Free CHFI v11 Practice Exam (2026)

Your score by topic

Get a free CHFI v11 study plan on WhatsApp See CHFI v11 Training with pass guarantee

Review answers Only my mistakes Retake

Question 1Digital Evidence⚑ Flag

A first responder enters an office at Ridgeview Insurance and finds the suspect's workstation on, with a chat window showing messages about transferring client files. The screen will lock in a few minutes. What should the responder do FIRST?

APhotograph the screen and note what is displayed BPull the power cord to preserve the disk contents CScroll through the chat to read the older messages DClose the chat app to stop any further messages

Correct answer: A. Photograph the screen and note what is displayed
On-screen content is fragile evidence that can vanish when the screen locks, so photographing and documenting it is the first step and changes nothing. Scrolling through the chat alters system state and should wait until volatile data is properly collected.

Question 2Procedures & Methodology⚑ Flag

A company's main database server runs on a RAID array and supports live customer transactions. Investigators need its data, and counsel has warned against unnecessary downtime and data corruption. Which approach is MOST appropriate?

ALeave the server alone and only interview the administrators about it BPull the power cord at once to freeze the disks in their current state CCollect volatile data, then perform a live or controlled acquisition DRemove individual RAID disks while the server runs and image them one by one

Correct answer: C. Collect volatile data, then perform a live or controlled acquisition
Business-critical servers and RAID systems are often acquired live or shut down in a controlled way, because a hard power cut can corrupt data and disrupt operations. Pulling disks from a running array can break the array and destroy evidence.

Question 3Digital Forensics⚑ Flag

An analyst at Kestrel Retail finds an entry for C:\Users\Public\scan.exe in the AppCompatCache (ShimCache) value of a Windows 10 SYSTEM hive. A manager says this proves the tool ran at the listed time. What is the BEST response?

AAgree, since ShimCache only stores executed files BAgree, as the timestamp is the last execution time CDisagree, since ShimCache only tracks DLL files DDisagree, as the entry alone does not prove execution

Correct answer: D. Disagree, as the entry alone does not prove execution
On Windows 10, ShimCache entries can be created when a file is merely seen by the system, and the stored timestamp is the file's last modified time, not its run time. ShimCache does track executables, so the claim about DLLs only is wrong.

Question 4Digital Forensics⚑ Flag

Analysts at Milbrook Telecom review DNS logs and see one host sending thousands of TXT queries to a single domain. Each query has a long, random-looking subdomain label, and responses contain encoded text. What activity does this pattern most likely indicate?

AA browser prefetching popular websites BNormal DNSSEC key validation traffic CA misconfigured reverse lookup zone DData moved out through DNS tunneling

Correct answer: D. Data moved out through DNS tunneling
High volumes of queries to one domain with long encoded subdomains and TXT responses suggest data is being carried inside DNS. Browser prefetching resolves real, readable host names across many domains, not random labels to one domain.

Question 5Forensic Science⚑ Flag

A defendant claims malware downloaded illegal files without his knowledge. The examiner treats this as a hypothesis and checks for malware, autoruns and remote access traces that would support it. Which scientific principle is the examiner applying?

AFollowing the order of volatility BTesting a falsifiable alternative hypothesis CRelying on the presumption of regularity DApplying the best evidence rule to digital files

Correct answer: B. Testing a falsifiable alternative hypothesis
Sound forensic science frames claims as testable hypotheses and seeks evidence that could confirm or refute them, including the defense's claim. The order of volatility concerns collection sequence and does not address how competing explanations are tested.

Question 6Tools & Programs⚑ Flag

An incident responder at Meridian Travel needs a free, lightweight Windows tool he can run from a USB drive to preview a suspect's disk, create an E01 or raw image, and also capture physical memory from the live machine. Which tool fits BEST?

AVolatility BFTK Imager CAutopsy DRegRipper

Correct answer: B. FTK Imager
FTK Imager is a free tool, now from Exterro and formerly AccessData, that previews evidence, creates raw and E01 images, and can capture memory from a live Windows system. Autopsy is a free analysis platform, but it is not designed for live memory capture.

Question 7Regulations & Ethics⚑ Flag

At trial, opposing counsel argues that a forensic image offered by examiner Tom Reyes of the Halvern County Sheriff's Office could have been altered after seizure. Which evidence BEST establishes that the image is authentic?

AThe fact that the image was created with a widely used commercial forensic tool BTestimony that the original drive was kept in a locked cabinet after the seizure CA statement from the prosecutor that the lab follows strict internal procedures DMatching acquisition and verification hashes plus a complete chain of custody

Correct answer: D. Matching acquisition and verification hashes plus a complete chain of custody
Authentication requires evidence that the item is what it is claimed to be. Matching hash values show the image has not changed, and the chain of custody accounts for everyone who handled the evidence. A locked cabinet helps, but on its own it does not show the image matches the original data.

Question 8Digital Evidence⚑ Flag

During a live response on a compromised Windows server, a junior responder plans to run the server's own netstat.exe and tasklist.exe to collect volatile data. What does RFC 3227 recommend instead?

ACopy the system's tools to the desktop and run them BWait until a full disk image has been completed CRun trusted tools from protected external media DReboot into safe mode before running any commands

Correct answer: C. Run trusted tools from protected external media
RFC 3227 advises using trusted programs on write-protected media because an attacker may have replaced system binaries to hide activity. Waiting for a disk image would let volatile data disappear first.

Question 9Procedures & Methodology⚑ Flag

A responder arrives at a running workstation whose monitor shows a screen saver. The desktop behind it has not been seen or photographed yet. What should the responder do?

APress Enter to unlock the system and view the open windows BNudge the mouse without clicking, then photograph the screen CPull the power cord because the screen saver hides the user session DWait for the screen saver to stop on its own before doing anything

Correct answer: B. Nudge the mouse without clicking, then photograph the screen
Gently moving the mouse wakes the display without selecting anything, so the screen can be photographed as found. Pressing keys can trigger actions or input in open programs and alter the system.

Question 10Forensic Science⚑ Flag

Before adopting a new write blocker, the lab at Ridgeway State Police reviews published test reports showing how the device behaved under controlled conditions. Which program publishes such forensic tool test results?

AThe ISO 9001 program BThe NIST NSRL program CThe NIST CFTT program DThe FBI CJIS program

Correct answer: C. The NIST CFTT program
The NIST Computer Forensics Tool Testing program publishes test results for tools like write blockers and imaging software. The NSRL program publishes hash sets of known software, not tool validation reports.

Question 11Digital Forensics⚑ Flag

An investigator at Fairhaven Schools needs to know when a specific user last ran a program on a Windows 10 build 1909 laptop. The investigator wants a per-user record kept by a system service. Which registry location fits BEST?

ASYSTEM\CurrentControlSet\Services\bam\State\UserSettings\{SID} BSOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\{SID} CSYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache DSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths

Correct answer: A. SYSTEM\CurrentControlSet\Services\bam\State\UserSettings\{SID}
The Background Activity Moderator (BAM) key stores executable paths with a last execution timestamp under each user's SID. ProfileList maps SIDs to profile folders and does not record program execution.

Question 12Digital Forensics⚑ Flag

A packet capture from Granite Ridge Law shows a workstation downloading an executable over plain HTTP just before an infection. The investigator wants a copy of that exact file to hash and analyze. What is the best approach?

ARead the DNS query log for the file name BExport the HTTP object from the capture CRebuild the file from NetFlow byte counts DCheck the switch port counters for errors

Correct answer: B. Export the HTTP object from the capture
Protocol analyzers can reassemble an unencrypted HTTP transfer and export the transferred object as a file for hashing and analysis. NetFlow and DNS logs only hold metadata, so they cannot reproduce the file's contents.

Question 13Tools & Programs⚑ Flag

A small county lab in Dunmore wants a free Ubuntu-based forensic workstation, maintained by SANS, that comes with many open-source tools such as The Sleuth Kit, Plaso and Volatility already installed. Which option meets this need?

ASIFT Workstation BAutopsy CMagnet AXIOM Examine DKali Linux

Correct answer: A. SIFT Workstation
The SANS SIFT Workstation is a free Ubuntu-based environment with a large set of open-source forensic tools preinstalled and configured. Kali Linux includes some forensic tools, but it is built mainly for penetration testing and is not maintained by SANS.

Question 14Digital Evidence⚑ Flag

An analyst at Sorrel Health learns that a former admin deleted Azure virtual machines about 70 days ago. The company never set up export of Azure Activity log data to storage or a workspace. What should the analyst do FIRST?

ARebuild the machines from templates to see what changed BWait for counsel, since Azure keeps these logs for years CExport the Activity log now before older events age out DAsk Microsoft for a disk image of the deleted machines

Correct answer: C. Export the Activity log now before older events age out
The Azure Activity log keeps events for about 90 days by default, so events from 70 days ago will soon be lost unless they are exported. Waiting on the belief that the logs last for years risks losing the only record of who deleted the machines.

Question 15Procedures & Methodology⚑ Flag

Before disconnecting a seized desktop and its peripherals, a first responder at a law firm wants to make sure the lab can rebuild the setup later. What should the responder do?

AUnplug everything quickly and sort the cables in one evidence bag BDraw a rough sketch later from memory once back at the lab CLeave the cables behind since only the computer holds evidence DLabel each cable and its matching port, then photograph them

Correct answer: D. Label each cable and its matching port, then photograph them
Labeling cables and ports and photographing them lets the lab reconstruct the exact setup if needed. A sketch made later from memory is unreliable and may miss key connections.

Question 16Regulations & Ethics⚑ Flag

Examiner Rosa Lin extracted two items for trial: timestamps written automatically by a firewall, and an email in which a coworker described seeing the suspect near the server room. Both are offered to prove what they say. Which statement is MOST accurate under hearsay principles?

ANeither item is hearsay, because both were recovered by a qualified forensic examiner BThe timestamps are hearsay, but the email is not, because a person wrote the email directly CBoth items are hearsay, because anything stored on a computer is an out-of-court statement DThe coworker's email raises a hearsay issue, while the automatic timestamps generally do not

Correct answer: D. The coworker's email raises a hearsay issue, while the automatic timestamps generally do not
Hearsay requires a statement by a person. Records generated entirely by a machine process, such as automatic firewall timestamps, are generally not hearsay, though they still need authentication. A human-written email offered for its truth is hearsay unless an exception applies.

Question 17Forensic Science⚑ Flag

An investigator has the hash of a leaked design document, but the copy on the suspect's drive has a slightly edited title page. The exact hash no longer matches. Which technique can still show the files are highly similar?

AContext-triggered piecewise hashing BRecalculating the hash with MD5 CChecking the file's NTFS timestamps DComparing SHA-256 values again

Correct answer: A. Context-triggered piecewise hashing
Context-triggered piecewise hashing, used by tools like ssdeep, produces similarity scores that survive small edits. Any cryptographic hash, including SHA-256 or MD5, changes completely after even a one-byte edit, so recalculating it will not reveal similarity.

Question 18Digital Forensics⚑ Flag

A network IDS at Clearwater Utilities raised an alert matching a known exploit signature against a web server. The incident lead asks whether the server was actually compromised. What should the investigator do next?

ADisable the IDS rule to cut alert noise BCorroborate it with packet data and host logs CReport a confirmed breach based on the alert alone DDelete the alert as a likely false positive

Correct answer: B. Corroborate it with packet data and host logs
An IDS alert shows that traffic matched a signature, not that the attack succeeded. The investigator should check the related packets, server responses and host logs to confirm or rule out compromise before drawing conclusions.

