is finalized DSend the draft to the client and let them suggest which findings to drop

Correct answer: A. Have a qualified peer review the methods, findings and conclusions
Technical peer review by another qualified examiner checks that the methods are sound and the conclusions follow from the data. Letting the client choose findings to drop would compromise objectivity.

Question 137Digital Evidence⚑ Flag

An investigator examines an NTFS volume where a user deleted a large non-resident report and emptied the Recycle Bin a few minutes earlier. Which statement BEST describes the state of the file?

AIts clusters are added to the $BadClus file for later reuse BIts MFT record is marked unused and $Bitmap frees its clusters CIts MFT record is erased and its clusters are filled with zeros DIts data moves into $LogFile until the volume is next rebooted

Correct answer: B. Its MFT record is marked unused and $Bitmap frees its clusters
NTFS clears the in-use flag in the MFT record and marks the clusters free in $Bitmap, so the content and often the record remain until overwritten. NTFS does not zero clusters when a file is deleted.

Question 138Tools & Programs⚑ Flag

A suspect at Ferris Academy deleted a folder of images, and carving found nothing usable. The investigator believes the suspect browsed that folder in Windows Explorer using a large icon view. Which tool is BEST suited to recover small previews of the images?

AExifTool run against the user's Pictures folder BA hex editor opened on the Windows paging file Cdc3dd run against the empty folder's location DA thumbcache viewer for Explorer cache files

Correct answer: D. A thumbcache viewer for Explorer cache files
Windows stores thumbnails in thumbcache_*.db files under the user's AppData\Local\Microsoft\Windows\Explorer folder, and they can remain after the originals are deleted. ExifTool reads metadata from files that still exist, so it cannot help once the images themselves are gone.

Question 139Digital Forensics⚑ Flag

An investigator needs to recover deleted photos that may still exist in unallocated space on a supported Android handset. Which acquisition type is most likely to capture that data?

AA cloud export of the user's photo library BLogical extraction through the backup API CPhysical extraction of the flash memory DManual extraction by photographing screens

Correct answer: C. Physical extraction of the flash memory
A physical extraction is a bit-for-bit copy of the storage, so it includes unallocated areas where deleted data may remain. Logical extraction only pulls active data the operating system exposes, so it rarely includes deleted content.

Question 140Forensic Science⚑ Flag

Threatening posts in a harassment case were traced to an IP address. The ISP's subscriber records show it was assigned to a home with shared Wi-Fi used by four adults. What conclusion does this evidence BEST support?

AThe account holder personally wrote the posts BThe posts came through that home's connection CThe router owner is responsible under law DThe IP address proves which device was used

Correct answer: B. The posts came through that home's connection
An IP address identifies a network connection and its subscriber, not the person at the keyboard or the specific device. Linking the posts to one person requires device-level evidence such as account logins, browser artifacts or the posts themselves on a seized device.

Question 141Digital Forensics⚑ Flag

During an intrusion review at Ashgrove Pharma, an investigator suspects the attacker used a remote admin tool that installs itself as a service on each target. Which Windows event should the investigator search for in the System log?

AEvent 4697, a scheduled task was updated BEvent 6005, the event log service started CEvent 7045, a new service was installed DEvent 4720, a user account was created

Correct answer: C. Event 7045, a new service was installed
Event 7045 in the System log is written by the Service Control Manager when a new service is installed, and it records the service name and image path. Event 4720 records account creation, which does not show service installation.

Question 142Procedures & Methodology⚑ Flag

A lab technician is preparing destination drives to receive forensic images for a new case. Which step is MOST important before imaging begins?

AForensically wipe the drives, verify the wipe and record it BUse drives from a previous case as long as they have free space CLabel the drives with the suspect's name using a permanent marker DFormat the drives with the same file system as the suspect drive

Correct answer: A. Forensically wipe the drives, verify the wipe and record it
Wiping and verifying target media shows that no leftover data from earlier cases could mix with the new evidence. Reusing drives without wiping invites claims of cross-contamination.

Question 143Digital Evidence⚑ Flag

An examiner configures a carving tool to recover deleted PDF documents from a disk image. Which header and footer pair should the tool use?

AHeader 89 50 4E 47 and footer IEND BHeader 25 50 44 46 and footer %%EOF CHeader 50 4B 03 04 and footer 50 4B 05 06 DHeader FF D8 FF and footer FF D9

Correct answer: B. Header 25 50 44 46 and footer %%EOF
PDF files begin with %PDF, which is 25 50 44 46 in hex, and end with an %%EOF marker. The 50 4B pair belongs to ZIP-based formats such as DOCX and XLSX.

