Computer Hacking Forensic Investigator (CHFI v10) — Question 289

As a Computer Hacking Forensic Investigator, you are analysing a system with a UEFI boot process underway. You have reached the Boot Device Selection phase, and you notice that the system is attempting to load MBR boot code into memory. What can you infer from this?

Answer options

• A. The system is transitioning to the DXE phase
• B. The system is stuck in the Pre-EFI initialization phase
• C. The system follows a UEFI boot process
• D. The system is going through a legacy BIOS boot process

Correct answer: D

Explanation

The correct answer is D because the presence of MBR boot code indicates that the system is using a legacy BIOS boot method rather than the UEFI standard. Answer A is incorrect as the DXE phase occurs after the system has successfully transitioned away from the boot device selection. Answer B is also wrong because if the system were stuck in the Pre-EFI initialization phase, it would not be attempting to load any boot code. Answer C is misleading, as MBR is not part of the UEFI boot process.