Option C. EnCase is the best answer because the question is about a forensic investigation of an MSSQL server where Lisa needs to collect and examine evidence files in a defensible manner. CHFI v11 explicitly includes SQL Server Logs , Investigating SQL Injection , and broad use of forensic tools for acquisition and examination of digital evidence.
Among the choices, EnCase is the forensic suite most appropriate for evidence collection, preservation, and detailed analysis . It supports imaging, examination, and evidentiary workflow, which are central to determining attack origin in a legally sound way. Sqlmap and SQLsus are offensive or testing-oriented tools associated with SQL injection activity, not primary forensic evidence examination platforms. Nessus is a vulnerability scanner, useful for assessment but not the best answer for collecting and analyzing MSSQL evidence after a breach.
Because the scenario centers on forensic examination of compromised database-server evidence, the strongest CHFI-aligned answer is EnCase , not exploit or scanning tools. It best supports evidence preservation, analysis, and reporting in a large-scale SQL-injection investigation.

According to the CHFI v11 objectives under Setting Up a Computer Forensics Lab and Ensuring Quality Assurance , maintaining strict control over who can access the forensic laboratory is a fundamental security requirement. The scenario described clearly aligns with physical access considerations , which focus on controlling, monitoring, and documenting entry into the forensic facility. Recording visitor details such as identity, time of entry, and purpose of visit ensures accountability and helps protect sensitive evidence, forensic tools, and investigation data from unauthorized access or tampering.
CHFI v11 emphasizes that forensic labs must implement visitor logs, access authorization procedures, and monitoring mechanisms as part of best practices. These measures directly support the chain of custody by demonstrating that evidence was only accessible to authorized individuals, which is essential for legal admissibility. In the event of an audit or court proceeding, access records can be used to prove that evidence integrity was preserved throughout the investigation lifecycle.
Human resource considerations (Option A) relate to staffing, training, and role assignments, not visitor access.
Work area considerations (Option B) address workspace layout and equipment placement. Physical and structural design considerations (Option D) involve building architecture and security infrastructure such as locks or surveillance systems, but not the administrative tracking of visitors.
Therefore, in accordance with CHFI v11 forensic lab security guidelines, physical access considerations best describe the security control being implemented

Option C is correct because CHFI v11 explicitly includes Analyze LNK Files and Jump Lists and also lists Tools to Examine Windows Files, Metadata, ShellBags, LNK files, and Jump Lists as important Windows artifact-analysis objectives. LNK files are commonly associated with user activity and recently accessed items, making the Recent folder the most relevant location among the options.
The path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent is the standard user-specific location associated with many recently accessed shortcut artifacts. This makes it a valuable source when reconstructing user behavior, identifying recently opened files, or linking a suspect to specific documents and file paths.
The other options are not the right artifact location for LNK files. Firefox cookies.sqlite is browser-related, WebCache is tied to cached browsing data, and the History location is not the best answer for Windows shortcut evidence. Therefore, from a CHFI perspective on Windows artifact analysis, the examiner should focus on the Recent folder to locate LNK files.

Option B is the correct answer because CHFI v11 explicitly emphasizes Live Acquisition , Order of Volatility , Collecting Volatile Information and Non-Volatile Information , and the need to acquire volatile evidence before it disappears. Memory-resident artifacts such as active processes, network connections, clipboard contents, and session data are highly time-sensitive and may be lost the moment the system is powered down or otherwise altered.
That is why Tom is prioritizing memory collection first. In forensic methodology, volatile data is often the most perishable , not the most stable. Non-volatile data remains on disk and can usually be acquired afterward, but RAM-based evidence may vanish quickly. This is especially important in insider-threat or live- system cases, where the most revealing traces of user behavior may still exist only in memory at the time of seizure.
Options A , C , and D all misunderstand the key principle being tested. The correct reason is that volatile data can be lost if not collected promptly , which makes it the highest priority in a live response under CHFI acquisition rules.

According to the CHFI v11 Anti-Forensics Techniques domain, steganography is a sophisticated method used by attackers to conceal sensitive or malicious information within seemingly normal files such as images, audio files, video files, or documents. Unlike encryption, which makes data unreadable but visibly suspicious, steganography hides the existence of the data itself , making detection significantly more challenging during forensic analysis.
In steganography, data is embedded into unused or less noticeable parts of a file-such as the least significant bits (LSB) of image pixels or audio samples-without noticeably altering the file's appearance or functionality. As a result, standard antivirus tools, intrusion detection systems, and basic forensic scans may not flag these files as suspicious. CHFI v11 highlights steganography as a common anti-forensic tactic used for covert data exfiltration, command-and-control communication, and storage of illegal or confidential information.
The other options are less effective in this scenario. File extension mismatch can often be detected through file signature analysis. Hiding data in file system structures leaves traces in metadata or unallocated space.
Trial obfuscation is not a formally recognized anti-forensics technique in CHFI v11.
CHFI v11 emphasizes that detecting steganography often requires specialized steganalysis tools , statistical analysis, and anomaly detection techniques beyond conventional scanning.
Therefore, the technique used to hide sensitive information within normal-looking files-fully aligned with CHFI v11-is Steganography , making Option D the correct answer.