Question 144Regulations & Ethics⚑ Flag

A state crime lab is running out of storage space and wants to clear old evidence drives. One case ended in a conviction last month, and the defendant has filed an appeal. What should the evidence manager do with that case's drives?

ARetain them until the appeal and any legal retention periods are resolved BWipe them now, since the trial has ended and the conviction has been entered CReturn them to the defendant's family, since the case is technically closed DKeep only the written report and destroy the drives to free up storage space

Correct answer: A. Retain them until the appeal and any legal retention periods are resolved
Retention policies tie disposal to the end of all legal proceedings, including appeals, and to any required retention periods. Destroying evidence while an appeal is pending could prevent retesting and harm the integrity of the case. When disposal is allowed, it should be authorized and documented.

Question 145Tools & Programs⚑ Flag

An examiner at Larkin Insurance wants to scan an E01 image with a commercial antivirus engine that only works on a real Windows drive letter. She must not change the evidence image. Which approach BEST meets this need?

ARestore the image to the lab's own boot drive BConvert the image to raw format with dd first CMount it read-only using Arsenal Image Mounter DOpen the image in a hex editor with write access

Correct answer: C. Mount it read-only using Arsenal Image Mounter
Arsenal Image Mounter presents E01 and other images to Windows as real disks, and its read-only or temporary write modes keep the image file unchanged while other programs scan it. Converting to raw with dd still leaves an image file that the antivirus engine cannot see as a drive.

Question 146Digital Forensics⚑ Flag

In a home burglary case, the victim says a smart speaker heard voices during the break-in. The speaker itself has very little local storage. Where are the voice recordings most likely to be found?

AOn the speaker's internal flash memory chip BIn the vendor's cloud account for the user COn the TV that shares the home network DOn the home router's system log

Correct answer: B. In the vendor's cloud account for the user
Smart speakers stream voice requests to the vendor's cloud, where recordings and transcripts are tied to the user's account and can be obtained through an account export or legal process. The router log may show traffic to the vendor but not the audio itself.

Question 147Forensic Science⚑ Flag

On a seized desktop at Tidewater Engineering, an examiner finds a 10 GB file named backup.dat with no recognizable file signature and near-maximum entropy throughout. A copy of VeraCrypt is also installed. What does this most likely indicate?

AA sparse virtual memory file BA partially carved video file CA corrupted ZIP archive with a bad header DA possible encrypted container

Correct answer: D. A possible encrypted container
A large file with no header, uniformly high entropy and an encryption tool on the system strongly suggests an encrypted container. A corrupted ZIP would usually still show ZIP signatures and structures rather than random-looking data.

Question 148Digital Forensics⚑ Flag

An investigator at Merriden Financial believes an employee uploaded large amounts of data with a cloud sync client last month. Firewall logs have already rolled over. Which Windows artifact can show bytes sent and received per application over the past several weeks?

AThe SRUM database at C:\Windows\System32\sru\SRUDB.dat BThe Jump List files for the sync client CThe Windows Defender operational log DThe Amcache.hve program inventory

Correct answer: A. The SRUM database at C:\Windows\System32\sru\SRUDB.dat
The System Resource Usage Monitor (SRUM) records network bytes sent and received per application and per user, typically for about 30 to 60 days. Amcache shows that a program existed on the system but holds no network usage figures.

Question 149Procedures & Methodology⚑ Flag

According to the order of volatility in RFC 3227, which of the following should be collected LAST?

ARunning process list BArchival backup media CContents of system memory DRouting table and ARP cache

Correct answer: B. Archival backup media
RFC 3227 places archival media at the bottom of the order because it changes least and is unlikely to be lost. Memory, process lists and network tables can change or vanish within seconds and are collected much earlier.

Question 150Digital Evidence⚑ Flag

While examining a seized desktop in a money laundering case, an examiner finds wallet.dat in the user's AppData\Roaming\Bitcoin folder. What is the BEST interpretation of this file?

AA full local copy of the bitcoin blockchain BA cache of the user's exchange login pages CA log of the user's mining hardware settings DKeys and addresses that control the funds

Correct answer: D. Keys and addresses that control the funds
Bitcoin Core's wallet.dat holds the private keys, addresses and related transaction data that control the user's funds, and it may be protected by a passphrase. The blockchain itself is kept in separate block files, so the wallet file should be preserved and handled as high-value evidence.