Question 19Digital Forensics⚑ Flag

A suspect at Glenmoor Accounting says she never browsed to a network share named \\FIN-SRV\payroll. The investigator wants evidence of paths the user manually typed into the File Explorer address bar. Which key should be checked?

ANTUSER.DAT\...\Explorer\RunMRU BNTUSER.DAT\...\Explorer\WordWheelQuery CNTUSER.DAT\...\Explorer\RecentDocs DNTUSER.DAT\...\Explorer\TypedPaths

Correct answer: D. NTUSER.DAT\...\Explorer\TypedPaths
The TypedPaths key stores paths a user typed directly into the Explorer address bar. RunMRU holds commands typed into the Run dialog, which is a different interface.

Question 20Digital Evidence⚑ Flag

Investigators at a regional utility must collect evidence from a 60 TB storage array that serves hundreds of users. The warrant covers only one employee's home share, and the array cannot be taken offline. Which approach is MOST appropriate?

AAsk the employee to copy the share to removable media BBit-stream image the entire array over a weekend CPerform a logical acquisition of the authorized share DRemove one disk from the array and image it offline

Correct answer: C. Perform a logical acquisition of the authorized share
A logical acquisition of the authorized share respects the warrant's scope and works on a live system too large to image. Removing a single disk from the array would yield striped fragments and could disrupt service.

Question 21Procedures & Methodology⚑ Flag

Investigators arrive at an office to seize computers in an embezzlement case. Several employees, including the suspect, are still at their desks. What should the lead responder do FIRST to secure the scene?

AHave all people step away from computers and devices right away BLet the suspect shut down his own machine to avoid an argument CStart imaging the suspect's computer while staff keep working DAsk everyone to finish their work and save files before leaving

Correct answer: A. Have all people step away from computers and devices right away
Removing people from the devices prevents anyone from deleting data or altering systems once they know an investigation is underway. Letting the suspect shut down his own machine gives him a chance to destroy evidence.

Question 22Tools & Programs⚑ Flag

An examiner at Valley Records Office imaged a file server and needs to hash thousands of files recursively with MD5 and SHA-256 at once. Later, she wants an audit that reports which files match, changed or are missing compared to her saved hash list. Which tool fits BEST?

Abulk_extractor Bdc3dd Chashdeep DExifTool

Correct answer: C. hashdeep
hashdeep computes several hash types recursively and has an audit mode that compares files against a known hash set and reports matches, changes, and missing or new files. dc3dd hashes data while imaging a device, but it does not audit individual files against a hash list.

Question 23Forensic Science⚑ Flag

A lab wants its evidence logs to show not only that a record is unchanged but also that it was produced by someone holding the lab's secret key. Which mechanism provides both properties?

AAn HMAC BA CRC-32 checksum CBase64 encoding DA plain SHA-256 hash

Correct answer: A. An HMAC
An HMAC combines a hash function with a secret key, so it verifies both integrity and the origin of the record. A plain SHA-256 hash shows integrity, but anyone can compute it, so it proves nothing about who created the record.

Question 24Digital Forensics⚑ Flag

An examiner at Holloway Aerospace has linked a USB drive serial number to a workstation. Next, the examiner needs to learn which drive letter Windows assigned to that device. Which registry key maps drive letters to volume identifiers?

ASOFTWARE\Microsoft\Windows Search\VolumeInfoCache BSYSTEM\MountedDevices CSYSTEM\CurrentControlSet\Control\DeviceClasses DSYSTEM\CurrentControlSet\Enum\USB

Correct answer: B. SYSTEM\MountedDevices
SYSTEM\MountedDevices holds values such as \DosDevices\E: whose data contains the device identifier, which can be matched to the USBSTOR entry. The Enum\USB key lists USB devices by vendor and product ID but does not map drive letters.

Question 25Digital Forensics⚑ Flag

An investigator at Hollins University knows the MAC address of a laptop used to send threats over the campus Wi-Fi. She now needs to determine which access point the laptop joined and at what times. Which source is the best fit?

AThe wireless controller's association logs BThe DHCP server's lease database for campus CThe wired switch MAC address table DThe firewall's NAT translation log

Correct answer: A. The wireless controller's association logs
Wireless controller or access point association logs record which client MAC joined which access point and when, which places the device physically. DHCP leases map MAC addresses to IP addresses but do not show the access point.

Question 26Digital Evidence⚑ Flag

A user at Corwin Engineering deleted a folder of contract drafts from a Windows 10 laptop and wiped the free space. The examiner still wants file names, paths and possibly some text from those documents. Which artifact is MOST promising?

AThe hosts file in System32\drivers\etc BThe pagefile settings in the SYSTEM hive CThe Windows Search index database, Windows.edb DThe Default.rdp file in the user's Documents folder

Correct answer: C. The Windows Search index database, Windows.edb
The Windows Search service keeps an index database (Windows.edb on Windows 10) with file names, paths, metadata and sometimes indexed text, and entries can remain after the files are deleted. The Default.rdp and hosts files hold connection settings and name mappings, not document content.

Question 27Regulations & Ethics⚑ Flag

A computer repair technician at a private shop finds suspected illegal images while fixing a customer's laptop and calls police. An officer arrives and wants to look at the laptop. What limit applies to the officer's warrantless review?

AThe officer may search the whole laptop, since the private search removed all privacy BThe officer may view what the technician already saw, but needs a warrant to go further CThe officer may not look at anything, because the technician's search itself was illegal DThe officer may search freely once the shop owner signs a consent form for the laptop

Correct answer: B. The officer may view what the technician already saw, but needs a warrant to go further
The Fourth Amendment does not apply to a purely private search, and police may generally repeat what the private party already did. Going beyond that scope, such as opening other folders, is a new government search that usually needs a warrant. The shop owner cannot consent on behalf of the customer's data.

Question 28Procedures & Methodology⚑ Flag

A retailer is forming an internal team to investigate a suspected data breach that could lead to lawsuits and regulator notice. Which role should be included at the start of the investigation?

AA marketing manager to prepare a public statement on day one BThe suspected employee's supervisor to lead all evidence collection CAn outside vendor to replace the affected systems right away DA legal advisor to guide authority, privilege and reporting duties

Correct answer: D. A legal advisor to guide authority, privilege and reporting duties
Legal counsel helps ensure the investigation has proper authority, protects privileged work and meets breach notification duties. Letting a possibly involved supervisor lead evidence collection creates conflicts of interest.

Question 29Digital Forensics⚑ Flag

During static analysis, an analyst finds that a malware sample's PE header compile timestamp shows a date in 1992, years before the APIs it imports existed. How should the analyst treat this value?

AAs likely forged and not reliable alone BAs proof the sample was written in 1992 CAs the date the file was copied to the host DAs the time the sample was last executed

Correct answer: A. As likely forged and not reliable alone
The TimeDateStamp field in the PE header is set at build time and can be altered or zeroed by the author or build tools. A date that conflicts with the imported APIs is a sign of tampering, and it never shows copy or execution time.

Question 30Forensic Science⚑ Flag

Responders at Larkspur Media arrive to find a running workstation with a mounted VeraCrypt volume and the user gone. Which action best preserves access to the encrypted data?

AShut down normally, then image the drive BPerform a live acquisition before shutdown CRemove the drive and image it in the lab DPull the power cord to freeze the system

Correct answer: B. Perform a live acquisition before shutdown
While the volume is mounted, its contents and keys are reachable, so capturing memory and the mounted volume live is often the only way to preserve access. Pulling the power drops the keys from memory and leaves only ciphertext on the disk.

Question 31Digital Evidence⚑ Flag

An examiner mounts an ext4 partition image on a Linux workstation using only the read-only option and later finds that the image's hash has changed. What is the MOST likely cause?

AThe kernel replayed the journal during the mount BRead-only mounts update access times by default CThe hash tool wrote a temporary lock file to it DLinux silently resized the ext4 partition on mount

Correct answer: A. The kernel replayed the journal during the mount
Mounting a dirty ext3 or ext4 file system read-only can still replay its journal and write to the device unless an option such as noload is used. Access times are not updated on a read-only mount.

Question 32Digital Forensics⚑ Flag

A Pinecrest Medical employee is suspected of browsing folders on an external drive that has since been destroyed. The investigator wants to show which folders the user opened, including on removable media that is no longer present. Which artifact is MOST suitable?

AThe Prefetch files for explorer.exe BThe MountPoints2 values in NTUSER.DAT CThe SRUM application usage tables DThe ShellBags stored in UsrClass.dat

Correct answer: D. The ShellBags stored in UsrClass.dat
ShellBags in UsrClass.dat record folders a user viewed in Explorer, including folders on removable or network drives that no longer exist. MountPoints2 shows volumes the user saw, but it does not list the folders opened on them.

Question 33Procedures & Methodology⚑ Flag

An analyst at Evergreen Forensics checks the hash of her working copy before analysis and finds it does not match the verified master image. What should she do?

ADiscard the copy, make a new one from the master and record why BRe-acquire the original drive since the evidence is now tainted CRecalculate with a different hash algorithm until the values match DContinue the analysis and note the mismatch in the final report

Correct answer: A. Discard the copy, make a new one from the master and record why
The master image is still verified, so a fresh working copy can be made from it and the issue documented. Re-acquiring the original is unnecessary because the problem is in the copy, not the evidence.

Question 34Tools & Programs⚑ Flag

An analyst at Ironwood Retail has extracted the $MFT file from an NTFS volume. She wants to convert it to a CSV that lists every file record with its $STANDARD_INFORMATION and $FILE_NAME timestamps so she can look for timestomping. Which tool should she use?

AExifTool BPECmd CMFTECmd DLECmd

Correct answer: C. MFTECmd
MFTECmd parses NTFS $MFT records into CSV or body file output, including both $STANDARD_INFORMATION and $FILE_NAME timestamps, which helps reveal timestamp manipulation. PECmd and LECmd parse prefetch and LNK files, not the master file table.

Question 35Regulations & Ethics⚑ Flag

An investigator at Northgate Industrial Supply finds that a fired sales manager used his old VPN credentials, which were never disabled, to download customer lists two weeks after termination. Which US federal law is MOST directly relevant to this access?

AThe Computer Fraud and Abuse Act BThe Federal Wiretap Act on interception CThe Fair Credit Reporting Act DThe Sarbanes-Oxley Act's record retention rules

Correct answer: A. The Computer Fraud and Abuse Act
The CFAA addresses accessing a protected computer without authorization or exceeding authorized access, and a terminated employee using leftover credentials is a classic example. The Wiretap Act covers intercepting communications in transit, which is not what happened here.

Question 36Digital Evidence⚑ Flag

A university forensics lab wants an acquisition format that is open and non-proprietary, supports compression and lets examiners add their own metadata fields. Which format fits BEST?

ARaw dd image with a separate hash file BEnCase Expert Witness Format CISO 9660 optical disc image DAdvanced Forensic Format (AFF)

Correct answer: D. Advanced Forensic Format (AFF)
AFF was created as an open, extensible format that supports compression and arbitrary metadata. The Expert Witness Format also stores metadata and compresses data, but it began as a proprietary format tied to a commercial vendor.

