312-49v10 — frequently asked questions

Legacy LM hashing splits or pads the password into two 7-character blocks and hashes each separately, so cracking works on two smaller spaces.

Yes; local Group Policy applies on the standalone server, and its SAM stores local account hashes, so domain replication timing is irrelevant.

The quotes mark jargon: in the IP ID idle scan the quiet helper host is called the zombie, so "idle system" names that role rather than describing an unused PC.

No. It only needs predictable, incremental IP ID behavior and no competing traffic; a botnet zombie, by contrast, is a host already taken over and running a bot.

The exit relay knows the destination server but receives traffic from the middle relay, so it does not see the suspect's source IP; origin tracing requires the entry/guard relay.

No. Bridges are unlisted entry points used to bypass censorship; the guard/entry relay remains the node that holds the client's source-side information.

It is a documented dd/Netcat alternative, but it depends on the fmem module and raw device access, while the question targets LiME's purpose-built TCP memory export from the suspect host.

The suspect machine must load LiME locally because that is where the RAM resides; the forensic workstation only receives the TCP stream with Netcat.

It captures all data, including deleted fragments, but imaging a large RAID server is too time- and resource-intensive for the stated constraint; sparse acquisition is targeted.

Yes. Sparse acquisition combines logical collection of selected files with capture of unallocated deleted fragments, which matches both requirements.

Password-protected packers gate the packed payload, so the unpacker needs the password to produce a usable unpacked file. Option A skips a required decryption step.

It can observe runtime behavior, but with a password-protected known packer the recommended next step is C: decrypt and unpack before deeper static or dynamic analysis.

ShellBags Explorer parses ShellBag registry data, not LNK shortcut files; LNKs may show target paths but do not directly reconstruct deleted folder views and mounted-drive history like BagMRU/Bags do.

No. ShellBags show that a folder was viewed or interacted with in Explorer and can persist after deletion, but they are circumstantial evidence and should be correlated with other artifacts.

While Task Scheduler allows persistence, AutoStart Registry keys are more commonly targeted by fileless malware for immediate execution at login.

They are specific registry paths (like CurrentVersion\Run) where programs are listed to start automatically when Windows boots or a user logs in.

In computing contexts like forensics, 1 KB is defined as 1024 bytes. Therefore, 1.5 * 1024 = 1536 bytes.

Slack space just wastes space. Fragmentation scatters file data across the disk, making logical reconstruction and timeline analysis significantly more complex for the investigator.

Clearing history removes UI entries but often leaves traces in the WebCache database. Forensic tools can parse these remnants even after a 'clear history' action.

No, it is specifically designed for Internet Explorer, Edge, and Chrome/Chromium-based browsers. It cannot parse Firefox's proprietary profile structure.

Windows XP returns a consistent and predictable TCP window size in its ACK packets during a half-open scan, creating a unique fingerprint detectable by Nmap.

Yes, Nmap can be executed on Windows (as indicated by the c:\> prompt), but the scan technique itself targets network stack vulnerabilities regardless of the source OS.

Code 1 (Host Unreachable) is a routing failure, while Code 13 (Administratively Prohibited) is a deliberate drop by security policies.

Port Unreachable is ICMP Type 3, Code 3, indicating no service is listening on the destination port.

16 bits allow for 65,536 unique ports, which is sufficient for most applications without wasting header space.

Yes, both the source and destination port fields in the TCP header are 16 bits each.

Smurf attacks use ICMP Echo Requests sent to broadcast addresses to amplify traffic, whereas Ping of Death relies on sending single, malformed packets that exceed the maximum IP payload size.

While modern operating systems are patched against this vulnerability, it remains a key concept in certification exams to test understanding of protocol limits and legacy DoS vectors.

EnCase uses CRC for its own file structure integrity, but MD5/SHA-1 is used for the evidence data itself.

MD5 provides a cryptographic fingerprint that makes accidental or intentional tampering easily detectable, unlike simple checksums.

HKEY_CURRENT_USER only holds settings for the logged-in user. Password hashes are stored centrally in the SAM database under HKLM for system-wide authentication.

The SAM data is physically stored in the file C:\Windows\System32\config\SAM on the local drive.

A null cipher selects hidden letters from a cover text by position and needs no physical overlay. The recovered plastic template is the distinctive tool of a grille cipher.

A grille cipher requires sender and receiver to use the same hole pattern. Finding duplicates at many suspects' desks shows a shared decoding template rather than ordinary text steganography.

