Certified Hacking Forensic Investigator (CHFI) -
Exam Prep (Answered September 2022)
What is a swap file?
Space on a hard disk used as virtual memory expansion for RAM
System time is one example of volatile information that forensic investigators should
collect. What are types of time that should be recorded?
System time, wall time, time system has been running
(Date /t and Time /t can be typed in a command prompt in windows to retrieve the
system time)
Choose the list of tools and commands used to determine logged-on users:
PsLoggedOn, Net Sessions, LogonSession
What tools can be used to see which files are open?
Net file, PsFile, Openfiles
(Net file reveals names of all open shared files and the number of file locks, PsFile
shows list of files open remotely, openfiles can be used to list or disconnect all open
files and folders)
True or False: When connections are made to other systems using NetBIOS
communications, the system will maintain a list of other systems connected. By viewing
the contents of the name table cache, an investigator might be able to find other
systems affected.
True
(A cache is duplicate data stored in a temporary location so a computer can rapidly
access that data. In this case, the NetBIOS Remote Cache Name Table may contain a
list of systems that a computer has connected to.
nbtstat -c can be used to view the cache of NetBIOS names on the host operating
system)
It appears the suspect's computer is connected to a network, what is one thing an
investigator should look for?
Network connections
(Information about network connections can expire over time so an investigator must
collect evidence as soon as possible after an incident.)
What are two commands to obtain network information?
netstat -ano & netstat -r
( netstat -ano shows active connections including protocol, local address, foreign
address, state and PID
netstat -r shows the routing table netstat -b displays the executable involved in
creating the connection netstat -v is used in conjunction with -b to show sequence of
components involved)
What are two ways to view running processes on Windows?
TaskManager & Tasklist command
,When there is an open network connection, some process must be responsible for
using that connection. What commands can be used to view the port?
netstat -o & fport
( netstat -o shows process to port mappings netstat -b shows the executable
involved in creating each connection (Windows XP) * fport shows process-to-port
mappings but must be executed with administrator privileges)
What command can be used to view command history?
doskey /history & scroll up in the command window
(If a command window is open, the investigator can scroll up to see command history.
But the attacker may have typed cls to clear the screen. Then, the investigator can use
the doskey /history command to see the history.)
What are two registry settings that could impact a forensic analysis and investigation?
ClearPageFileAtShutdown & DisableLastAccess
( ClearPageFileAtShutdown - tells the OS to clear the page file when the system is
shut down. This will clear virtual memory in the swap file. DisableLastAccess -
disables updating of the last access times on files so the timestamp might not be
accurate)
What is the Index.dat file used for?
AutoComplete & Redundant information such as visited URLs, search queries, recently
opened files
( Index.dat is used for redundant information such as AutoComplete
information. Index.dat can be found in the History folder for Internet Explorer)
Which of the following is true about the swap file?
Hidden file in the root directory called pagefile.sys & Registry path is
HKEY_LOCAL_MACHINE_SYSTEM\CurrentControlSet\Control\Session Manager\
Memory Management
(The swap file can be organized as a contiguous space so fewer I/O operations are
required to read and write. It is a hidden file in the root directory called pagefile.sys.)
Each process of Windows is represented as an _______.
Executive process
(Each process on a Windows system is represented as an executive process or
EProcess. EProcess block is a data structure containing attributes of the process and
pointers to threads and process environment blocks.)
What command is used to view EProcess block?
dt -a -b -v _EPROCESS
What is the most important element of EProcess?
PEB - Process Environment Block
What are the six stages of process creation?
1. Launch .exe: File Execution Options registry key is checked for debugger value. If
yes, process starts over
2. EProcess object created along with KProcess, PEB, and initial address space
3. Initial thread created
4. Windows subsystem is notified of new process and thread
5. Execution of initial thread starts
6. Initialization of address space is complete for new process and thread
,True or False: The EProcess object is created along with KProcess, PEB, and initial
address space
True
What tool can parse memory?
Lsproc.pl d:\dumps\test-mem.dmp
What is an important consideration for complete memory dump analysis?
Pagefile.sys
(The swap file, called pagefile.sys, is virtual memory. Information in the swapfile must
also be considered when analyzing memory.)
What files contain pool headers?
Pooltag.txt
(Windows memory manager generally allocates memory in 4KB pages. Sometimes, 4K
would be too large and waste memory. So memory manager allocates several pages
ahead of time thus keeping an available pool of memory.)
What is the advantage of PMDump?
Dump contents of process memory without stopping the process
What does HKEY_CURRENT_USER contain?
Active, loaded user profile for currently logged-on user
What does HKEY_USERS hive contain?
All users profiles
What does HKEY_LOCAL_MACHINE hive contain?
Configuration information for the system including hardware and software settings
What does HKEY_CURRENT_CONFIG?
Hardware profile at startup
What does HKEY_CLASSES_ROOT hive contain?