Question 37Digital Forensics⚑ Flag

An investigator at Dunmore Freight suspects an attacker created a scheduled task for persistence on a domain controller. Object access auditing for task changes was enabled. Which Security log event ID records the creation of a scheduled task?

AEvent ID 4688 BEvent ID 4698 CEvent ID 4720 DEvent ID 4776

Correct answer: B. Event ID 4698
Event ID 4698 records that a scheduled task was created and includes the task's XML details. Event 4688 records process creation, 4720 records a new user account and 4776 records NTLM credential validation.

Question 38Procedures & Methodology⚑ Flag

A lab manager is reviewing the evidence storage room. Which condition BEST supports long-term preservation of seized media?

AA room shared with office supplies to save floor space BA sunny room with windows that keep the air dry CA locked room with steady temperature and humidity DA basement room near the water heater to keep things warm

Correct answer: C. A locked room with steady temperature and humidity
Stable temperature and humidity in a secured room reduce the risk of media decay and corrosion. Areas near water heaters risk leaks and heat swings that can damage drives.

Question 39Forensic Science⚑ Flag

An analyst converts UTC event times from a New York server to local time using a fixed UTC-5 offset. Events from July all appear one hour off compared to witness statements. What caused the error?

AThe server stored times in FAT format BThe tool ignored daylight saving time CThe server clock lost one hour of drift DThe witnesses used a 24-hour clock

Correct answer: B. The tool ignored daylight saving time
New York observes daylight saving time, so summer local time is UTC-4, not UTC-5, and a fixed offset shifts summer events by one hour. Clock drift is usually gradual and irregular, so it would not create a clean one-hour error tied to the season.

Question 40Digital Forensics⚑ Flag

At Brennan Transport, a malicious program starts only when the user "jlopez" signs in, and not for other users of the same PC. In which location is a Run key entry MOST likely to be found?

AHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run in the SOFTWARE hive BHKLM\SYSTEM\CurrentControlSet\Services in the SYSTEM hive CHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce key DSoftware\Microsoft\Windows\CurrentVersion\Run in jlopez's NTUSER.DAT

Correct answer: D. Software\Microsoft\Windows\CurrentVersion\Run in jlopez's NTUSER.DAT
Run keys in a user's NTUSER.DAT only launch programs when that specific user logs on. The HKLM Run key in the SOFTWARE hive applies to every user, which does not match a program that starts for one account only.

Question 41Digital Evidence⚑ Flag

An employee at Halvern Bank claims he never opened a malicious invoice that arrived by email. The examiner finds a copy of invoice.xlsm under the user's INetCache\Content.Outlook folder. What does this location BEST indicate?

AA browser cached it during a web download BOutlook stored a copy when it was opened CThe user saved it to the desktop by hand DThe file arrived from a USB drive first

Correct answer: B. Outlook stored a copy when it was opened
Outlook copies an attachment into its secure temporary folder under Content.Outlook when the user opens or previews it, and copies can remain there afterward. A browser download would leave cache entries and a Zone.Identifier stream in different locations, not in the Outlook temp folder.

Question 42Tools & Programs⚑ Flag

An investigator at Summit Engineering finds a shortcut named Q3_Bids.xlsx.lnk in a user's Recent folder, but the spreadsheet itself is gone. Which information could LECmd MOST likely recover from the shortcut?

AThe number of times the spreadsheet application was launched BThe password that protected the spreadsheet when it was saved CThe target's original path, volume serial number and timestamps DThe full contents of the deleted spreadsheet's first worksheet

Correct answer: C. The target's original path, volume serial number and timestamps
LNK files record the target's path, size, timestamps, and details of the volume it was on such as serial number and drive type, and LECmd parses these fields. A shortcut never stores the target file's contents, and application run counts come from prefetch, not LNK files.

Question 43Procedures & Methodology⚑ Flag

An examiner's report on a data theft case will be read by the company's board members, most of whom have no technical background. Which approach is MOST appropriate?

AOpen with a plain-language summary and define technical terms BWrite only for technical readers since lawyers can explain it later CReplace exact findings with general statements that are easier to read DRemove all technical detail so the report is only one page

Correct answer: A. Open with a plain-language summary and define technical terms
A plain-language executive summary and definitions make the findings clear while the full technical detail remains for experts. Removing all detail would make the report impossible to verify or reproduce.

Question 44Forensic Science⚑ Flag

An examiner notices that every last modified time on a suspect's FAT32 memory card ends in an even number of seconds. What best explains this pattern?

ATimestamps were rounded by the write blocker BThe files were timestomped to hide activity CThe card was wiped and refilled by a tool DFAT records write times in 2-second units

Correct answer: D. FAT records write times in 2-second units
FAT file systems store the last modified time with 2-second resolution, so odd seconds never appear. A write blocker prevents changes to the media and does not alter how stored timestamps are displayed.

Question 45Digital Forensics⚑ Flag

An investigator at Sutter Vale Insurance wants a list of documents a user recently opened with Microsoft Word, grouped by the application that opened them. The files may have been opened from a network share. Which artifact fits BEST?

AThe AutomaticDestinations jump list files BThe $I files inside the user's Recycle Bin CThe WINWORD.EXE entry in the BAM key DThe Word entries in the Amcache.hve hive

Correct answer: A. The AutomaticDestinations jump list files
Jump lists in AutomaticDestinations are named by application ID and list files recently opened by that application, including network paths. BAM only records that Word ran and when, not which documents were opened.

Question 46Digital Forensics⚑ Flag

After analyzing one malware sample, an analyst at Kestrel Insurance has a unique mutex name and a distinctive byte sequence from its code. She wants to sweep files on 500 endpoints for other members of the same malware family. Which approach fits best?

AReview the firewall logs for blocked ports BCompare MD5 hashes of every file to the sample CWrite a YARA rule using those patterns DSearch each host's Prefetch for the file name

Correct answer: C. Write a YARA rule using those patterns
YARA rules match on strings and byte patterns, so they can find related variants even when their hashes differ. An MD5 comparison only finds exact copies of the one sample, missing recompiled or slightly changed variants.

Question 47Regulations & Ethics⚑ Flag

A hospital hires Clearpath Forensics to investigate a compromised file server that holds patient records. Before the examiner starts imaging, the hospital's compliance officer raises a concern. What arrangement is MOST important to have in place?

AWritten permission from the state medical board to access the patient records BA signed waiver from each patient releasing the firm from HIPAA privacy rules CA nondisclosure agreement signed by each patient whose records are on the server DA business associate agreement covering how the firm protects health information

Correct answer: D. A business associate agreement covering how the firm protects health information
A vendor that handles protected health information on behalf of a covered entity is generally a business associate under HIPAA and needs a business associate agreement. The agreement limits use of the data and requires safeguards. Patient-by-patient NDAs or waivers are not how HIPAA handles service providers.

Question 48Digital Evidence⚑ Flag

An acquisition tool produced a raw image of a 500 GB drive as segments named case.001 through case.250, with one MD5 value recorded for the source drive. How should the examiner verify the image against that value?

AHash only the first and the last segments BHash the largest segment and compare it CHash each segment and add the values together DHash all segments as one stream in sequence

Correct answer: D. Hash all segments as one stream in sequence
Split segments are pieces of one continuous byte stream, so they must be hashed together in order to match the source hash. Adding separate segment hashes has no mathematical meaning and cannot match the drive value.

Question 49Procedures & Methodology⚑ Flag

During an examination, an analyst could not access an encrypted container on the suspect's drive. The rest of the drive was fully analyzed. How should this be handled in the report?

AMention it only if opposing counsel asks about it during testimony BState the limitation clearly and explain how it affects conclusions CLeave it out since no findings came from the encrypted container DAssume the container held no relevant data and state that it was empty

Correct answer: B. State the limitation clearly and explain how it affects conclusions
Reports should state limitations openly so readers know what was not examined and how that affects the conclusions. Leaving it out could mislead readers into thinking the drive was fully reviewed.

Question 50Tools & Programs⚑ Flag

A forensic accountant at Ashford Partners wants to pull USB device history, recent documents and user activity from exported registry hives quickly. She prefers a tool that runs a set of plugins against each hive and writes a plain text report. Which tool fits BEST?

ARegistry Editor BPECmd CRegRipper DAutoruns

Correct answer: C. RegRipper
RegRipper runs plugins against offline hives such as NTUSER.DAT, SYSTEM and SOFTWARE and outputs a text report of key artifacts. Windows Registry Editor is built to view and change the live registry, not to produce forensic reports from exported hives.

Question 51Forensic Science⚑ Flag

A suspect's workstation clock was found running about 7 minutes fast. Its email traffic passed through a corporate mail server synced to NTP. How should the examiner handle the time difference?

AAssume the offset was zero before the seizure BReset the workstation clock to the correct time CExclude all workstation timestamps from the report DDocument the offset and check server logs

Correct answer: D. Document the offset and check server logs
Examiners record the observed offset and corroborate it with independent sources, such as NTP-synced server logs, then adjust their analysis. Resetting the suspect's clock alters the evidence and destroys the record of the original drift.

Question 52Digital Forensics⚑ Flag

An analyst detonated a sample in a sandbox for five minutes and saw no network traffic, file writes or registry changes. Static review shows calls that query BIOS strings and a long sleep routine at startup. What is the best interpretation?

AThe sample is harmless and can be closed BThe sandbox network adapter has failed CThe sample may be evading the sandbox DThe file is a damaged office document

Correct answer: C. The sample may be evading the sandbox
Checks for virtual machine artifacts and long sleeps are common ways malware avoids revealing behavior in analysis environments. A quiet sandbox run with these traits calls for deeper static work or a modified sandbox, not a verdict of harmless.

Question 53Digital Forensics⚑ Flag

Attackers at Fallon Ridge used a compromised jump server to open Remote Desktop sessions to several file servers. The investigator wants image fragments showing what appeared on screen during those sessions. Which artifact on the jump server is MOST useful?

AThe Terminal Server Client\Servers registry key BThe RDP bitmap cache in the user's AppData CThe thumbcache files in the Explorer folder DThe Default.rdp file in the user's Documents

Correct answer: B. The RDP bitmap cache in the user's AppData
The Remote Desktop client caches screen tiles in bcache*.bmc or Cache*.bin files under AppData\Local\Microsoft\Terminal Server Client\Cache, and those tiles can be rebuilt to show parts of the remote screens. The Servers registry key lists hosts the user connected to but shows nothing about what was displayed.

Question 54Digital Evidence⚑ Flag

A responder captures 32 GB of RAM from a running server and computes a SHA-256 hash of the dump file. What does this hash prove?

AThat the capture tool did not alter memory at all BThat the dump matches live memory at any later time CThat the dump has not changed since it was hashed DThat no malware was running during the capture

Correct answer: C. That the dump has not changed since it was hashed
Memory keeps changing during and after capture, so there is no fixed source to compare against. The hash only proves the dump file stays unchanged from that point on, and the capture tool itself alters memory slightly.

Question 55Procedures & Methodology⚑ Flag

A defense expert wants to check a prosecution examiner's findings by repeating the analysis. Which documentation BEST allows the work to be reproduced?

ATool names and versions, settings, steps and image hashes BA copy of the final report without the supporting notes CA statement that industry standard methods were followed DThe examiner's resume and list of professional certifications

Correct answer: A. Tool names and versions, settings, steps and image hashes
Recording tools, versions, settings, steps and hashes lets another qualified examiner repeat the work and reach the same results. A general claim that standards were followed gives no way to test the work.