A cluster (allocation unit) is a logical file-system construct made of one or more consecutive sectors, so it is always equal to or larger than a single sector.

A platter surface is divided into concentric tracks, and each track is subdivided into sectors, the smallest physically addressable block (512 bytes or 4 KB).

Slack space can hold remnants of deleted content, but NTFS metadata for files and directories lives in MFT records, so EnCase parses the MFT first; orphaned records go to Lost Files.

It places the entry in the Lost Files folder, which holds files parsed from unallocated MFT clusters; this behavior applies to NTFS volumes, not FAT.

dcfldd is an enhanced version of dd designed for forensics, offering features like hashing, split files, and multiple outputs, but basic syntax remains similar.

/dev/hda refers to the entire physical disk device. Using the whole disk ensures all partitions and metadata are overwritten, which is critical for wiping.

Wireshark captures at Layer 2, but the question asks about monitoring via a router, which functions at Layer 3. The context shifts focus to the routing device's layer.

Ethereal captures frames at Layer 2. However, 'monitoring' in a router context implies observing the IP traffic flow, which is a Layer 3 activity.

While NTDS.dit contains the data, the logical component handling NTLM credential verification is the SAM subsystem. Exams often target this distinction.

SAM is the Windows database for local and domain account credentials. Shadow files are used in Linux/Unix systems for the same purpose.

Lost clusters are marked as used in the allocation table but have no file owner, whereas unallocated space is marked as free and available for new files.

Yes, they may contain remnants of deleted files. Forensic tools can scan these areas to recover data if the file headers are intact.

Besides config.db, filecache.db stores cached file content and metadata, which can be crucial for recovering deleted or modified documents.

Yes, if Dropbox is installed and configured, config.db will exist in the .dropbox.cache directory, containing the user's session and setup data.

IPACCESSLOG records a matched packet. IPACCESSLOGP records that a match occurred but the log entry itself was dropped due to rate limiting.

Increase the logging rate limit using the 'logging rate-limit' command or allocate more memory for logging buffers on the router.

'y' represents a sequential number starting from zero, assigned to distinguish files with the same original name deleted from the same drive.

Files are renamed to prevent naming conflicts if multiple files with the same name are deleted and to preserve the original drive location metadata.

In Known-stego, the analyst has the original cover, stego object, and algorithm. In Blind steganalysis, only the stego object is available, requiring detection without prior knowledge.

Knowing the message alone doesn't reveal the embedding technique. Known-stego specifically requires knowledge of the algorithm used to embed the data into the cover object.

config.db holds general application settings, while Sync_config.db specifically tracks synchronization metadata, including the user's email, sync root path, and client version.

filecache.db stores cached file metadata and content for offline access, not user identity information like email addresses or sync directory paths.

Yes, CHKDSK can detect bad sectors and physical media issues, but its primary forensic role often cited in exams is repairing logical file system errors.

No, CHKDSK is not a dedicated tool for examining slack space; it focuses on file system structure and metadata integrity.

ResourcesExtract parses the resource directory of PE files for embedded assets like icons and bitmaps. It does not scan the binary data for ASCII/Unicode strings, which is the job of tools like strings.

No. Static analysis involves examining the code/file without running it. ResourcesExtract reads the file structure offline, so it remains a static analysis technique.

Belkasoft Live RAM Capturer acquires volatile memory for RAM analysis, but Google Drive's persistent metadata — account IDs, paths, sync settings — is written to the Windows Registry, which RAM capture does not enumerate.

PEBrowse Professional inspects a running process's environment block (modules, handles, threads), and Dependency Walker maps PE module and DLL dependencies — neither reads registry-based application artifacts.

PEiD matches the Portable Executable's signature entries against a database of compilers, linkers, packers, and cryptors, so it directly names the tool that packed the file.

No. Dependency Walker only reports DLL imports and exports, while SysAnalyzer logs runtime behavior; neither scans packer signatures, so both fail on a heavily packed sample.

Process Monitor records file, registry, process and network activity; it does not enumerate interactive or remote user sessions like PSLoggedon.

Yes, PsLoggedon can report local and resource-based logons for a remote computer when permissions allow.

myisamchk checks, repairs, and optimizes MyISAM tables; it does not process the MyISAM log file, which is myisamlog's purpose.

No; myisamlog can display the log and can also perform recovery operations on the MyISAM log file when used accordingly.