Configuration information relating to which application is used to open various files on
the system
What registry data type indicates raw binary data?
REG_BINARY
What registry data type indicates 32-bit integer?
REG_DWORD
What registry data type indicates fixed length text string?
REG_SZ
What registry data type indicates variable length text string?
REG_EXPAND_SZ
What registry data type indicates multiple strings separated by delimiter?
REG_MULTI_SZ
What registry data type indicates no data type?
REG_NONE
What registry data type indicates 64-bit integer?
REG_QWORD
What registry data type indicates Unicode string naming a symbolic link?
REG_LINK
What registry data type indicates series of nested arrays storing a resource list?
REG_RESOURCE_LIST
What registry data type indicates series of nested arrays storing a device driver's list?
, REG_RESOURCE_REQUIREMENTS_LIST
What registry data type indicates series of nested arrays storing a resource list used by
physical hardware device?
REG_FULL_RESOURCE_DESCRIPTOR
Which type of cell contains registry key information including offsets to other cells and
LastWrite time for the key
Key cell
Which type of cell holds a value?
Value cell
Which type of cell holds series of indexes pointing to parent key cells?
Subkey list cell
Which type of cell holds values of common key cell?
Value list cell
What type of cell holds security descriptor information for key cell
Security descriptor cell
What are signatures for the cells in the registry?
kn (key cell), kv (value cell), ks (security descriptor cell)
How long is a key cell?
76 bytes
How long is a value cell?
18 bytes
Where is the last time the system was shut down?
SYSTEM\ControlSet00x\Control\Windows
Where is the computer name located?
SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerName
Where is the time zone listed?
SYSTEM\CurrentControlSet\Control\TimeZoneInformation
Which registry key maintains the audit policy?
SECURITY\Policy\PolAdtEv
Which registry key maintains the shares?
SYSTEM\CurrentControlSet\lanmanserver\parameters
Which registry key maintains the wireless SSID?
SOFTWARE\Microsoft\WZCSVC\Parameters\Interfaces\(GUID)
Which registry key is NOT accessed and parsed when a user logs into a system?
1) HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Runonce
2) HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\
PoliciesExplorer\Run
3) HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run
4) HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Windows\
Run
5) HKEY_CURRENT_USER\software\Microsoft\Windows\CurrentVersion\Run
6) HKEY_CURRENT_USER\software\Microsoft\Windows\CurrentVersion\RunOnce
7) All of the above are parsed when a user logs into a system
All of the above are parsed when a user logs into a system.
(Run means the values in this key execute at system startup
Exam Prep (Answered September 2022)
What is a swap file?
Space on a hard disk used as virtual memory expansion for RAM
System time is one example of volatile information that forensic investigators should
collect. What are types of time that should be recorded?
System time, wall time, time system has been running
(Date /t and Time /t can be typed in a command prompt in windows to retrieve the
system time)
Choose the list of tools and commands used to determine logged-on users:
PsLoggedOn, Net Sessions, LogonSession
What tools can be used to see which files are open?
Net file, PsFile, Openfiles
(Net file reveals names of all open shared files and the number of file locks, PsFile
shows list of files open remotely, openfiles can be used to list or disconnect all open
files and folders)
True or False: When connections are made to other systems using NetBIOS
communications, the system will maintain a list of other systems connected. By viewing
the contents of the name table cache, an investigator might be able to find other
systems affected.
True
(A cache is duplicate data stored in a temporary location so a computer can rapidly
access that data. In this case, the NetBIOS Remote Cache Name Table may contain a
list of systems that a computer has connected to.
nbtstat -c can be used to view the cache of NetBIOS names on the host operating
system)
It appears the suspect's computer is connected to a network, what is one thing an
investigator should look for?
Network connections
(Information about network connections can expire over time so an investigator must
collect evidence as soon as possible after an incident.)
What are two commands to obtain network information?
netstat -ano & netstat -r
( netstat -ano shows active connections including protocol, local address, foreign
address, state and PID
netstat -r shows the routing table netstat -b displays the executable involved in
creating the connection netstat -v is used in conjunction with -b to show sequence of
components involved)
What are two ways to view running processes on Windows?
TaskManager & Tasklist command
,When there is an open network connection, some process must be responsible for
using that connection. What commands can be used to view the port?
netstat -o & fport
( netstat -o shows process to port mappings netstat -b shows the executable
involved in creating each connection (Windows XP) * fport shows process-to-port
mappings but must be executed with administrator privileges)
What command can be used to view command history?
doskey /history & scroll up in the command window
(If a command window is open, the investigator can scroll up to see command history.
But the attacker may have typed cls to clear the screen. Then, the investigator can use
the doskey /history command to see the history.)
What are two registry settings that could impact a forensic analysis and investigation?
ClearPageFileAtShutdown & DisableLastAccess
( ClearPageFileAtShutdown - tells the OS to clear the page file when the system is
shut down. This will clear virtual memory in the swap file. DisableLastAccess -
disables updating of the last access times on files so the timestamp might not be
accurate)
What is the Index.dat file used for?