Question 56Regulations & Ethics⚑ Flag

An investigator confirms that attackers stole customer personal data from a German online retailer's database, creating a risk to those customers. Under the GDPR, what is the general deadline for the retailer to notify the supervisory authority?

AWithin 30 days, once the full forensic report has been finalized BWithin 72 hours of becoming aware of the breach, where feasible CWithin 7 business days, counted from the attacker's first access DOnly after every affected customer has been contacted by mail

Correct answer: B. Within 72 hours of becoming aware of the breach, where feasible
The GDPR requires controllers to notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach. Waiting for a final forensic report is not required, since information can be provided in phases.

Question 57Forensic Science⚑ Flag

At Ashford Credit Union, every file in one folder has creation and modified times with sub-second values of exactly .0000000. Files elsewhere on the volume show varied sub-second values. What does this suggest?

AThe timestamps were likely set by a tool BNTFS records only whole seconds for folders CThe files were compressed by Windows DThe folder was restored from a FAT32 backup

Correct answer: A. The timestamps were likely set by a tool
NTFS stores times in 100-nanosecond units, so natural activity produces varied fractions, and a block of zeroed values often points to timestomping tools. NTFS does not limit folders to whole seconds, so that explanation does not fit.

Question 58Digital Forensics⚑ Flag

A domain controller at Ridgeway Telecom shows more than 3,000 Security event 4625 entries in ten minutes, all with Logon Type 3 and the same source IP, and each for a different user name. What activity does this pattern MOST likely show?

AFailed batch logons from a broken scheduled task BNormal Kerberos ticket renewals from a file server CPassword spraying or guessing over the network DRepeated workstation unlock attempts by one person

Correct answer: C. Password spraying or guessing over the network
Event 4625 marks failed logons, and type 3 is a network logon, so many failures across many user names from one source points to password spraying or guessing. A failing scheduled task would show batch logon type 4 for a single account.

Question 59Digital Forensics⚑ Flag

In the web logs of Orchard Bank, an investigator sees GET requests to /search with a q parameter containing %3Cscript%3E followed by encoded JavaScript that reads document.cookie. What attack were these requests most likely attempting?

ASQL injection against the search database BDirectory traversal to read system files CA denial of service against the web server DCross-site scripting against site users

Correct answer: D. Cross-site scripting against site users
%3Cscript%3E decodes to a script tag, and code that reads document.cookie is typical of cross-site scripting meant to steal session cookies. SQL injection traces show query syntax such as quotes, UNION or OR 1=1 rather than script tags.

Question 60Digital Evidence⚑ Flag

A seized laptop drive makes a repeated clicking sound and is not detected by the forensic workstation. The case depends on its contents. What is the MOST appropriate next step?

AKeep power cycling it until the workstation detects it BOpen the drive on the lab bench to reseat the heads CFreeze the drive overnight and then try imaging again DSend it to a clean room recovery lab, documenting why

Correct answer: D. Send it to a clean room recovery lab, documenting why
Clicking usually signals a mechanical failure, and repairs such as head swaps need a clean room to keep dust off the platters. Repeated power cycling can scrape the platters and destroy the data for good.

Question 61Procedures & Methodology⚑ Flag

What BEST describes a deposition in a civil case involving digital evidence?

ASworn testimony given outside court and recorded for later use BAn informal interview that cannot be used later in the trial CA written report filed by the expert directly with the judge DA closed hearing where only the judge may question the witness

Correct answer: A. Sworn testimony given outside court and recorded for later use
A deposition is sworn, out-of-court testimony recorded by a court reporter, and it can be used later at trial, including to challenge inconsistent statements. Treating it as informal is a common and costly mistake.

Question 62Tools & Programs⚑ Flag

A camera's SD card from a hit-and-run case at Easton Police was quick-formatted, and the file system no longer lists any photos. The examiner wants a free tool that ignores the file system and recovers JPEG files by their signatures. Which tool is BEST?

AExifTool BPhotoRec CMFTECmd DHxD

Correct answer: B. PhotoRec
PhotoRec is a free file carver that scans raw data for known file signatures and recovers files even when the file system is damaged or reformatted. ExifTool reads metadata from files that still exist, so it cannot recover photos the file system no longer lists.

Question 63Digital Evidence⚑ Flag

A seized drive's label reads Advanced Format 512e. What does this mean for the examiner?

A512-byte physical sectors grouped into 4,096-byte clusters B512 bytes of error correction stored for every 4 KB sector CAn SSD design that erases NAND in 512-byte blocks at a time D4,096-byte physical sectors shown to the host as 512-byte ones

Correct answer: D. 4,096-byte physical sectors shown to the host as 512-byte ones
512e drives store data in 4 KB physical sectors but emulate 512-byte logical sectors for compatibility, which matters when calculating offsets. Grouping sectors into clusters is a file system choice, not a drive format.

Question 64Regulations & Ethics⚑ Flag

A US-based company plans to deploy endpoint monitoring software on all employee computers, including at its subsidiary in Germany. The investigator leading the rollout learns the German office has a works council. What should be done BEFORE monitoring starts there?

AGet each employee's verbal agreement, which removes any need for works council input BApply the US policy as written, because the parent company's rules govern all subsidiaries CInvolve the works council, since it usually has co-determination rights over monitoring DStart monitoring quietly and inform the works council only if an incident is found

Correct answer: C. Involve the works council, since it usually has co-determination rights over monitoring
In Germany, works councils generally have co-determination rights over technical systems that can monitor employee behavior or performance. Deploying such tools without that involvement can make the monitoring unlawful and the evidence hard to use. A US parent company policy does not override local labor law.

Question 65Digital Forensics⚑ Flag

A web application firewall at Tidewater Clinic logged a blocked SQL injection attempt at 02:14 from a single IP. The investigator must confirm the request never reached the application. What should she check?

AThe DNS logs for the clinic's domain BThe web server access log for that IP and time CThe domain registrar's WHOIS record for the IP DThe WAF vendor's public threat feed

Correct answer: B. The web server access log for that IP and time
If the WAF blocked the request, the backend web server log should show no matching entry for that IP and time, or only the WAF's block response. Threat feeds and WHOIS describe the source but cannot show whether the request reached the application.

Question 66Digital Forensics⚑ Flag

An analyst at Orchard Lane Hospital needs to see the full command line of an encoded PowerShell command launched on a server. The audit policy for process creation is enabled, with command line logging turned on. Which Security event ID should the analyst search?

A4672 B4648 C4688 D4663

Correct answer: C. 4688
Event 4688 records process creation, and when command line auditing is enabled it includes the full command line. Event 4672 records special privileges assigned to a new logon and does not show process command lines.

Question 67Forensic Science⚑ Flag

Unallocated space on most of a drive holds fragments of old documents, but one large contiguous region contains nothing except the repeating byte 0x00. What should the examiner consider?

AThe region was likely wiped by a tool BThe region holds an encrypted container CThe disk firmware stores spare sectors there DThe region is normal NTFS metadata padding

Correct answer: A. The region was likely wiped by a tool
Uniform zeros or repeating patterns across a large region surrounded by residual data suggest deliberate overwriting, so the examiner should look for wiper traces. An encrypted container would look random with high entropy, not like a long run of identical bytes.

Question 68Procedures & Methodology⚑ Flag

An expert testifying about disk forensics is asked by counsel to give an opinion on the psychological state of the suspect when the files were deleted. What should the expert do?

AGive an opinion based on the timing of the deletions BDecline because the question is outside her area of expertise CAnswer briefly and confidently so the jury is not left with doubts DAsk the judge for a short recess to research the topic

Correct answer: B. Decline because the question is outside her area of expertise
Experts must stay within the field they are qualified in, and psychology is outside disk forensics. Offering opinions beyond one's expertise can lead to exclusion of testimony and harm credibility.

Question 69Digital Evidence⚑ Flag

A drive uses 512-byte sectors and 4,096-byte clusters. A 1,300-byte file occupies part of one cluster. How large are the RAM slack and the drive slack?

A236 bytes of RAM slack and 2,560 bytes of drive slack B2,796 bytes of RAM slack and no drive slack at all C236 bytes of RAM slack and 2,796 bytes of drive slack D512 bytes of RAM slack and 2,284 bytes of drive slack

Correct answer: A. 236 bytes of RAM slack and 2,560 bytes of drive slack
The file ends inside its third sector, which ends at byte 1,536, so RAM slack is 236 bytes and the five unused sectors form 2,560 bytes of drive slack. The 2,796 figure is the total file slack, not the drive slack alone.

Question 70Tools & Programs⚑ Flag

After a breach at Ostler Manufacturing, an analyst has EVTX files from 25 servers. She wants a fast command-line tool that hunts through them with Sigma detection rules and flags suspicious events. Which tool BEST fits?

APhotoRec Bbulk_extractor CChainsaw DRegRipper

Correct answer: C. Chainsaw
Chainsaw is built to search Windows event logs quickly and apply Sigma rules to flag suspicious activity across many EVTX files. RegRipper parses registry hives, so it does not hunt through event logs.

Question 71Digital Forensics⚑ Flag

An investigator reviews access logs for Bellfield Online. One IP made hundreds of requests to paths like /old, /backup and /db.sql, nearly all returning 404. One request for /site-backup.zip returned 200 with a response size of 480 MB. Which entry matters most?

AThe first 404 in the sequence BThe 200 for /site-backup.zip CThe 404 for /db.sql DThe final 404 in the sequence

Correct answer: B. The 200 for /site-backup.zip
The 404s show directory guessing that failed, but the 200 with a large response size means a backup archive was likely downloaded. That entry points to probable data exposure and should drive the next steps.

Question 72Forensic Science⚑ Flag

A steganalysis tool flags a bitmap because the counts of pixel values that differ only in the least significant bit are nearly equal. Which detection technique produces this finding?

AFile signature analysis BFuzzy hash comparison CError level analysis DChi-square analysis

Correct answer: D. Chi-square analysis
Chi-square steganalysis detects LSB embedding, which tends to equalize the frequencies of value pairs that differ only in the lowest bit. Error level analysis looks at JPEG recompression differences and is not designed to measure LSB pair statistics.

Question 73Digital Forensics⚑ Flag

An investigator at Vantage Realty receives a laptop that was hibernated before it was seized. No live memory capture is possible. Which file offers the BEST chance of recovering a structured snapshot of RAM from before hibernation?

AC:\hiberfil.sys BC:\swapfile.sys CC:\Windows\MEMORY.DMP DC:\pagefile.sys

Correct answer: A. C:\hiberfil.sys
When Windows hibernates, it writes a compressed copy of RAM to hiberfil.sys, which tools can convert into an image for memory analysis. The pagefile holds only scattered memory pages that were swapped out, not a complete snapshot.

Question 74Procedures & Methodology⚑ Flag

Under the Daubert standard, who acts as the gatekeeper deciding whether expert testimony is reliable enough to be heard?

AThe jury foreman BThe trial judge CThe opposing expert DThe court clerk

Correct answer: B. The trial judge
Daubert makes the trial judge the gatekeeper who decides whether expert testimony rests on reliable methods before the jury hears it. The jury weighs admitted testimony but does not rule on its admissibility.

Question 75Regulations & Ethics⚑ Flag

A US federal agency investigating a fraud ring needs server logs held by a small hosting company that operates only in another country and has no US presence. The foreign company ignores informal requests. What is the usual formal route?