The disk is a tangible object you can seize and bag; the image file is logical data you preserve by hashing and copying. The question asks about the file itself, not the media.

Printed publications are tangible paper items that can be collected, labelled and entered into a chain of custody, so they count as physical evidence.

The checksum protects the integrity of the encrypted file's header/data region, so it is stored in the EFS header rather than in the per-user DDF record inside the $EFS attribute.

The DDF stores the user SID, container name, provider name, EFS certificate hash, and the FEK encrypted to the user's public key, enabling key recovery via the private key.

Lspm.pl takes the same arguments as Lspi.pl but serves a different enumeration role; only Lspi.pl locates the start of the executable image of a process.

They are a family of Perl scripts with identical argument handling, but each targets different process information, with Lspi.pl specifically pinpointing the executable image location.

RAID 1 mirrors data, so every member disk holds an exact copy of the volume. Imaging the volume or any single disk yields identical content.

No. That guidance says a controller image will "most likely" differ, which is conditional. D claims it is always different, which fails for mirrored RAID 1.

SQL Server does not use a .log extension; its transaction log is stored in a .ldf file, so Model.log is a decoy option.

The .ldf transaction log records every transaction and data modification, exposing unauthorized queries and changes made during an attack.

Classic HFS records timestamps using the 1904 epoch in local time, not UTC. Platform ownership (Mac vs. Windows) does not determine the timestamp format — NTFS's UTC encoding does.

No. FAT stores creation, access, and modification times in local time, with only two-second resolution on modification time, which complicates forensic time correlation.

pdfid.py only parses PDF files and reports PDF-specific tokens, so it cannot inspect an OLE/MS Office document for encryption, Flash objects, or macros.

oledir.py dumps the raw OLE directory entries and oleform.py extracts VBA user-form data; only oleid.py gives the broad indicator overview (type, encryption, Flash, macros) the task needs.

Middleware is software that processes, routes, and abstracts data between devices and applications. It does not physically contain the sensors or RFID tags that acquire data from the environment.

The edge technology layer holds the physical sensing hardware, while the access gateway layer provides network connectivity and routing that carries collected data toward the server and upper layers.

4688 only records that a new process was created; it proves execution but carries no data about which registry keys or values the process touched.

Yes. Registry auditing must be enabled (audit policy plus SACL on the relevant keys) before running the file, otherwise no 4657 events are generated.

That phrase describes Rule 1004, which allows secondary evidence only when the original is lost, destroyed, or cannot be obtained. Rule 1002 states the affirmative requirement for the original itself.

Rule 1003 allows a duplicate to be admitted to the same extent as an original unless authenticity is genuinely questioned. Rule 1002 sets the baseline demand for the original before any duplicate rule applies.

Init only spawns and supervises user-space services. The Dalvik VM preloading and forking that lowers memory and start-up cost happens inside Zygote itself, not in init.

Zygote forks its already-loaded Dalvik VM to create a new app process, so the app starts from a pre-warmed template with shared classes and resources instead of a cold boot.

Azure Portal can create a snapshot interactively, but the CHFI procedure for duplicating a snapshot into a storage account in another region specifies the scriptable, repeatable Azure CLI command, which also produces an auditable record.

Azure Active Directory (Entra ID) only authenticates and authorizes Robert's access to the VM and storage account; it does not transfer any snapshot data between regions.

SAM stores local account password hashes, while SYSTEM contains the boot key needed to decrypt them; PWdump7 uses both to produce usable LM/NTLM hashes.

Nuix is an eDiscovery and forensic analysis platform for processing and reviewing data, not a dedicated utility for dumping local SAM account hashes.

pslist only walks the active process linked list, so it can miss unlinked hidden processes and does not scan process memory for injected PE regions.

It scans process memory for suspicious executable regions and PE headers that may indicate hidden processes, injected code or injected DLLs.

Malvertising is the ad-delivery vector; the question describes silent installation via a browser flaw during a site visit, which is the drive-by download itself.

Phishing relies on user interaction with a deceptive message or page, while a drive-by download needs only the visit and a browser or plugin vulnerability.

The Disk Signature (2 bytes) is a unique ID for the disk located after the partition table. The Boot Signature (0x55AA, 2 bytes) is at the very end of the MBR to validate the sector.

While 0x55AA is a signature, the term 'Disk Signature' specifically refers to the 2-byte unique identifier field defined in the MBR structure before the final boot signature.

EFSDump is specifically for extracting data from encrypted EFS volumes, not for recovering deleted partitions from standard file systems.

