You ' re working as a computer forensic investigator at an established tech company that's currently investigating a potential breach of confidential data. The prime suspect is an employee who has recently resigned. The company has seized the suspect ' s work laptop, which operates on a Windows OS. Your responsibility is to acquire the necessary data for the investigation. Given the seriousness of the case, the integrity of the evidence must be preserved. The system is still running and volatile data collection is an immediate priority. What is the most accurate sequence to collect volatile data?
Correct Answer: B
Option B is the best answer because CHFI v11 explicitly covers Live Acquisition , Order of Volatility , Rules of Thumb for Data Acquisition , and Collecting Volatile Information and Non-Volatile Information . When a Windows system is still running, the investigator should gather the most volatile and easily lost information first . Among the choices provided, network connections should be collected first because they can disappear immediately if sessions close or the system state changes. Running processes come next because active processes may terminate or change quickly. A list of open ports is also volatile and supports network-state interpretation, but it is slightly less informative on its own than established connections and active processes. System state is collected after those more transient live indicators. This ordering is consistent with CHFI's emphasis on preserving volatile evidence before it is altered by shutdown, user activity, or acquisition actions. Although detailed live-response procedures can vary by tool and environment, the option that best matches CHFI's order-of-volatility principle is: network connections, running processes, open ports, then system state .
312-49v11 Exam Question 77
A forensic investigator is assigned to a cybercrime investigation where they need to document critical evidence from a powered-on computer located at the crime scene. The computer is suspected to contain important files or programs that are part of the ongoing investigation, upon arriving at the scene, the investigator observes that the monitor of the computer is displaying a screensaver, which is obscuring any active programs or open files. The forensic team is under pressure to preserve the integrity of the evidence without modifying or tampering with any data on the machine. The investigator needs to capture a clear image of the programs running on the screen to document the evidence properly. However, they are uncertain about how to proceed in this situation to avoid potentially altering any information on the computer. What should the investigator do to capture the active programs on the screen and document the evidence effectively?
Correct Answer: B
Option B is the best answer because the investigator's immediate goal is to document what is currently displayed or active on a powered-on system while causing the least possible disturbance . CHFI v11 emphasizes best practices for handling digital evidence , preserving evidence , collecting volatile information , and understanding the consequences of actions taken on a live system. A slight movement of the mouse to wake the screen is the least disruptive way among the listed options to reveal the active display and allow proper photographic documentation. Rebooting or unplugging the machine would destroy volatile evidence and significantly alter the system state. Disconnecting the network cable may sometimes be considered in other operational contexts, but it does not solve the immediate issue of documenting the active on-screen evidence hidden by the screensaver. From a CHFI standpoint, documentation at the scene should preserve the evidence as found as much as possible while minimizing changes. Therefore, the correct response is to gently wake the screen and photograph/document the visible programs without taking destructive actions that would compromise volatile evidence.
312-49v11 Exam Question 78
Zachary, a digital forensic analyst, is working on a cyber-espionage case involving an old workstation. The workstation used an Integrated Drive Electronics (IDE) hard disk drive which failed due to a power surge, rendering it unreadable. Zachary believes the drive contains pivotal evidence that can aid the investigation. However, the workstation ' s motherboard also got damaged in the incident, and all of Zachary ' s available systems are modern and equipped only with SATA connectors. As a result, he can ' t directly connect the IDE drive to these systems. What should Zachary do in this scenario to retrieve the data from the IDE hard drive?
Correct Answer: A
Option A is the best answer because CHFI v11 specifically covers disk interfaces , understanding hard disks and SSDs , sources of potential evidence , and the methodology for choosing the best data acquisition method before evidence collection begins. When the issue is simply that the examiner's current systems have SATA connectors while the evidence drive is IDE , the most practical and forensically sound response is to use an appropriate adapter so the examiner can access the drive using modern hardware. This approach aligns with CHFI's acquisition principles because it supports controlled evidence access while preserving the drive for imaging and analysis. Sending the drive to a specialized recovery service may be necessary only if the drive itself is physically damaged beyond ordinary access, but the question's main obstacle is the interface mismatch. Extracting platters and placing them into another drive is highly inappropriate and risks destroying evidence. Repairing the old motherboard is also unnecessary and less efficient when an interface adapter can solve the connection problem safely. Therefore, based on CHFI data acquisition concepts and disk-interface awareness, the correct first choice is to use a SATA-to-IDE adapter .
312-49v11 Exam Question 79
As an IoT forensic investigator, you are tasked with investigating a cybercrime involving a compromised Smart TV and other IoT devices. The investigation requires extracting data from various IoT devices, including drones, wearables, and SD cards, to gather crucial evidence. You need a tool capable of performing both physical and logical extractions from these devices, covering mobile devices running Android, iOS, Tizen OS, and chip-off memory sources. Which of the following tools would be most suitable for this investigation?
Correct Answer: B
This question maps directly to CHFI v11 objectives under Mobile and IoT Forensics and Tools for IoT Device Forensics . IoT investigations often involve heterogeneous devices with different operating systems, storage mechanisms, and acquisition challenges. CHFI v11 emphasizes the need for specialized forensic tools that support both logical and physical extraction , including advanced techniques such as chip-off and SD card analysis, to ensure comprehensive evidence collection. MD-NEXT is a purpose-built digital forensic tool designed for mobile and IoT investigations. It supports forensic acquisition and analysis across a wide range of platforms, including Android, iOS, Tizen OS, wearables, drones, smart TVs, and removable media. Importantly, MD-NEXT provides capabilities for logical extraction, physical imaging, file system parsing, and chip-off memory analysis, which are critical when dealing with damaged, locked, or non-standard IoT devices. The other options are not suitable for this scenario. DoubleSpace is a disk compression utility, EpochConverter is used for timestamp conversion, and Systemctl is a Linux service management command. None provide forensic acquisition capabilities. Therefore, MD-NEXT is the most suitable and CHFI v11- aligned tool for comprehensive IoT and mobile device forensic investigations.
312-49v11 Exam Question 80
You ' re a forensic investigator tasked with analyzing a potential security breach on an Internet Information Services (IIS) web server. Your objective is to collect and analyze IIS logs to determine how and from where the attack occurred. Where are IIS log files typically stored by default on Windows Server operating systems?
Correct Answer: C
According to the CHFI v11 objectives under Web Application Forensics and Log Analysis , knowing the default storage locations of web server logs is essential for reconstructing web-based attacks. On Windows Server operating systems, Internet Information Services (IIS) stores its HTTP and HTTPS request logs by default in the directory: %SystemDrive%\inetpub\logs\LogFiles This directory contains subfolders such as W3SVC1, W3SVC2, etc., where each folder corresponds to a specific IIS website instance. The log files stored here record critical forensic details including client IP addresses, timestamps, HTTP methods, requested URLs, status codes, user agents, and referrers . These artifacts allow investigators to identify attack vectors such as SQL injection, command injection, directory traversal, brute-force attempts, and web shell uploads. The other options are incorrect because they do not represent default IIS log locations. %AppData% is user- profile specific, %ProgramFiles% contains application binaries rather than logs, and %SystemRoot% \Logs\IIS is not a standard IIS logging path. The CHFI Exam Blueprint v4 explicitly covers IIS web server architecture and log analysis , emphasizing familiarity with default log paths to ensure timely evidence acquisition and accurate incident reconstruction. Therefore, %SystemDrive%\inetpub\logs\LogFiles is the correct and exam-aligned answer