AAn administrative demand sent straight to the company's server administrator BRemote access to the server to copy the logs without notifying anyone abroad CA US grand jury subpoena served on the foreign company by email DA request under a Mutual Legal Assistance Treaty between the countries

Correct answer: D. A request under a Mutual Legal Assistance Treaty between the countries
Mutual Legal Assistance Treaties let one country formally ask another to gather and share evidence under its own laws. They are slow, but they are the standard channel when a provider is outside US jurisdiction. Reaching into a foreign server without authorization can violate that country's laws and taint the evidence.

Question 76Digital Evidence⚑ Flag

A suspect claims he destroyed a document on his SSD by overwriting the file in place with random data. Which statement BEST reflects how wear leveling affects this claim?

AWear leveling encrypts old pages so they are unreadable BThe SSD moves old pages into the HPA for safekeeping CThe overwrite replaced the original NAND pages exactly DOld pages may survive in NAND the host cannot address

Correct answer: D. Old pages may survive in NAND the host cannot address
Wear leveling writes new data to fresh pages and remaps the logical address, so the old pages may persist in NAND until erased. They are not reachable through the normal interface and usually require chip-off or other specialist methods.

Question 77Procedures & Methodology⚑ Flag

A corporate investigator has referred an embezzlement case to police. A detective then asks him to log in remotely to the suspect's home computer and copy files, since the company can act faster than a warrant. What should the investigator do?

ADecline, since acting for police can make it a government search BCopy only the files that hold obvious evidence to limit the intrusion CDo it but leave the detective's request out of the case notes DDo it quickly since a private party does not need a warrant

Correct answer: A. Decline, since acting for police can make it a government search
A private party who searches at the direction of law enforcement can be treated as a government agent, so Fourth Amendment warrant rules apply. Accessing the home computer without authority could also be a crime and would likely make the evidence inadmissible.

Question 78Forensic Science⚑ Flag

A JPEG on a suspect's drive opens normally, but a hex view shows large amounts of data after the FF D9 marker. What does this indicate?

AThe image uses progressive JPEG encoding BThe file system cluster size was too large CData was appended after the end-of-image marker DThe EXIF header was corrupted during transfer

Correct answer: C. Data was appended after the end-of-image marker
FF D9 is the JPEG end-of-image marker, so viewers ignore anything after it, which makes trailing data a sign of hidden content. Progressive encoding changes how scans are stored inside the image but does not place data after the end marker.

Question 79Digital Forensics⚑ Flag

An examiner has a dead-box image of a suspect's Windows laptop and wants evidence that Tor Browser was actually run, since Tor Browser keeps no history by default. Which artifacts are most useful?

APrefetch files and the Tor Browser install folder BThe print spooler folder for queued jobs CThe .onion browsing history in places.sqlite DThe Windows Update log on the system drive

Correct answer: A. Prefetch files and the Tor Browser install folder
Prefetch entries can show that the browser executable ran, with run counts and times, while the install folder shows where it lived and when it was added. Tor Browser runs in a private mode, so places.sqlite does not keep .onion history.

Question 80Digital Forensics⚑ Flag

Which NTFS metadata file acts as a transaction log of metadata changes, so the file system can be brought back to a consistent state after a crash?

A$Bitmap B$LogFile C$Extend\$Quota D$Volume

Correct answer: B. $LogFile
$LogFile records NTFS metadata transactions so the file system can redo or undo changes after a crash, and it can show very recent file activity. $Bitmap only tracks which clusters are in use.

Question 81Tools & Programs⚑ Flag

An analyst at Redfield College is reviewing a capture in Wireshark and wants to see only HTTP requests in which a client submitted form data to a web server. Which display filter fits BEST?

Ahttp.response.code == 200 Bhttp.request.method == "POST" Ctcp.port == 80 Dhttp.request.uri contains "login"

Correct answer: B. http.request.method == "POST"
Form submissions are normally sent with the HTTP POST method, and this filter shows only requests that use it. A filter on a URI containing login would catch some login pages, but it would also show GET requests and miss forms posted to other paths.

Question 82Digital Evidence⚑ Flag

A server seized from a small accounting firm used a four-disk RAID 5 array, but only three of the disks were recovered. What can the examiner expect?

AOnly parity blocks can be read, not the user data BThe volume cannot be rebuilt without all four disks CThe volume can be rebuilt from the three using parity DOnly one quarter of the files will be recoverable

Correct answer: C. The volume can be rebuilt from the three using parity
RAID 5 distributes parity so the array survives the loss of any one disk, and the missing data can be computed with XOR. Losing one member of a RAID 0 set would ruin the volume, but RAID 5 is built to tolerate it.

Question 83Procedures & Methodology⚑ Flag

During an internal HR investigation, a department head emails the investigator asking for preliminary findings so he can share them with his whole team. What is the MOST appropriate response?

ASend the findings since the department head is a senior manager BLimit sharing to those with a need to know, through HR or counsel CPost a summary on the company intranet to stop rumors from spreading DSend a partial summary that leaves out the employee's name only

Correct answer: B. Limit sharing to those with a need to know, through HR or counsel
Internal investigations should share information only with people who need it, usually through HR or legal, to protect fairness, privacy and privilege. Wider sharing can harm the employee's rights and expose the company to claims.

Question 84Regulations & Ethics⚑ Flag

An attorney who hired examiner Ben Okafor asks him to change his report to say a USB device was 'definitely' used by the opposing party, though the artifacts only show it was connected to a shared computer. The attorney hints that future work depends on it. What should Ben do?

AAdd the stronger wording in a footnote so the main finding stays intact BRemove the USB finding entirely so the report does not hurt the client CChange the wording, since the paying client controls what the report says DKeep the conclusion the evidence supports and decline to change it

Correct answer: D. Keep the conclusion the evidence supports and decline to change it
Examiners must keep their conclusions tied to what the evidence supports, regardless of who pays. Overstating a finding to please a client is unethical and can be exposed on cross-examination, damaging the examiner's credibility. The client may decide whether to use the report, but not what it concludes.

Question 85Forensic Science⚑ Flag

An analyst at Bellmont University reviews exported Security events and sees the EventRecordID jump from 58,210 to 61,904 within one minute. Log retention settings were not reached. What does this most likely indicate?

ARecords were removed or the log was altered BThe audit policy was set to success only CThe system was rebooted during that minute DNormal rotation of the Security log

Correct answer: A. Records were removed or the log was altered
EventRecordID values increase sequentially, so a large unexplained gap without retention overwrite suggests records were removed or the log was tampered with. A reboot does not reset or skip record numbers in this way.

Question 86Digital Forensics⚑ Flag

Investigators at Wexford Biotech believe a compromised EC2 instance connected to an outside IP address on port 4444 overnight. They want to confirm the connections and their byte counts. Which AWS log source is the best fit?

AS3 server access logs BAWS Config history CVPC Flow Logs DCloudTrail management events

Correct answer: C. VPC Flow Logs
VPC Flow Logs record IP traffic to and from network interfaces, including addresses, ports, byte counts and accept or reject status. CloudTrail records API calls made to AWS services, not the instance's network connections.

Question 87Digital Forensics⚑ Flag

An employee at Ellery Partners used a secure delete tool to wipe a contract file last week. System Protection is enabled on the C: drive, and restore points were created daily. Where is the investigator MOST likely to recover an earlier version of the file?

AIn a Volume Shadow Copy snapshot BIn the $UsnJrnl:$J change journal CIn the $I file in the Recycle Bin DIn the user's Prefetch folder

Correct answer: A. In a Volume Shadow Copy snapshot
Volume Shadow Copies keep block-level snapshots of the volume, so a version of the file from before the wipe may still exist in an older snapshot. The USN journal records that changes happened but does not keep file content.

Question 88Digital Evidence⚑ Flag

An examiner receives both disks from a workstation's two-disk RAID 1 mirror. Time is short, and only one disk can be analyzed today. Which statement is MOST accurate?

ANeither disk is readable without the RAID controller BEach disk holds alternating stripes of every file CThe disks must be combined to reconstruct parity DEither disk should hold a full copy of the volume

Correct answer: D. Either disk should hold a full copy of the volume
RAID 1 writes identical data to each member, so one disk image normally holds the whole volume, though both should still be imaged and compared. Alternating stripes describe RAID 0, not a mirror.

Question 89Tools & Programs⚑ Flag

A memory analyst at Harborview Clinic suspects that malware injected code into a legitimate explorer.exe process. She wants Volatility to flag memory regions that are executable and writable but not backed by a file on disk. Which plugin should she use?

Awindows.malfind Bwindows.cmdline Cwindows.dlllist Dwindows.filescan

Correct answer: A. windows.malfind
windows.malfind looks for process memory regions with suspicious protections, such as executable and writable pages with no mapped file, which is typical of injected code. windows.dlllist shows modules loaded through the normal loader, so injected code that never registered as a DLL would not appear there.

Question 90Procedures & Methodology⚑ Flag

While building a timeline, an investigator at Northgate Energy finds that firewall, server and badge reader logs disagree by several minutes for the same events. Which forensic readiness measure would have BEST prevented this?

AEncrypting all log files with a single company key BStoring all logs on each system's local disk only CSynchronizing all system clocks to a trusted time source DIncreasing the log file size limit on every network device

Correct answer: C. Synchronizing all system clocks to a trusted time source
Synchronizing clocks with a trusted source such as NTP keeps timestamps consistent across systems, which makes event correlation reliable. Larger log files keep more history but do nothing about clock drift.

Question 91Digital Evidence⚑ Flag

An MBR-partitioned disk image shows six separate volumes, yet the MBR has only four partition table entries. How is this possible?

AThe MBR stores two extra entries in its boot code area BEach entry can describe up to two primary partitions CWindows hides the extra volumes in a protective MBR DOne entry is an extended partition with logical drives

Correct answer: D. One entry is an extended partition with logical drives
An extended partition uses one MBR entry and contains a chain of extended boot records, each defining a logical drive. The protective MBR is a GPT feature and plays no role in MBR layouts.

Question 92Forensic Science⚑ Flag

An examiner finds fragments of a deleted contract in the space between the end of a small text file and the end of its last cluster. Where was this data recovered from?

AThe Host Protected Area BAn alternate data stream CThe Master File Table DFile slack space

Correct answer: D. File slack space
File slack is the unused space between a file's logical end and the end of its last allocated cluster, and it can hold remnants of earlier data. An alternate data stream is a named attribute attached to a file, not leftover space inside a cluster.

Question 93Digital Forensics⚑ Flag

An S3 bucket at Cobalt Media was briefly made public, and the team needs to know which objects outside parties downloaded. CloudTrail is configured for management events only, with no data events. Which source should the investigator use?

AIAM credential report BS3 server access logs for the bucket CCloudTrail management events for the account DVPC Flow Logs for the account

Correct answer: B. S3 server access logs for the bucket
S3 server access logs record individual requests such as GET Object, with requester, object key and time. CloudTrail management events cover bucket-level configuration calls, so object reads are missing unless data events were enabled.

Question 94Digital Forensics⚑ Flag

On a compromised Linux server at Brookhaven Labs, the investigator finds that root's .bash_history is a symbolic link pointing to /dev/null. What is the MOST reasonable conclusion?

