Option D is the best answer because the question states that the malware executed as soon as the user visited the site , with no further interaction required . That behavior is most characteristic of a drive-by download
, in which malicious code is delivered or executed automatically through a compromised or malicious website. CHFI v11 includes common techniques attackers use to distribute malware across web and explains how attacks can work through websites as part of the malware infection chain.
The defining clue is the absence of any extra action by the user after visiting the site. Spear-phishing sites and malvertising can be part of delivery paths, but the actual technique described here is the automatic installation or execution behavior associated with drive-by downloads . Black hat SEO is a method of luring victims to malicious sites by manipulating search rankings, not the execution technique itself.
From a CHFI standpoint, investigators must distinguish between how victims are brought to malicious content and how the malware is actually delivered. In this case, the delivery mechanism is clearly drive-by download
, making option D the most accurate answer.

Option A. Raw Data Acquisition is correct because a bit-for-bit copy of the original storage medium is the defining characteristic of raw acquisition. CHFI v11 covers data acquisition methods , including the need to preserve evidence integrity and create a faithful duplicate suitable for examination, validation, and possible court use. A raw image captures the disk at the lowest level, including active files, deleted space, slack space, and unallocated areas, making it highly valuable in forensic investigations.
This is different from sparse acquisition , which captures only selected or relevant data rather than the full medium. Differential acquisition is not the standard answer for a complete forensic duplicate in this context.
Live data acquisition refers to collecting data from a running system, often to preserve volatile evidence, but it does not itself mean a full bit-stream copy of the storage media.
Because the question explicitly asks for the acquisition method that provides a bit-for-bit copy , the correct answer is raw data acquisition. This aligns directly with CHFI's focus on choosing the proper imaging method, preserving evidence, and maintaining forensic integrity through accurate duplication of the original media.

According to the CHFI v11 Malware Forensics and Malware Analysis objectives , dynamic malware analysis must be performed in a controlled, isolated, and well-monitored environment to both observe malicious behavior and prevent unintended spread to production systems. A key requirement of such an environment is the ability to monitor and record all system-level changes made by the malware during execution.
Host Integrity Monitoring (HIM) plays a critical role in dynamic malware analysis by tracking modifications to files, registry keys, services, processes, startup locations, system calls, and configuration settings . CHFI v11 emphasizes system behavior analysis as a core component of malware forensics, including monitoring registry artifacts, file system changes, persistence mechanisms, and process activity.
HIM enables investigators to safely analyze malware impact while maintaining forensic visibility and containment.
The other options are not aligned with CHFI v11 best practices. Disabling antivirus software weakens security controls but does not ensure containment or safety. Running malware on physical machines increases the risk of permanent damage and network propagation, which contradicts CHFI guidelines favoring sandboxed or virtualized environments. Using outdated operating systems does not contribute to safety and may introduce irrelevant vulnerabilities.
CHFI v11 strongly advocates controlled malware analysis labs with monitoring mechanisms that capture behavioral indicators without exposing production assets. Therefore, implementing host integrity monitoring is a key design aspect that supports both safe containment and effective behavioral analysis , making Option A the correct and CHFI-verified answer.

Option D. The inode table is the correct answer because, in Linux file systems such as ext2, file metadata including timestamps, permissions, ownership, and file size is stored in the file's inode , not in the file's content blocks. CHFI v11 explicitly includes Windows, Linux, and macOS File Systems , Linux File System Analysis Tools , and File System Analysis using The Sleuth Kit (TSK) , showing that exam candidates are expected to understand file-system structures and where key forensic metadata resides.
The data blocks contain file content, while the superblock stores overall file-system-level information such as layout and status. The dentry cache is a kernel memory structure related to name lookups and is not the primary persistent source for file metadata in this context. For detailed per-file forensic metadata, the examiner must look at the inode information.
Therefore, when Emily wants the most critical metadata about a specific ext2 file, the best source is the inode table , because that is where the file's core descriptive attributes are maintained.

Option D is the correct answer because CHFI v11 places major emphasis on rules of evidence , seeking consent , obtaining a warrant for search and seizure , legal issues, privacy issues and legal compliance , and the role of local/international agencies during cybercrime investigation . In a case involving multiple jurisdictions , cross-border systems , and lack of client consent, the investigator's first duty is to ensure the evidence-gathering process is legally valid in every relevant jurisdiction.
Working closely with legal counsel is essential because improper access can compromise admissibility, violate privacy laws, and expose the firm to legal liability. CHFI also highlights best practices for handling digital evidence , preserving evidence , and the importance of lawful authority before conducting intrusive forensic activity.
Option A is too limited and may ignore critical evidence. B would violate legal procedures. C is clearly improper because ownership claims do not override consent, privacy, or jurisdictional requirements.
Therefore, the most defensible and CHFI-aligned initial approach is to coordinate with the legal team, understand each legal regime, and obtain the necessary warrants or permissions before proceeding.