CHFI Practice Test 20 — 15 Questions

Question 1

During a forensic analysis of a compromised server, you discover that a rootkit has hidden itself by modifying the HPA (Host Protected Area) of the hard disk. Which tool can detect the presence of an HPA by comparing the reported size with the actual number of sectors?

Accepted Answer

hdparm. The hdparm tool in Linux can query the ATA security features, including HPA. The command `hdparm -N /dev/sda` displays the HPA settings and can reveal if an HPA is active by showing a reduced device size.

Answer

smartctl

Answer

dd

Answer

fdisk

Question 2

An analyst is investigating a compromised Linux system. Which file system structure holds metadata about every file and directory, including permissions, ownership, timestamps, and pointers to data blocks?

Accepted Answer

Inode. Inodes are data structures in ext2/3/4 that store metadata about files and directories.

Answer

Journal

Answer

Block bitmap

Answer

Superblock

Question 3

Which TWO of the following are valid methods to hide data on an NTFS volume? (Choose two.)

Accepted Answer

Storing data in the $Recycle.bin folder. Alternate Data Streams (ADS) allow data hiding in files, and the $Recycle.bin folder can be used to store deleted files that are not visible in normal browsing.

Answer

Using the volume boot record

Answer

Using the MFT resident data area

Answer

Using the USN journal

Question 4

A security analyst is investigating a compromised Windows system and wants to see which processes were running at the time of memory capture. Which Volatility command should they use?

Accepted Answer

volatility -f mem.dump pslist. The 'pslist' plugin lists processes from the EPROCESS structures. 'pstree' shows parent-child relationships.

Answer

volatility -f mem.dump hashdump

Answer

volatility -f mem.dump malfind

Answer

volatility -f mem.dump netscan

Question 5

An analyst recovers a disk image from a Linux server that used ext4. The image shows a superblock backup at multiple offsets. Which dd command would correctly extract the backup superblock located at offset 32768 bytes?

Accepted Answer

dd if=image.dd of=superblock.bin bs=512 skip=64 count=2. To extract the backup superblock at offset 32768 with size 1024 bytes, dd needs skip=32768/512=64 and count=1024/512=2.

Answer

dd if=image.dd of=superblock.bin bs=4096 skip=8 count=1

Answer

dd if=image.dd of=superblock.bin bs=1024 skip=32 count=1

Answer

dd if=image.dd of=superblock.bin bs=32768 skip=1 count=1

Question 6

An investigator notes that a file on an NTFS volume has a resident data size of 900 bytes, but the $DATA attribute lists an allocated size of 1024 bytes. What does this indicate?

Accepted Answer

The file has slack space that may contain remnants of previously deleted data. The difference between actual data size and allocated size is slack space. The file was allocated a cluster of 1024 bytes, but only 900 bytes are used, leaving 124 bytes of slack space that could contain residual data.

Answer

The file is compressed using NTFS compression

Answer

The file's data is stored in the MFT as a resident attribute

Answer

The file is stored in an alternate data stream

Question 7

A forensic analyst is examining a disk image and needs to identify the file system structure. She looks for the Master File Table ($MFT) to begin analysis. Which file system is she most likely dealing with?

Accepted Answer

NTFS. $MFT is a key component of NTFS, storing metadata about files and directories.

Answer

FAT32

Answer

HFS+

Answer

ext4

Question 8

Which file system artifact in NTFS records file system events such as file creation, deletion, and modification, and is often used to track attacker activities?

Accepted Answer

USN Journal. The USN (Update Sequence Number) journal, also known as the change journal, records all changes to files on an NTFS volume. It is a valuable artifact for tracking file activity and forensic timeline analysis.

Answer

Event Logs

Answer

Prefetch files

Answer

Registry

Question 9

During a forensic investigation of a hard disk, the investigator finds that the partition table is missing. The disk was previously partitioned using GPT. Which area of the disk should be examined to recover the GPT partition table?

Accepted Answer

LBA 1 (sector 1). GPT stores a primary partition table at LBA 1 (sector 1) and a backup at the end of the disk. The protective MBR is at LBA 0.

Answer

Last sector of the disk

Answer

Volume boot record

Answer

Master Boot Record (LBA 0)

Question 10

A forensic investigator is analyzing a Linux ext4 file system. They suspect a file was deleted but its inode may still be intact. Which tool can be used to recover the file by referencing the inode?

Accepted Answer

debugfs. The 'debugfs' tool can access ext2/3/4 file systems directly and recover files from inodes. 'extundelete' also works, but debugfs is more versatile.

Answer

dd

Answer

scalpel

Answer

foremost

Question 11

Which TWO of the following are file systems that use journaling to maintain integrity?

Accepted Answer

NTFS. NTFS and ext4 both use journaling. FAT32 does not; APFS uses a copy-on-write mechanism but is also journal-like; HFS+ has journaling but the question may expect ext4. However, NTFS and ext4 are clear examples.

Answer

FAT32

Answer

HFS+

Answer

APFS

Question 12

A forensic investigator is examining a Mac system with APFS. Which artifact would be most useful for determining the exact time a file was moved to the Trash?

Accepted Answer

The APFS journal (fsroot) records the move operation with a timestamp. APFS maintains a journal (fsroot) that records file system operations, including moves to Trash.

Answer

The file's creation timestamp in the directory entry

Answer

The .DS_Store file in the Trash folder

Answer

The 'com.apple.metadata:kMDItemWhereFroms' extended attribute

Question 13

A security analyst suspects an attacker has hidden data in the Host Protected Area (HPA) of a suspect's hard drive. Which of the following tools is BEST suited to detect and access the HPA?

Accepted Answer

EnCase. EnCase Forensic can image the entire disk including HPA and DCO, and is commonly used to detect hidden areas.

Answer

Foremost

Answer

WinPmem

Answer

PhotoRec

Question 14

Which TWO of the following are valid techniques for acquiring RAM in a Windows system?

Accepted Answer

WinPmem. WinPmem and FTK Imager are both capable of acquiring RAM on Windows systems. LiME is for Linux.

Answer

Sleuth Kit

Answer

LiME

Answer

dd

Question 15

A forensic analyst is investigating a Windows system and needs to examine the contents of the Recycle Bin. Which file artifact contains metadata about deleted files, including original file paths and deletion times?

Accepted Answer

$Recycle.bin\$I. The $Recycle.bin directory contains a file named $R (deleted file) and $I (info file). The $I file stores metadata such as original path, deletion time, and size. This is the standard Recycle Bin artifact in NTFS.

Answer

C:\Windows\System32\winevt\Logs

Answer

$Recycle.bin\$R

Answer

C:\Windows\Prefetch