ABash has rotated the history file because it was too large BThe root account has never opened an interactive shell CSomeone deliberately stopped command history from being saved DThe shell is set to save history only in system memory

Correct answer: C. Someone deliberately stopped command history from being saved
Linking .bash_history to /dev/null discards all history writes, which is a common anti-forensics step to hide commands. Bash does not rotate history files this way, so the link points to deliberate tampering rather than normal behavior.

Question 95Regulations & Ethics⚑ Flag

Examiner Aisha, who works mostly on Windows laptops, is asked to extract and interpret data from a vehicle's infotainment system for an accident case. She has never worked on vehicle systems. What is the MOST appropriate response?

AAccept the work and learn the system as she goes without telling the client BDisclose her limited experience and get training or bring in a qualified expert CUse her usual Windows tools, since all storage devices work the same way DAccept the work but avoid testifying, so her inexperience never comes up in court

Correct answer: B. Disclose her limited experience and get training or bring in a qualified expert
Examiners should work only within their competence, which means being honest about limits and getting proper training, validated tools or a qualified colleague. Learning on live evidence without disclosure risks damaging data and producing unreliable findings.

Question 96Procedures & Methodology⚑ Flag

An examiner has already extracted and filtered the relevant files, logs and registry data from a set of verified images. She now correlates those items into a timeline to decide whether an employee took client files. Under NIST SP 800-86, which phase is she in?

ACollection BExamination CAnalysis DReporting

Correct answer: C. Analysis
NIST SP 800-86 describes collection, examination, analysis and reporting, and the analysis phase interprets the extracted data to answer the questions behind the case. Examination comes before it and covers processing the collected data to pull out what is relevant, without drawing conclusions.

Question 97Digital Evidence⚑ Flag

In a hex view of sector 0, an examiner sees a single MBR partition entry of type 0xEE spanning the entire disk and no other entries. What does this indicate?

AThe disk holds a single Linux swap partition BThe disk uses GPT behind a protective MBR CThe disk holds one hidden FAT32 partition DThe MBR was wiped by an anti-forensics tool

Correct answer: B. The disk uses GPT behind a protective MBR
Type 0xEE marks a protective MBR, which tells legacy tools the disk is in use and that the real layout is in the GPT that follows. Linux swap uses type 0x82 in an MBR table.

Question 98Tools & Programs⚑ Flag

A responder at Sterling Media must capture the memory of a running Windows 11 laptop before seizing it. She wants a free, simple tool that runs from a USB drive with a small footprint and saves a raw memory image. Which tool is BEST suited?

APECmd BLiME CMagnet RAM Capture DVolatility 3 framework

Correct answer: C. Magnet RAM Capture
Magnet RAM Capture is a free Windows tool that acquires physical memory from a live system and saves it for analysis in tools such as Volatility. Volatility analyzes memory images but does not acquire them, and LiME is built for Linux and Android.

Question 99Forensic Science⚑ Flag

In a dispute at Tamsin Partners, both sides argue over who last edited a .docx contract. The examiner wants the name that Microsoft Word recorded inside the file for the last person who saved it. Where should she look?

AThe cp:lastModifiedBy element in docProps/core.xml BThe NTFS owner recorded in the file's security data CThe dc:creator element in docProps/core.xml DThe Zone.Identifier stream attached to the file

Correct answer: A. The cp:lastModifiedBy element in docProps/core.xml
A .docx is a ZIP package, and its docProps/core.xml part stores cp:lastModifiedBy, which Word fills with the user name configured in Office when the file is saved. The dc:creator element shows the original author, and since the Office user name can be changed, either value should be corroborated.

Question 100Digital Forensics⚑ Flag

An investigator at Coldwater Analytics reboots a CentOS virtual machine by mistake before collecting logs. Afterward, journalctl shows no entries from before the reboot. What is the MOST likely reason?

AThe system rotated /var/log/messages during boot Bjournalctl hides entries from earlier boot sessions Cjournald only keeps entries for one hour by default DThe journal was stored in volatile /run/log/journal

Correct answer: D. The journal was stored in volatile /run/log/journal
When persistent storage is not set up, journald keeps its logs in /run/log/journal, which lives in memory and is lost at reboot. With persistent storage in /var/log/journal, earlier boots stay available through options such as journalctl -b -1.

Question 101Digital Forensics⚑ Flag

A Microsoft 365 tenant at Linden Partners shows that an executive's mailbox has been auto-forwarding mail to an outside address. The investigator needs to know who created the inbox rule and when. Which log should she search?

AThe Microsoft 365 unified audit log BThe Windows Security log on her laptop CThe Exchange message trace for one day DThe Azure Activity Log

Correct answer: A. The Microsoft 365 unified audit log
The unified audit log records Exchange Online actions such as New-InboxRule and Set-InboxRule, with the user, time and source IP. The Azure Activity Log covers Azure resource management at the subscription level, not mailbox rule changes.

Question 102Procedures & Methodology⚑ Flag

Two different carving tools give different counts of recovered JPEG files from the same image in a child custody case. The examiner must report the number of recovered photos. What should the examiner do?

AAverage the two numbers and note that both tools were used BReport the higher number because it captures more evidence CInvestigate why the results differ and confirm the true count DReport the lower number since it is the more cautious estimate

Correct answer: C. Investigate why the results differ and confirm the true count
Dual-tool verification is meant to catch errors, so a difference must be explained by checking the data, for example by reviewing the files each tool found. Picking either number without understanding the cause could put a wrong figure in court.

Question 103Digital Evidence⚑ Flag

A suspect zeroed the partition table on a disk that held one NTFS volume. The examiner wants to find where the volume starts. Which search is MOST useful?

AScan every sector for the 0x55AA signature by itself BScan the first megabyte for FF D8 FF headers CScan the last sector for the $Bitmap file name DScan for NTFS boot sectors by their OEM ID string

Correct answer: D. Scan for NTFS boot sectors by their OEM ID string
An NTFS boot sector carries the OEM ID NTFS at offset 3, and a backup copy sits at the end of the volume, so finding them reveals the volume's location and size. The 0x55AA signature alone appears in many boot records and would produce many false hits.

Question 104Regulations & Ethics⚑ Flag

Examiner Hugo Marsh wants to present a case study at a forensics conference using screenshots from a recent corporate fraud investigation. The client did not discuss publication when hiring him. What should he do?

APresent it but blur only the company logo that appears on each screenshot BPresent it, since sharing knowledge with peers outweighs client confidentiality CPresent it as is, because the case has already concluded and the file is closed DGet the client's permission and remove details that could identify anyone

Correct answer: D. Get the client's permission and remove details that could identify anyone
Examiners owe clients confidentiality, and case material should not be shared without permission. Even with permission, details that identify people or the organization should be removed. A closed case is still confidential.

Question 105Forensic Science⚑ Flag

Files on servers at Kirkwood Dental were renamed with a new extension, and each folder holds a text note with a unique victim ID and a contact email. What is the MOST useful way for the investigator to use the note at this stage?

ADelete the notes so staff stop seeing them BIdentify which ransomware family it fits CTreat the victim ID as the attacker's name DEmail the address to ask what was taken

Correct answer: B. Identify which ransomware family it fits
The note's wording, the file extension and the ID format help identify the ransomware family, which points to known behavior, likely entry methods and any public decryptor. Contacting the attackers is a decision for leadership and counsel, and deleting the notes destroys evidence.

Question 106Digital Forensics⚑ Flag

An investigator downloads CloudTrail log files from an AWS account as evidence in a fraud case. What should she do to best support chain of custody for this cloud evidence?

AStore the files only in the same account BHash them and record the source, time and account used CRename the files to match the case number and folder DEdit the logs to remove unrelated entries

Correct answer: B. Hash them and record the source, time and account used
Hashing the files right after collection and documenting where, when and by whom they were obtained lets others verify the evidence was not altered. Editing or keeping files only in the same account allows changes and breaks the integrity of the record.

Question 107Digital Forensics⚑ Flag

On ext4 and similar Linux file systems, which piece of information is NOT stored in a file's inode?

AThe pointers or extents to data blocks BThe owner UID and permission bits CThe access, modify and change timestamps DThe name of the file

Correct answer: D. The name of the file
File names are stored in directory entries, which map names to inode numbers, and this is why one inode can have several hard links. The inode itself holds metadata such as owner, permissions, timestamps and the location of data blocks.

Question 108Procedures & Methodology⚑ Flag

After a report was delivered, a peer reviewer at Granite Forensic Services finds that the examiner misread a time zone setting, shifting several key events by five hours. What is the MOST appropriate action?

AWait to mention the error only if asked about it during testimony BLeave the report as is unless the opposing side notices the error CIssue a corrected supplemental report and notify the client and counsel DQuietly replace the report file in the case folder with a fixed version

Correct answer: C. Issue a corrected supplemental report and notify the client and counsel
Errors found after release must be corrected openly with a supplemental report, and the people relying on it must be told. Quietly swapping the file hides the error and would seriously damage credibility if discovered.

Question 109Tools & Programs⚑ Flag

An examiner at Highland Sheriff's Office uses Android Debug Bridge to collect data from an unlocked, non-rooted Android phone. Which limitation should she expect?

AThe extraction will always include a full physical image BMany app databases and deleted data are out of reach CThe phone's SIM card contents will be erased on connect DOnly photos can be copied, not any text-based files

Correct answer: B. Many app databases and deleted data are out of reach
On a non-rooted phone, ADB gives logical access to shared storage and some system information, but the Android app sandbox blocks most private app data and deleted data cannot be reached. A full physical image requires deeper access methods that ADB alone does not provide.

Question 110Digital Evidence⚑ Flag

An examiner confirms that a suspect drive has no host protected area, yet it still reports fewer sectors than the manufacturer's specification and some drive features are disabled. What is the MOST likely cause?

AThe file system reserved space for the MFT BTRIM has released the missing sectors CA device configuration overlay was set DThe drive uses 4K Advanced Format sectors

Correct answer: C. A device configuration overlay was set
A DCO can reduce the reported capacity and switch off drive features, and it can hide data even when no HPA exists. MFT reservation happens inside the file system and does not change the drive's reported sector count.

Question 111Forensic Science⚑ Flag

A photo submitted in a fraud case shows a clean wall, but its embedded EXIF thumbnail shows the same scene with a handwritten sign on the wall. What does this most likely indicate?

AThe main image was edited after capture BThe thumbnail was added by the file system CThe EXIF data belongs to a different camera DThe camera generated an incorrect thumbnail

Correct answer: A. The main image was edited after capture
Some editing programs change the main image but leave the original embedded thumbnail untouched, so a mismatch suggests the main image was altered. Camera thumbnail errors are rare and would not add a specific object that is missing from the main image.

Question 112Digital Forensics⚑ Flag

A departing employee's laptop at Marlow Engineering holds an Outlook OST file, but cached mode was set to sync only the last 12 months of mail. Legal needs the complete mailbox, which still exists on the Exchange server. What is the best source?

AThe Windows search index on the laptop BA server-side eDiscovery mailbox export CThe OST file converted to PST format DThe Outlook autocomplete NK2 cache file

Correct answer: B. A server-side eDiscovery mailbox export
A server-side export captures the entire mailbox, including mail older than the client's sync window. The OST only holds what cached mode synced, so it will lack the older messages even after conversion.

Question 113Procedures & Methodology⚑ Flag

An internal investigation at Maplewood Retail has closed, and the employee resigned. The lab is holding a seized laptop and several forensic images. What should happen to this evidence?

