312-49v11 Practice Exam — 312-49v11：CHFI （Computer Hacking Forensic Investigator）

Option Analysis: A. Correct, forensic imaging of the disk preserves the original storage state, and deleted web cache files, browsing history fragments, and erased downloaded images can typically be recovered from unallocated disk space even after the suspect cleared history and deleted files. B. Incorrect, co-worker eye-witness testimony is not forensically verifiable evidence of the specific website visits and downloaded content attributed to the suspect. C. Incorrect, the Windows registry does not store records of individual website visits or downloaded image files, so this will not yield the required evidence of the violation. D. Incorrect, requesting evidence from website administrators requires legal process, is logistically slow, and cannot directly tie the alleged activity to the suspect's specific device. Key Concept: The core CHFI v11 concept here is that deleted digital data remains intact on storage media until overwritten, so forensic imaging and deleted file recovery can retrieve evidence of erased user activity including web browsing and downloads. References: EC-Council Computer Hacking Forensic Investigator (CHFI) v11 Program Page, https://www.eccouncil.org/programs/computer-hacking-forensic-investigator-chfi/ NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response, https://csrc.nist.gov/publications/detail/sp/800-86/final

Option Analysis: A. The registry stores system configuration, user preferences, and application installation data but does not contain unsaved file content from running applications, so this option is incorrect. B. The swap file (also called page file) stores temporary copies of in-memory data from running applications that have not been saved to persistent storage, so this is the correct option to locate unsaved cheque file evidence. C. The recycle bin only contains files that were explicitly saved and then deleted by a user, so it would not hold unsaved file data, making this option incorrect. D. Metadata is descriptive data associated with saved files, which were already exhaustively searched with no evidence found, so this option is incorrect. Key Concept: In digital forensics for the CHFI v11 (312-49v11) exam, unsaved or ephemeral application data not found in persistent saved files can often be recovered from the swap/page file, which stores temporary copies of RAM content written to disk. References: NIST Special Publication 800-86: Guide to Integrating Forensic Techniques into Incident Response, https://csrc.nist.gov/publications/detail/sp/800-86/final Microsoft Learn: Introduction to the Page File, https://learn.microsoft.com/en-us/windows/client-management/introduction-page-file

Option Analysis: A. Temporary Files are generic transient files stored by operating systems or applications for temporary operational use, not specifically sent by websites to track and maintain user-specific information, so this option is incorrect. B. Open files refer to any files currently being accessed by an active running process, and have no association with website-generated data intended for user information tracking and validation, so this option is incorrect. C. Cookies are small text-based data sent from a web server to a user's browser, stored locally on the user's device to track user activity, validate session state, and retain user-specific information like login status and preferences, so this option is correct. D. Web Browser Cache stores static web content such as images, scripts, and HTML files to reduce page load times for repeat visits, and is not used to track, validate, or maintain user-specific identity or activity information, so this option is incorrect. Key Concept: This 312-49v11 CHFI exam question assesses knowledge of common web forensics artifacts, specifically the core definition and purpose of HTTP cookies as a frequent source of evidence in web-related forensic investigations. References: MDN Web Docs: HTTP Cookies, https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies EC-Council Computer Hacking Forensic Investigator (CHFI) v11 Program Page, https://www.eccouncil.org/programs/computer-hacking-forensic-investigator-chfi/

Option Analysis: A. 18 USC §1029 covers fraud involving access devices such as credit cards and telecom equipment, not general computer-related fraud, so this option is incorrect. B. 18 USC §1030, also known as the Computer Fraud and Abuse Act (CFAA), explicitly addresses fraud and related activity in connection with computers, so this option is correct. C. 18 USC §1361 criminalizes the injury or destruction of U.S. government property, which is unrelated to computer fraud, so this option is incorrect. D. 18 USC §1371 prohibits the destruction of public communication lines and infrastructure, not computer-related fraud, so this option is incorrect. Key Concept: The CHFI v11 (312-49v11) exam requires candidates to identify relevant U.S. federal computer crime statutes, specifically recognizing 18 USC §1030 as the law governing fraud and related activity involving computers. References: 18 U.S. Code § 1030 - Fraud and related activity in connection with computers, Cornell Legal Information Institute, https://www.law.cornell.edu/uscode/text/18/1030 Computer Fraud and Abuse Act (CFAA), U.S. Department of Justice

Option Analysis: A. RAID Level 0 performs only data striping across multiple drives with no parity support of any kind, so this option is incorrect. B. RAID Level 5 stripes data across multiple drives and stores parity information distributed across all member drives, matching the described characteristics, so this option is correct. C. RAID Level 3 uses byte-level data striping but stores all parity information on a single dedicated parity drive rather than distributing it across all drives, so this option is incorrect. D. RAID Level 1 is drive mirroring that writes identical copies of data to paired drives with no data striping or distributed parity, so this option is incorrect. Key Concept: For the 312-49v11 CHFI exam, RAID level identification depends on recognizing core traits including striping granularity, parity presence, and parity storage location, where RAID 5 is distinguished by distributed parity across all member drives paired with data striping. References: Microsoft Learn, RAID levels, IBM Documentation, RAID levels, https://www.ibm.com/docs/en/power8?topic=support-raid-levels