Home ExamRange Practice Tests

CHFI (312-49) Digital Forensics Simulation

Practice identifying encryption artifacts during digital forensics investigations. Learn to distinguish between forensic tools, network analyzers, and encryption software to effectively analyze suspect workstations.

Investigation Scenario

Case ID: #2026-DF-049

Subject: Windows 10 Pro Workstation (Asset Tag: WKS-992)

Context: A corporate investigation has been initiated following suspected intellectual property theft. The suspect abruptly resigned. You have acquired a forensically sound physical image (.E01) of the suspect's primary workstation. During the data examination phase, you discover multiple files with high entropy that cannot be read by standard file viewers.

Evidence Collected

[+] EXTRACTING ARTIFACTS: C:\Users\suspect\Documents\Archive\... ------------------------------------------------------------------- File: financials_Q3.encrypted Size: 450 MB Entropy: 7.998 (Highly Compressed / Encrypted) Signature Map: Unknown / No recognizable magic bytes [+] ANALYZING REGISTRY HIVE: NTUSER.DAT ------------------------------------------------------------------- Key: Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs Entry: .encrypted -> points to binaries executed recently. [+] PARSING PREFETCH DIR: C:\Windows\Prefetch ------------------------------------------------------------------- Found: VERACRYPT.EXE-3F8A9B2C.pf Execution Count: 14 Last Run Time: 2026-04-09 14:32:11 UTC

Question

In a digital-forensics investigation, an analyst is examining a suspect's Windows workstation and finds several files with a .encrypted extension. The analyst suspects that the user used a specific tool to encrypt these files. Which of the following is a common file-encryption tool?
Forensic Hint: Review the Prefetch evidence collected. Look for tools designed for On-The-Fly Encryption (OTFE) or container creation. The other options are tools used by the investigator, not the suspect.

Expert Analysis

1. What The Evidence Shows

The forensic extraction reveals files with high entropy (~7.998), which strongly indicates encryption or heavy compression. The absence of standard file signatures (magic bytes) corroborates encryption. Furthermore, the presence of VERACRYPT.EXE in the Windows Prefetch folder proves that the user actively executed this specific binary on the system.

2. Forensic Stage

Examination and Analysis. The investigator is parsing file systems, extracting artifacts, calculating entropy, and analyzing registry/prefetch data to determine the nature of unreadable files.

3. Why The Correct Answer Is Correct

A. VeraCrypt is a widely used, open-source utility used for on-the-fly encryption (OTFE). It can create virtual encrypted disks within files or encrypt entire partitions. In digital forensics, finding VeraCrypt artifacts explains the presence of high-entropy, inaccessible files.

4. Why Others Are Wrong

B. Wireshark: This is a network protocol analyzer used for packet capture (PCAP) analysis, not for encrypting local file systems.
C. Autopsy: This is a digital forensics platform (graphical interface to The Sleuth Kit) used by investigators to analyze hard drives, not a user-level encryption tool.
D. FTK Imager: This is a forensic data acquisition and preview tool used to create forensic images (e.g., .E01 files) while maintaining the chain of custody.

5. Real-World Forensic Action

If encryption is suspected during a live response, the investigator must immediately attempt to capture live memory (RAM) using tools like DumpIt or FTK Imager before pulling the plug. RAM captures may contain the unencrypted volume master keys. If the machine is already powered down, the investigator must search for backup keys, passwords written on sticky notes, or attempt dictionary attacks using the suspect's generated wordlists against the container headers.

6. Mini Lesson: Artifact Interpretation
  • Entropy Analysis: A measure of randomness (0 to 8). Encrypted data approaches 8.0.
  • Prefetch Files (.pf): Found in C:\Windows\Prefetch. They prove a specific executable was run, providing run counts and MAC (Modified, Accessed, Created) timestamps.
  • File Extensions: A .encrypted extension is merely a user/application label; true forensic identification relies on file signature analysis (hex headers). In this case, VeraCrypt containers typically have no recognizable header, appearing as random data.

Ready to master the Digital Forensics Process?

Enhance your CHFI preparation with more evidence-driven scenarios.

Explore more CHFI simulations
ExamRange – CHFI 312-49 Simulation
Home ExamRange Practice Tests

CHFI (312-49) Digital Forensics Simulation

Master macOS forensic artifacts by analyzing file system metadata. This scenario trains your ability to track user downloads and reconstruct timelines during an internal investigation.

Investigation Scenario

You have been assigned to an intellectual property theft case. An employee is suspected of downloading proprietary datasets onto a company-issued MacBook Pro (macOS Ventura). The employee claims they never accessed or downloaded any such files. The physical device has been secured, and you have mounted a read-only logical image of the APFS volume.

Evidence Collected

Question

During a forensic examination of a macOS computer, an analyst is looking for evidence of a user's file downloads. Which file on the macOS file system stores metadata about files downloaded from the internet?

Investigator's Hint: macOS and its built-in browser (Safari) heavily rely on SQLite databases to store structured metadata, rather than simple property list (.plist) files, to track complex download histories over time.

Expert Analysis

What the Evidence Shows

The empty `~/Downloads` folder combined with FSEvents deletion logs indicates anti-forensic activity (file clearing). However, macOS retains historical records of internet downloads in specific metadata databases that are not cleared by simply emptying the Downloads directory.

Forensic Stage

Examination and Analysis. The investigator is transitioning from the collection phase (obtaining the APFS image) to examining specific system artifacts to reconstruct the timeline and prove intent.

Why the Correct Answer is Correct (C)

C. Downloads.db is the correct answer. On macOS, Safari (and historically the system's broader download tracking) stores a record of downloaded files in an SQLite database named `Downloads.db` (located at `~/Library/Safari/Downloads.plist` historically, and migrating to `.db` structures). This database contains critical metadata including the file name, download URL, file size, and timestamp of the download, which persists even if the actual file is deleted from the file system.

Why the Others are Wrong

  • A. com.apple.DownloadAssessment.plist: This property list file is related to macOS Risk Assessment (Gatekeeper/XProtect) policies regarding what file types trigger warnings, not a historical log of downloaded files.
  • B. com.apple.Safari.plist: This stores general Safari application preferences (e.g., default search engine, window state), not the granular database of file download history.
  • D. metadata.db: This is a generic filename distractor. While macOS uses many `.db` files, the specific artifact for Safari downloads is `Downloads.db`.

Real-World Forensic Action

Extract the `Downloads.db` file from the logical image. Open it using an SQLite database viewer. Execute a SQL query (e.g., SELECT DownloadEntryURL, DownloadEntryPath FROM DownloadItem;) to extract the source URLs and cross-reference the timestamps with the FSEvents deletion logs to build an unassailable timeline of the suspect's actions.

Mini Lesson: Artifact Interpretation & Timelining

In digital forensics, "absence of evidence is not evidence of absence." Suspects frequently delete the payload (the downloaded files) but overlook the system metadata tracking the event. Always verify secondary artifacts such as the macOS QuarantineEventsV2 database and Downloads.db. Document the chain of custody for the disk image, extract the database while preserving MACB timestamps, and validate the extracted SQL data by hashing the database file before and after examination.