AFollow the retention policy and confirm no legal hold applies first BGive the laptop back to the former employee as a goodwill gesture CStore the images on a shared drive in case another team needs them DWipe everything right away since the case is now closed

Correct answer: A. Follow the retention policy and confirm no legal hold applies first
Evidence should be kept or disposed of according to the retention policy, and only after confirming no legal hold or pending claim requires it. Wiping it right away could destroy evidence needed for a later lawsuit.

Question 114Digital Forensics⚑ Flag

An investigator at Wexford Shipping must determine whether a USB storage device was plugged into an Ubuntu workstation and, if so, its vendor and serial number. Which source is MOST likely to show this?

AThe user's ~/.bash_history file BThe /var/log/apt/history.log file CKernel messages in /var/log/kern.log or syslog DThe /etc/fstab mount configuration file

Correct answer: C. Kernel messages in /var/log/kern.log or syslog
When a USB device connects, the kernel logs messages such as the vendor ID, product ID and serial number, which land in kern.log and syslog. The fstab file only lists configured mounts and usually does not include removable drives at all.

Question 115Digital Evidence⚑ Flag

When examining a Windows 11 computer that boots in UEFI mode from a GPT disk, where should the examiner look for the boot manager files?

AIn the first 446 bytes of the MBR boot code BIn a hidden recovery partition formatted exFAT CIn the NTFS boot sector of the C: volume DIn the EFI System Partition, formatted FAT32

Correct answer: D. In the EFI System Partition, formatted FAT32
UEFI firmware loads boot files such as bootmgfw.efi from the EFI System Partition, which uses a FAT file system. MBR boot code is used by legacy BIOS booting, not UEFI.

Question 116Regulations & Ethics⚑ Flag

During a civil lawsuit, a court finds that a defendant intentionally wiped a key laptop after receiving a litigation hold notice, in order to keep its data from the plaintiff. What consequence is the court MOST likely able to impose?

AOnly an order that the defendant buy a replacement laptop for the plaintiff BA criminal conviction issued directly by the civil judge in the same case CNo penalty, because deleting data from company property is the owner's right DSanctions such as an adverse inference instruction or a default judgment

Correct answer: D. Sanctions such as an adverse inference instruction or a default judgment
When a party destroys electronically stored information with intent to deprive the other side of it, courts can impose serious sanctions, including telling the jury to presume the lost data was unfavorable or entering a default judgment. Ownership of the device does not excuse destruction once the duty to preserve has attached.

Question 117Tools & Programs⚑ Flag

A response team at Pacific Rim Freight needs to collect registry hives, event logs, prefetch files and the $MFT from 40 Windows machines in minutes, without full disk images. They want a tool that uses predefined targets to copy these files and can then run parsing modules. Which tool fits BEST?

AKAPE BFTK Imager Cdc3dd DWireshark

Correct answer: A. KAPE
KAPE (Kroll Artifact Parser and Extractor) uses target files to collect specific artifacts quickly, including locked files, and module files to run parsers such as Eric Zimmerman's tools on the results. FTK Imager can export individual files, but it is built for imaging and has no target-based triage workflow.

Question 118Procedures & Methodology⚑ Flag

Officers executing a warrant in a threat case find a laptop and a USB drive on the suspect's desk. Investigators believe the suspect's fingerprints on the drive could link him to it. What should the digital evidence team do BEFORE handling the drive?

APlug it into a field laptop to preview its contents BCoordinate with crime scene staff and wear gloves CWipe the drive's casing so it is clean for the lab DHand it to the suspect to confirm who owns it

Correct answer: B. Coordinate with crime scene staff and wear gloves
Devices can carry physical evidence such as fingerprints or DNA, so the team should coordinate with crime scene staff and handle the item with gloves so that evidence is not destroyed. Previewing the drive in the field risks changing its data and adds handling before physical evidence is collected.

Question 119Forensic Science⚑ Flag

Prosecutors must show that a set of images came from one specific seized camera, not just the same model. Which technique best supports this?

ARunning error level analysis BComparing JPEG quantization tables CMatching the EXIF camera model field DComparing sensor PRNU noise patterns

Correct answer: D. Comparing sensor PRNU noise patterns
Photo-response non-uniformity is a noise pattern unique to each sensor, so it can link an image to an individual camera. The EXIF model field identifies only the model and is easy to edit, so it cannot single out one device.

Question 120Digital Forensics⚑ Flag

An email header contains dkim=pass with d=vendorpay.com. A junior analyst says this proves the named employee at the vendor personally sent the message. What does a DKIM pass actually show?

AThe message body was encrypted during delivery BThe sender's IP address appears on an approved list CThe vendor's domain signed it and signed parts were not altered DThe message was sent directly from the vendor employee's own computer

Correct answer: C. The vendor's domain signed it and signed parts were not altered
DKIM verifies a signature from the domain named in d=, proving the signed headers and body were not changed after signing. It does not identify which person sent the message, and approved sending IPs are what SPF checks.

Question 121Digital Evidence⚑ Flag

A detective submits a 256 GB SDXC card from a body camera. The card holds video files larger than 4 GB. Which file system is the examiner MOST likely to find?

AexFAT BFAT32 Cext4 DHFS+

Correct answer: A. exFAT
The SDXC standard uses exFAT, which was designed for flash media and supports files far larger than 4 GB. FAT32 is common on smaller cards but cannot hold a single file over 4 GB.

Question 122Digital Forensics⚑ Flag

An examiner at Pemberton Arts needs to review macOS system and app log activity from a seized MacBook running a recent macOS version. Where are the unified log tracev3 files stored?

A/Library/Logs/DiagnosticReports B~/Library/Containers/logs C/private/var/db/diagnostics D/var/log/system.log.d

Correct answer: C. /private/var/db/diagnostics
The unified logging system stores tracev3 files under /private/var/db/diagnostics, with supporting string data in /private/var/db/uuidtext, and they are read with the log show command. DiagnosticReports holds crash and hang reports, not the unified log.

Question 123Procedures & Methodology⚑ Flag

A lab evidence technician at Brennan County receives a sealed bag from a field officer. The tamper-evident tape is torn at one corner, and the custody form shows no prior opening. What should the technician do FIRST?

ARecord the torn seal and notify the submitter BReseal the bag with new tape and log it as received CRefuse the item and send it back with no record kept DBegin imaging, since the drive inside looks undamaged

Correct answer: A. Record the torn seal and notify the submitter
A damaged seal is a chain of custody concern, so the technician should record and photograph its condition, note it on the custody record and notify the submitter before any analysis. Simply resealing the bag would hide the problem and weaken the item's integrity record.

Question 124Regulations & Ethics⚑ Flag

In a routine contract dispute, outside counsel asks an examiner to make full physical images of laptops for 150 employees. The relevant evidence appears to be email and shared documents from five custodians. What approach BEST fits e-discovery principles?

AFull physical images of all 150 laptops, since more data always reduces risk BA targeted collection from the key custodians, scaled to the case's needs CNo collection at all until the court specifically lists which files to preserve DForensic images of every device the five custodians have ever used at work

Correct answer: B. A targeted collection from the key custodians, scaled to the case's needs
E-discovery is governed by relevance and proportionality, so collection should match the importance and needs of the case. Imaging every laptop adds huge cost without a clear benefit. Full forensic imaging is more typical of investigations where deleted data or user activity is in question.

Question 125Digital Evidence⚑ Flag

A fire damaged an older, unencrypted Android phone in an arson case. Its USB port and much of its circuit board are destroyed, but the flash memory chip looks intact. Which acquisition method is MOST likely to recover its data?

AChip-off extraction of the memory chip BLogical extraction through Android tools CJTAG extraction through the test points DA manual review of the phone's screens

Correct answer: A. Chip-off extraction of the memory chip
Chip-off removes the memory chip and reads it directly in a reader, so it does not depend on the phone's damaged board or ports, and the data is readable because the device was not encrypted. JTAG needs working test access points on the board, which the fire destroyed.

Question 126Forensic Science⚑ Flag

An investigator recovers Linux password hashes and plans to use precomputed rainbow tables. Each hash includes a unique random salt. What effect does the salt have?

AIt allows the hash to be reversed directly BIt limits passwords to eight characters CIt makes precomputed tables largely ineffective DIt shortens the time needed for brute force

Correct answer: C. It makes precomputed tables largely ineffective
A unique salt changes each hash, so a precomputed table would have to be built for every salt value, which makes rainbow tables impractical. Salting does not make brute force faster, since each guess must still be hashed with the salt.

Question 127Digital Forensics⚑ Flag

An examiner finds an iPhone backup folder on a suspect's Windows computer. Which file in the backup serves as the database that maps the hashed backup file names to their original paths on the device?

AInfo.plist BManifest.db CStatus.plist DPreferences.db

Correct answer: B. Manifest.db
In modern iOS backups, Manifest.db is a SQLite database that maps each hashed file name to its domain and original path. Info.plist describes the device and backup, and Status.plist records backup state, but neither indexes the files.

Question 128Digital Forensics⚑ Flag

A Mac user at Sterling Consulting claims she was not using her laptop during a call at 3:00 PM. The investigator wants to show which application was in focus at that time and whether the screen was unlocked. Which artifact is BEST suited?

AThe QuarantineEventsV2 database BThe /.fseventsd change records CThe com.apple.dock.plist file DThe knowledgeC.db database

Correct answer: D. The knowledgeC.db database
KnowledgeC records usage events such as which app was in focus and device lock state, each with start and end times. The dock plist only stores Dock layout settings and has no usage timeline.

Question 129Tools & Programs⚑ Flag

The digital forensics unit at Brookfield Police wants one commercial platform that can load a computer image, a phone extraction and cloud account data into a single case. Examiners want results grouped by artifact type, such as chats, web history and media. Which product is best known for this approach?

AMagnet AXIOM BFTK Imager CX-Ways Forensics DThe Sleuth Kit

Correct answer: A. Magnet AXIOM
Magnet AXIOM is known for bringing computer, mobile and cloud evidence into one case and presenting it by artifact category. X-Ways Forensics is a fast, efficient disk analysis tool, but it focuses on computer evidence rather than combined mobile and cloud acquisition.

Question 130Procedures & Methodology⚑ Flag

A responder is sealing an evidence bag that holds a seized USB drive. Which step BEST shows later whether the bag was opened?

ATape it with clear packing tape and add a printed label BSeal it with tamper-evident tape and sign across the seal CClose it with staples and write the case number on the front DFold it shut and keep it in the responder's jacket pocket

Correct answer: B. Seal it with tamper-evident tape and sign across the seal
Tamper-evident tape breaks visibly if removed, and a signature across the seal shows the bag has not been opened since it was sealed. Staples or packing tape can be removed and replaced without leaving clear signs.

Question 131Digital Evidence⚑ Flag

A Mac with an APFS volume is seized. The suspect deleted several spreadsheets the day before. Besides carving, where might earlier versions of those files still exist?

AIn local APFS snapshots of the volume BIn the HFS+ catalog file on the same volume CIn the FAT32 EFI partition used for booting DIn an NTFS $LogFile created by Boot Camp

Correct answer: A. In local APFS snapshots of the volume
APFS supports snapshots, including local Time Machine snapshots, which preserve earlier states of the file system through copy-on-write. An APFS volume has no HFS+ catalog file, since it uses its own B-tree structures.

Question 132Digital Forensics⚑ Flag

A seized Android phone is locked with an unknown passcode, and the device is set to wipe after too many failed attempts. The phone is in a Faraday bag and charging. What should the examiner do next?