AutoComplete & Redundant information such as visited URLs, search queries, recently
opened files
( Index.dat is used for redundant information such as AutoComplete
information. Index.dat can be found in the History folder for Internet Explorer)
Which of the following is true about the swap file?
Hidden file in the root directory called pagefile.sys & Registry path is
HKEY_LOCAL_MACHINE_SYSTEM\CurrentControlSet\Control\Session Manager\
Memory Management
(The swap file can be organized as a contiguous space so fewer I/O operations are
required to read and write. It is a hidden file in the root directory called pagefile.sys.)
Each process of Windows is represented as an _______.
Executive process
(Each process on a Windows system is represented as an executive process or
EProcess. EProcess block is a data structure containing attributes of the process and
pointers to threads and process environment blocks.)
What command is used to view EProcess block?
dt -a -b -v _EPROCESS
What is the most important element of EProcess?
PEB - Process Environment Block
What are the six stages of process creation?
1. Launch .exe: File Execution Options registry key is checked for debugger value. If
yes, process starts over
2. EProcess object created along with KProcess, PEB, and initial address space
3. Initial thread created
4. Windows subsystem is notified of new process and thread
5. Execution of initial thread starts
6. Initialization of address space is complete for new process and thread
,True or False: The EProcess object is created along with KProcess, PEB, and initial
address space
True
What tool can parse memory?
Lsproc.pl d:\dumps\test-mem.dmp
What is an important consideration for complete memory dump analysis?
Pagefile.sys
(The swap file, called pagefile.sys, is virtual memory. Information in the swapfile must
also be considered when analyzing memory.)
What files contain pool headers?
Pooltag.txt
(Windows memory manager generally allocates memory in 4KB pages. Sometimes, 4K
would be too large and waste memory. So memory manager allocates several pages
ahead of time thus keeping an available pool of memory.)
What is the advantage of PMDump?
Dump contents of process memory without stopping the process
What does HKEY_CURRENT_USER contain?
Active, loaded user profile for currently logged-on user
What does HKEY_USERS hive contain?
All users profiles
What does HKEY_LOCAL_MACHINE hive contain?
Configuration information for the system including hardware and software settings
What does HKEY_CURRENT_CONFIG?
Hardware profile at startup
What does HKEY_CLASSES_ROOT hive contain?
Configuration information relating to which application is used to open various files on
the system
What registry data type indicates raw binary data?
REG_BINARY
What registry data type indicates 32-bit integer?
REG_DWORD
What registry data type indicates fixed length text string?
REG_SZ
What registry data type indicates variable length text string?
REG_EXPAND_SZ
What registry data type indicates multiple strings separated by delimiter?
REG_MULTI_SZ
What registry data type indicates no data type?
REG_NONE
What registry data type indicates 64-bit integer?
REG_QWORD
What registry data type indicates Unicode string naming a symbolic link?
REG_LINK
What registry data type indicates series of nested arrays storing a resource list?
REG_RESOURCE_LIST
What registry data type indicates series of nested arrays storing a device driver's list?
, REG_RESOURCE_REQUIREMENTS_LIST
What registry data type indicates series of nested arrays storing a resource list used by
physical hardware device?
REG_FULL_RESOURCE_DESCRIPTOR
Which type of cell contains registry key information including offsets to other cells and
LastWrite time for the key
Key cell
Which type of cell holds a value?
Value cell
Which type of cell holds series of indexes pointing to parent key cells?
Subkey list cell
Which type of cell holds values of common key cell?
Value list cell
What type of cell holds security descriptor information for key cell
Security descriptor cell
What are signatures for the cells in the registry?
kn (key cell), kv (value cell), ks (security descriptor cell)
How long is a key cell?
76 bytes
How long is a value cell?
18 bytes
Where is the last time the system was shut down?
SYSTEM\ControlSet00x\Control\Windows
Where is the computer name located?
SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerName
Where is the time zone listed?
SYSTEM\CurrentControlSet\Control\TimeZoneInformation
Which registry key maintains the audit policy?
SECURITY\Policy\PolAdtEv
Which registry key maintains the shares?
SYSTEM\CurrentControlSet\lanmanserver\parameters
Which registry key maintains the wireless SSID?
SOFTWARE\Microsoft\WZCSVC\Parameters\Interfaces\(GUID)
Which registry key is NOT accessed and parsed when a user logs into a system?
1) HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Runonce
2) HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\
PoliciesExplorer\Run
3) HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run
4) HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Windows\
Run
5) HKEY_CURRENT_USER\software\Microsoft\Windows\CurrentVersion\Run
6) HKEY_CURRENT_USER\software\Microsoft\Windows\CurrentVersion\RunOnce
7) All of the above are parsed when a user logs into a system
All of the above are parsed when a user logs into a system.
(Run means the values in this key execute at system startup
