Option B. Dictionary attack is the best answer because the attacker used a precompiled list of common passwords and tested them against the login page. That is the defining pattern of a dictionary attack: trying likely password candidates from a prepared wordlist rather than exhaustively attempting every possible combination. CHFI v11 includes password-related attack and analysis concepts within its investigation scope, and this scenario matches the classic distinction between dictionary and brute-force methods.
A brute-force attack would attempt all possible character combinations systematically, which is broader and usually more time-consuming than using a list of common passwords. A keylogger would capture keystrokes from the victim's device, which is not what happened here. Cryptanalytic attack refers to attacking cryptographic mechanisms, not simply testing common passwords against a login page.
From a CHFI perspective, understanding the difference between password-guessing methods is important because it helps investigators interpret authentication logs and attacker behavior. Since Oliver relied on a text file of frequently used passwords and tested them one by one, the technique most accurately described is a dictionary attack .

According to the CHFI v11 objectives under Digital Forensics Review and Anti-Forensics Techniques , attackers frequently use file extension manipulation as an anti-forensic technique to conceal malicious executables by renaming them with harmless-looking extensions such as .txt, .jpg, or .pdf. This tactic relies on the assumption that investigators or users will trust the file extension rather than verifying the file's true structure.
Autopsy , which is built on The Sleuth Kit (TSK) , provides a dedicated capability to detect file extension mismatches by analyzing file headers (magic numbers) and comparing them against the file's extension. If a file's internal signature does not match its extension, Autopsy flags it as suspicious, allowing investigators to identify hidden executables and recover their true file types. CHFI v11 explicitly highlights "Detecting File Extension Mismatch using Autopsy" as a key forensic technique for defeating anti-forensics.
OSForensics is primarily used for detecting data hiding techniques such as alternate data streams and overwritten metadata, while Timestomp is itself an anti-forensic tool used to manipulate timestamps.
StegoHunt focuses on steganography detection rather than file type validation.
The CHFI Exam Blueprint v4 emphasizes the importance of file type analysis and extension mismatch detection when investigating disguised malware, making Autopsy the most appropriate and exam-aligned tool in this scenario

According to the CHFI v11 objectives under Computer Forensics Fundamentals , Forensic Readiness , and Incident Response Integration , forensic readiness refers to an organization's ability to efficiently collect, preserve, analyze, and present digital evidence while minimizing the cost and impact of investigations. A lack of forensic readiness primarily affects how well an organization can respond to, investigate, and legally defend itself after an incident-not whether the incident causes operational disruption.
System downtime (Option B) is a direct operational impact of a cyberattack , such as a DDoS attack, ransomware infection, or system compromise. While poor preparedness may prolong recovery, downtime itself is not caused by the absence of forensic readiness; it is caused by the attack's technical and operational effects. Therefore, system downtime is not a consequence of lacking forensic readiness.
In contrast, the other options are well-documented consequences of poor forensic readiness in CHFI v11.
Lack of preparation often results in inability to collect legally sound evidence (Option D), which affects court admissibility. Limited collaboration with legal and IT teams (Option C) occurs when roles, procedures, and escalation paths are not predefined. Additionally, without proper controls and monitoring, data manipulation, deletion, and theft (Option A) may go undetected or untraceable.
The CHFI Exam Blueprint v4 emphasizes forensic readiness as a strategic capability focused on evidence integrity, compliance, and investigative efficiency , not on preventing or causing system downtime, making Option B the correct and exam-aligned answer

According to the CHFI v11 objectives under Email Forensics and Digital Evidence Analysis , investigators must be capable of extracting, recovering, and analyzing email data stored in proprietary formats such as Microsoft Outlook PST files . PST files often contain emails from Inbox, Sent Items, Trash, and Archive folders, and may include deleted or corrupted messages that are highly relevant to an investigation.
SysTools MailPro+ is a forensic-grade email analysis tool designed specifically to handle PST file processing and recovery . It allows investigators to open, parse, and analyze PST files while recovering deleted emails, attachments, and metadata such as headers, timestamps, sender/recipient details, and message paths. CHFI v11 emphasizes the importance of using tools that support evidence integrity, selective extraction, and comprehensive visibility into email contents, all of which are core capabilities of MailPro+.
The other options are not suitable for this task. P2LOCATION ' s Email Header Tracer focuses on tracing email headers for routing analysis, not PST recovery. Email Dossier and Hunter's Email Verifier are OSINT and email validation tools used for profiling and verification, not forensic extraction or recovery of mailbox data.
The CHFI Exam Blueprint v4 highlights email evidence acquisition, deleted email recovery, and PST analysis as key forensic competencies. Therefore, SysTools MailPro+ is the most appropriate and exam- aligned tool for this investigation

According to the CHFI v11 objectives under Web Application Forensics and Analyzing Web-Based Attacks , the primary goal of investigating a command injection attack is to identify and understand the underlying vulnerabilities in the web application's code that allowed the attack to occur. Command injection attacks exploit improper input validation, where user-supplied data is passed directly to system-level commands without adequate sanitization or restriction.
From a forensic perspective, investigators analyze web server logs, application logs, and request parameters to determine how malicious input was crafted , which input fields were exploited , and what commands were executed on the server . This analysis helps reconstruct the attack sequence, assess the extent of compromise, and determine whether the attacker achieved privilege escalation, data exfiltration, or lateral movement.
Option B correctly reflects this forensic objective, as identifying code-level weaknesses enables organizations to remediate vulnerabilities, apply secure coding practices, and prevent recurrence. Option A focuses on log access control rather than attack analysis. Option C is unrelated to security incidents, and Option D relates more to analytics than forensic investigation.
The CHFI v11 Exam Blueprint explicitly includes investigating command injection attacks as part of web application forensics, emphasizing vulnerability identification, attack reconstruction, and remediation guidance. Therefore, identifying potential vulnerabilities in the web application's code is the correct and exam-aligned forensic goal