ARemove the SIM card and reboot the phone BTry common passcodes until one works CFactory reset it to bypass the lock DUse an approved lock bypass method or lawful unlock

Correct answer: D. Use an approved lock bypass method or lawful unlock
The examiner should use validated forensic tools, vendor or legal assistance, or the owner's lawfully obtained passcode instead of guessing. Repeated guesses risk triggering a wipe, and a factory reset destroys the user data being sought.

Question 133Digital Forensics⚑ Flag

On a Mac at Ironwood Games, a suspicious script launches every time the user "mpatel" logs in, but not at system boot before any login. Which location is the MOST likely place to find the plist that starts it?

A/Users/mpatel/Library/LaunchAgents B/private/etc/periodic/daily C/System/Library/LaunchDaemons D/Library/LaunchDaemons

Correct answer: A. /Users/mpatel/Library/LaunchAgents
Launch agents in a user's ~/Library/LaunchAgents folder are loaded when that user logs in and run in that user's context. LaunchDaemons start at system boot, before any user logs in, which does not match the behavior.

Question 134Forensic Science⚑ Flag

Which password recovery method will eventually find any password given unlimited time, but becomes slower as length and character set grow?

AHybrid rule attack BDictionary attack CBrute force attack DRainbow table lookup

Correct answer: C. Brute force attack
Brute force tries every possible combination, so it is exhaustive, but its run time grows exponentially with password length and character set. A dictionary attack is faster but fails when the password is not in its word list.

Question 135Regulations & Ethics⚑ Flag

Calder Insurance lets staff use personal phones for work email through a managed work container. An investigator wants to examine a departing employee's phone for signs of data theft, but the employee refuses to hand it over. What is the MOST appropriate approach?

AUse company-side data and the work container, and get legal advice before going further BRemotely wipe the entire phone so no company data leaves with the employee CPush monitoring software to the whole phone through the work email profile DSeize the phone at the exit interview, since it was used for company business

Correct answer: A. Use company-side data and the work container, and get legal advice before going further
A personal phone carries a stronger expectation of privacy than a company laptop, and the employer usually has rights only to its own data and what the BYOD policy allows. Seizing or wiping the whole device without consent or a court order can create legal liability and taint the evidence.

Question 136Procedures & Methodology⚑ Flag

A lab must ship a seized hard drive to an accredited partner lab in another state for specialized analysis. What is the MOST appropriate method?

AAsk an intern to drive it over in a personal car on the weekend BUpload the image to a public file sharing site and mail the drive later CSend it by regular mail in a plain envelope to avoid attention DUse a tracked, signature-required courier and log it on the custody form

Correct answer: D. Use a tracked, signature-required courier and log it on the custody form
A tracked courier that requires signatures, plus a chain of custody entry, documents every step of the transfer. Regular mail offers no tracking or proof of who handled the drive.

Question 137Digital Evidence⚑ Flag

An examiner at Granville Police runs an ASCII keyword search for a suspect's alias across a Windows image and gets few hits. A colleague notes that Windows stores many strings, such as registry values, in a different encoding. What should the examiner do?

ALimit the search to files with .txt names BRepeat the search using UTF-16LE as well CSearch only in unallocated clusters instead DConvert the image to a compressed E01 file

Correct answer: B. Repeat the search using UTF-16LE as well
Windows often stores text such as registry data, file names and many logs in UTF-16 little-endian, where each character takes two bytes, so an ASCII-only search misses those hits. Searching only unallocated space would narrow the search rather than catch the missing encoded strings.

Question 138Tools & Programs⚑ Flag

A paralegal team at Whitcomb Law receives a 20 GB Outlook PST file from a departed employee's laptop. The investigator wants to browse folders, search messages and view attachments without installing or configuring Outlook. Which category of tool fits BEST?

AA packet analyzer such as Wireshark or tcpdump BA registry parser such as RegRipper or RECmd CA dedicated PST viewer like Kernel or Stellar DA SQLite browser such as DB Browser for SQLite

Correct answer: C. A dedicated PST viewer like Kernel or Stellar
PST viewers from vendors such as Kernel and Stellar open Outlook data files directly, so the examiner can browse folders, search mail and export attachments without Outlook. A SQLite browser is meant for app databases, and PST files use Microsoft's own format, not SQLite.

Question 139Digital Forensics⚑ Flag

Officers recover only the SIM card from a suspect's phone, which was thrown in a river. What kind of evidence can the SIM card itself provide?

ABrowser history from the phone's web browser BIMSI, ICCID and any contacts or SMS saved to it CPhotos and videos taken by the phone camera DChat histories stored by the phone's messaging applications

Correct answer: B. IMSI, ICCID and any contacts or SMS saved to it
A SIM stores subscriber identifiers such as the IMSI and ICCID and can hold a small set of contacts, SMS and network location data. Photos, app chats and browser history live on the handset or in the cloud, not on the SIM.

Question 140Forensic Science⚑ Flag

A viral image in a defamation case contains a signed C2PA manifest stating it was produced by a generative AI tool. What does this manifest represent?

AA camera sensor noise fingerprint BAn EXIF field written by every camera model CA hash entry from the NSRL data set DA signed record of content provenance

Correct answer: D. A signed record of content provenance
C2PA Content Credentials are signed provenance metadata that describe how content was created and edited. EXIF fields are unsigned and easy to change, and they are not written by every device, so they do not provide the same assurance.

Question 141Digital Forensics⚑ Flag

An investigator at Fulton Records examines an external hard drive formatted for both Windows and Mac use. The root of the drive contains a hidden folder named .Spotlight-V100. What does this MOST likely indicate?

AThe drive was formatted on a Linux system with HFS+ BThe drive was attached to a Mac that indexed it CThe drive was encrypted with FileVault at some point DThe drive was used as a Time Machine backup target

Correct answer: B. The drive was attached to a Mac that indexed it
macOS creates a .Spotlight-V100 folder on volumes that Spotlight indexes, so its presence shows the drive was connected to a Mac. A Time Machine target would show its own backup folder structure, not just a Spotlight store.

Question 142Procedures & Methodology⚑ Flag

Before trial, the attorney who retained an examiner asks her to remove a finding from her report because it weakens the client's case. The finding is accurate. What should the examiner do?

ARewrite it in vague terms so it no longer clearly hurts the client BRemove it since the attorney controls the content of the report CKeep the finding, since her duty is to give objective results DMove it to an appendix that the attorney does not have to submit

Correct answer: C. Keep the finding, since her duty is to give objective results
An expert must report accurate findings objectively, regardless of who pays, and cannot hide unfavorable results. Removing or burying a valid finding is misleading and can destroy the expert's credibility if exposed.

Question 143Digital Evidence⚑ Flag

An examiner finds that the MFT of an NTFS image is intact and lists several recently deleted files. Why should file system-based recovery be tried before carving?

AIt keeps names, paths and timestamps for the files BIt is the only way to recover files larger than 1 MB CIt recovers files even after clusters are overwritten DIt does not require a forensic image of the drive

Correct answer: A. It keeps names, paths and timestamps for the files
Recovering through MFT records keeps file names, folder paths, timestamps and fragmented cluster runs. Carving finds data by signatures alone and loses that metadata, but neither method recovers content that has been overwritten.

Question 144Regulations & Ethics⚑ Flag

Under the Federal Rules of Evidence, when is a piece of digital evidence considered relevant?

AWhen it proves a disputed fact beyond a reasonable doubt without other support BWhen both parties agree before trial that it should be shown to the jury CWhen it was lawfully collected under a valid search warrant or written consent DWhen it has any tendency to make a fact of consequence more or less probable

Correct answer: D. When it has any tendency to make a fact of consequence more or less probable
Relevance is a low bar: evidence is relevant if it has any tendency to make a fact that matters to the case more or less probable. How evidence was collected affects other questions, such as suppression, but it does not decide relevance.

Question 145Tools & Programs⚑ Flag

A defense expert challenges a lab's findings in court and asks exactly how the tool's parsing logic works. Which advantage do open-source tools such as The Sleuth Kit offer in this situation?

ATheir source code can be reviewed to show how results were produced BThey come with guaranteed vendor support and expert testimony services CThey are automatically accepted by courts without any validation DThey always process evidence faster than commercial forensic suites

Correct answer: A. Their source code can be reviewed to show how results were produced
Because open-source code is public, any expert can examine how a tool parses data, which supports transparency and peer review. Vendor support and expert testimony services are usually strengths of commercial suites, and no tool is accepted by courts without validation.

Question 146Digital Forensics⚑ Flag

In a death investigation, the victim wore a fitness tracker that syncs to a phone app. The tracker keeps only a few days of data in limited memory, and investigators need heart rate and step data for a night two weeks ago. Where should they look first among items they already hold?

AThe Bluetooth settings menu on a laptop BThe tracker's charging cable and its docking cradle CThe companion app's data on the paired phone DThe victim's home thermostat history

Correct answer: C. The companion app's data on the paired phone
Wearables sync readings to a companion app, which keeps longer history in local databases on the phone, so the seized phone is the best place to start. The tracker itself rolls over older data, and the vendor cloud would require separate legal process.

Question 147Forensic Science⚑ Flag

A state lab examining a seized server in a hacking case wants to automatically flag files already identified as specific attack tools in earlier cases. Which approach BEST meets this goal?

AFilter the files using the NIST NSRL hash set BSort all files by their last access time CRun a keyword search for the word exploit DMatch hashes against a known-bad hash set

Correct answer: D. Match hashes against a known-bad hash set
A known-bad or notable hash set lists files previously identified as malicious or contraband, so matching hashes flags them quickly and reliably. The NSRL contains known software files and is used to remove ordinary files from review, not to flag attack tools.

Question 148Digital Forensics⚑ Flag

On a standalone file server at Merrow Finance, an investigator suspects an attacker created a local account named svc_bkp and then gave it administrator rights. Which Security event ID records the account being added to the local Administrators group?

A4672 B4720 C4728 D4732

Correct answer: D. 4732
Event 4732 records a member being added to a security-enabled local group, such as the local Administrators group on a member or standalone server. Event 4720 records the account's creation but not its group membership, and 4728 applies to global groups in a domain.

Question 149Procedures & Methodology⚑ Flag

A busy lab handles dozens of cases at once, and two drives from different cases were recently mixed up. Which case management practice would BEST prevent this?

AWrite only the suspect's last name on each drive with a marker BGive each item a unique case and item number on every label CStore all drives from the same month together on one shelf DLet each examiner use their own naming system for evidence

Correct answer: B. Give each item a unique case and item number on every label
A unique case and item number on every label and form ties each piece of evidence to one case and one record. Personal naming systems or suspect names alone can repeat and cause mix-ups.

Question 150Digital Evidence⚑ Flag

A signature analysis report flags thousands of files for review. One entry shows contract_final.docx beginning with the bytes 50 4B 03 04. What should the examiner conclude about this entry?

AThe file is a legacy Word 97 document saved as DOCX BThe file is a damaged DOCX missing its true header CThe header fits DOCX, which is a ZIP-based format DThe file is a ZIP archive disguised as a Word file

Correct answer: C. The header fits DOCX, which is a ZIP-based format
DOCX, XLSX and PPTX files are ZIP containers, so they normally start with 50 4B 03 04, and flagging this one is a false positive. Legacy Word 97 files use a different OLE compound file header.