No, Diskview is generally a disk management or monitoring tool and lacks the deep forensic algorithms required to reconstruct deleted partition structures.

Option D is a secondary fallback. The system tries the mkext cache (A) first. It only searches /System/Library/Extensions if the mkext file is also missing or corrupted.

No. The mkext cache was used primarily in older Mac OS X versions (pre-10.7). Modern macOS uses different mechanisms, but CHFI v10 tests this specific legacy behavior.

7035 logs the command sent by the Service Control Manager to start/stop a service, while 7036 logs the resulting state change of the service.

Event ID 1 is a generic system startup/shutdown event. It does not provide granular details about individual services starting or stopping.

DumpChk is designed for quick inspection of crash dump headers and summaries, not for parsing or isolating specific user-mode processes from a full dump.

Process Dumper extracts the complete virtual memory space of a specific process, creating a smaller, manageable file for targeted forensic analysis.

Dynamic analysis requires the file to execute properly. If it is password-protected, it may fail to launch or behave erratically, preventing accurate observation of its behavior.

No. Reverse engineering is a last resort. If you have knowledge of the packing tool and the unpacking tool, using them directly after decryption is faster and more reliable.

Decryption requires knowing the algorithm and key, which is only possible after mounting the file to analyze its headers and identify the packer type.

Static analysis is usually ineffective on packed files because the code is encrypted/obfuscated, preventing signature matching until unpacked.

AWS provides the default security group, but the customer creates and configures the rules within it, making firewall configuration a customer responsibility.

In managed services like RDS or Elastic Beanstalk, AWS patches and maintains the underlying OS, so the customer does not handle OS security.

PST files are used for archiving or exporting personal folders, whereas OST is specifically designed to cache online mailbox data for offline use.

They are usually found in AppData\Local\Microsoft\Outlook, distinct from PST files which are often in Documents or custom locations.

NGFWs focus on network-level filtering (IPs, ports). ModSecurity inspects HTTP payloads at Layer 7, which is necessary to detect SQL injection syntax.

No. Logging provides forensic data after the fact but does not actively block or filter malicious requests in real-time.

Standard Exit Relays are publicly listed in the Tor directory. In authoritarian countries, ISPs and firewalls maintain blocklists of these known IPs, making it easy to detect and block connections to them.

A Guard Relay is the first hop in a standard Tor circuit and is public. A Bridge Node is a type of entry point that is NOT published in the public directory, making it harder for censors to find and block.

Static analysis examines code without executing it. Packing encrypts/compresses the code, making it unreadable to static tools until decrypted.

Rarely. It consumes excessive time and resources. Dynamic analysis provides actionable intelligence much faster without needing the key.

While Juniper IDS provides attack statistics, the CHFI curriculum specifically links bandwidth adjustment and business risk valuation to Check Point IPS logs.

Kippo is used to mimic SSH services to capture attacker behavior, not to measure network bandwidth or assist in business risk valuation.

Chi-square relies on statistical anomalies. If the attacker knows detection techniques, they can use algorithms that minimize these anomalies, making Chi-square less reliable.

Known-message requires knowing the hidden payload, which is usually unknown. Known-stego uses the original and stego files plus the algorithm to analyze modifications directly.

No live-triage need is described; the smartwatch is crime-scene evidence, so a forensic image must preserve its stored data before any extraction or analysis.

After the device is imaged and legally preserved; cloud and mobile-linked data are later investigative sources, especially because the paired smartphone is unavailable.

Dead acquisition requires powering down the system, which destroys volatile cloud-session data and mounted container state before they can be captured.

Yes, open files and command history remain useful, but this question's cloud-service wording makes the cloud-specific volatile evidence in C the better match.

fls lists filenames and directory entries, while istat displays detailed metadata for a specific inode, including block addresses.

fsstat only shows high-level filesystem statistics like superblock info, not individual inode data or block allocations.

Lower ASCII (0-127) covers standard letters, numbers, and punctuation. Higher ASCII (128-255) extends this with special symbols, graphics, and foreign language characters.

Codes 32-126 are printable characters like letters and symbols. Codes 0-31 are control codes, but the entire 0-127 range is 'standard' compared to the extended 128-255 range.

Fingerprint protection comes after the scene is documented and surveyed; handling the keyboard first destroys the positional context and the record of how the scene was found.

Only after the scene is documented and the search is planned; the log then records each item identified and collected, so starting it first skips a CHFI stage.