Which type of cybercrime involves an attacker using a compromised system as a stepping stone to attack other systems while making attribution difficult?
Chfi Forensic Science
Question · Easy
What is the primary purpose of forensic readiness in an organization?
Chapter 1: Foundations of Digital Forensics & Cybercrime Investigation
1.1 Cybercrime Classifications, Forensic Science Principles & Legal Admissibility
Study guide
According to the order of volatility, which data should an investigator collect FIRST during live acquisition?
Tech Exam Prep Podcast
Listen on Spotify
Podcast
Which of the following BEST describes anti-forensics?
Which network is commonly accessed through TOR relays and is frequently a target of forensic dark web investigations?
An IoC (Indicator of Compromise) for a malware infection is MOST likely to be which of the following?
1.2 RFC 3227 Order of Volatility, Live vs. Dead Acquisition & Forensic Readiness
Which type of malware operates entirely in memory without writing executable artifacts to disk?
Question · Medium
Which of the following is the FaaS (Forensics-as-a-Service) model BEST described as?
Which dark-web component allows clients to connect to a TOR network without revealing that they are using TOR?
OWASP lists which of the following as a Top 10 IoT vulnerability category?
1.3 Indicators of Compromise (IoCs), Cyber Attribution & Threat Intelligence
A forensic examiner needs to analyze metadata embedded in a JPEG image, including GPS coordinates and camera model. Which standard defines this metadata?
An attacker hosts a malicious script on a webpage that runs entirely in the user's browser memory and does not write to disk. This is BEST classified as which type of fileless attack vector?
Question · Hard
A forensic investigator needs to demonstrate that an original disk image has not been altered since acquisition. Which technique provides this assurance?
What characterizes 'live acquisition' compared to 'dead acquisition'?
1.4 AI-Assisted Forensics, GitOps, Automation/Orchestration & Forensics-as-a-Service (FaaS)
In MySQL forensics, which directory typically contains the data files for InnoDB and MyISAM tables that an investigator should image?
Under the U.S. Federal Rules of Evidence, the 'Best Evidence Rule' generally requires what when proving the content of a writing, recording, or photograph?
Chfi Regulations Policies Ethics
Which of the four ACPO (Association of Chief Police Officers) principles addresses what to do when it is necessary to access original digital evidence?
A documented record showing every person who handled an item of evidence, the date and time of each transfer, and the purpose of access is known as the:
Chapter 2: Modern Forensic Environments & Emerging Threats
2.1 Fileless Malware, In-Memory Execution & Living-off-the-Land (LotL)
The U.S. CAN-SPAM Act of 2003 imposes which requirement on commercial email senders?
Which of the following BEST distinguishes computer forensics from eDiscovery?
Which ISO standard provides guidelines for the identification, collection, acquisition, and preservation of digital evidence?
When can law enforcement search a computer WITHOUT a warrant under U.S. law?
2.2 IoT & Operational Technology (OT/SCADA) Forensic Fundamentals
An investigator is asked to testify in court as an expert witness. Which behavior would MOST damage the credibility of the testimony?
ENFSI (European Network of Forensic Science Institutes) Best Practice Manuals are MOST useful for what purpose?
A forensic investigator is asked by their employer to fabricate evidence to support a wrongful-termination case. Per the CHFI Code of Ethics, the investigator should:
Which RAID level provides striping with distributed parity, allowing single-disk failure recovery?
Chfi Digital Evidence
2.3 Dark Web, Tor Network, Onion Routing & Hidden Services Forensics
On a Windows system using NTFS, which file contains the metadata for every file and directory, including timestamps, permissions, and data attribute pointers?
A Windows system shows boot manager 'bootmgr' loading from the EFI system partition. Which boot method is in use?
An investigator extracts a SIM card from a suspect's phone. Which artifact is MOST commonly stored on the SIM itself?
Which Windows event log ID indicates a successful interactive logon?
2.4 Blockchain Transactions, Cryptocurrency Tracing & Digital Asset Investigations
A web server is running Microsoft IIS. By default, where are the W3C-format access logs stored?
An Apache web server stores access logs with entries in 'combined' log format. Which file typically holds them on a default Linux installation?
A hex editor reports that a file begins with the bytes FF D8 FF E0. Which file format does this magic number identify?
Which mobile-device data acquisition method recovers the FULL flash chip contents, including unallocated space and deleted records?
Chapter 3: Legal Frameworks, Search Warrants & Evidence Rules
3.1 Federal Rules of Evidence (FRE 702, 901, 902, 1001-1003) & Daubert/Frye Standards
What does the 'CDR' in a cellular investigation refer to?
Which file system is native to modern macOS volumes and replaced HFS+ starting with macOS 10.13 High Sierra?
Which Windows artifact stores user-level information about folders that have been browsed in Explorer, including remote shares and removable drives?
An investigator opens a .lnk file in a Windows forensic suite. Which information is MOST likely embedded in the LNK file?
Loading more…