CHFI Practice Exam 3 — 20 Questions

Question 1

An analyst is investigating a compromised Linux system. Which file system structure holds metadata about every file and directory, including permissions, ownership, timestamps, and pointers to data blocks?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Inode. The inode is the fundamental data structure in Unix/Linux file systems (e.g., ext2/3/4) that stores metadata for each file and directory, including permissions, ownership, timestamps (access, modify, change), and pointers to data blocks. Unlike the superblock or block bitmap, the inode does not store the file name (which is in directory entries) but contains all other essential metadata required for file system operations.

Answer

Journal

Answer

Block bitmap

Answer

Superblock

Question 2

During a forensic examination, the analyst encounters a file that is not automatically readable by forensic tools. The analyst suspects the file contains contraband images. Which of the following is the BEST approach to handle this evidence in accordance with the rules of evidence?

Accepted Answer

Create a forensic copy and use a write blocker to access the copy with appropriate software.. Forensic best practices require creating a bit-for-bit forensic copy of the original evidence and using a write blocker to prevent any alteration to the original. The analyst can then use specialized software (e.g., a hex editor, file carving tools, or a viewer that supports the file's raw format) to access the copy and extract contraband images without violating the integrity of the evidence, which is essential for admissibility under rules of evidence such as the Federal Rules of Evidence (FRE) 901.

Answer

Delete the file to prevent accidental distribution.

Answer

Ignore the file because it cannot be easily read.

Answer

Open the file using the original application on the suspect's computer.

Question 3

An analyst is investigating a Linux server running ext4 and needs to recover deleted files that may have been overwritten partially. Which technique is BEST suited for recovering fragments of known file types when the inode metadata is lost?

Accepted Answer

Perform file carving using 'foremost' with custom signatures. When inode metadata is lost, file system-based recovery tools like extundelete cannot function because they rely on that metadata. File carving with foremost uses content-based signatures (magic bytes) to locate and extract file fragments, even from partially overwritten areas of the disk. This makes it the best choice for recovering fragments of known file types when the file system metadata is unavailable.

Answer

Use 'dd' to extract the partition and then 'grep' for strings

Answer

Manually reconstruct the inode table using 'debugfs'

Answer

Use 'extundelete' to recover files from the journal

Question 4

An analyst recovers a hard drive from a suspect's computer. The drive has a partition table that uses a 32-bit identifier and a maximum partition size of 2 TB. Which partition table type is present?

Accepted Answer

MBR. The Master Boot Record (MBR) partition table uses a 32-bit identifier for partition entries and, with traditional 512-byte sectors, supports a maximum partition size of 2 TB. This matches the description exactly, making MBR the correct answer.

Answer

HFS+

Answer

GPT

Answer

APFS

Question 5

What is slack space in a file system?

Accepted Answer

The unused portion of a file's last cluster. Slack space is the unused portion of the last cluster allocated to a file. When a file does not exactly fill its final cluster, the remaining bytes in that cluster are slack space, which can contain remnants of previously deleted data. This is a critical area in file system forensics because it may hold hidden evidence.

Answer

Space used by the file system journal

Answer

Space reserved for the MBR

Answer

Space between partitions on a disk

Question 6

Which TWO artifacts are commonly used to identify USB device insertion history on a Windows system? (Select TWO.)

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR. The USBSTOR registry key and setupapi.dev.log contain information about USB devices connected to the system, including device IDs and timestamps.

Answer

NTUSER.DAT

Answer

prefetch files

Answer

Event ID 7045

Question 7

A forensic analyst is examining a disk image and needs to identify the file system structure. She looks for the Master File Table ($MFT) to begin analysis. Which file system is she most likely dealing with?

Accepted Answer

NTFS. The Master File Table ($MFT) is a core component of the NTFS file system, storing metadata about every file and directory on the volume. When a forensic analyst locates the $MFT, they are definitively working with an NTFS volume, as no other common file system uses this structure.

Answer

FAT32

Answer

HFS+

Answer

ext4

Question 8

A forensic analyst finds a partition that uses the Master Boot Record (MBR) scheme. Which of the following is TRUE about the MBR partition table?

Accepted Answer

It stores partition information in a 64-byte table. The MBR partition table is exactly 64 bytes in size, divided into four 16-byte entries. Each entry stores the starting and ending CHS/LBA addresses, partition type, and boot flag. This fixed-size table is the defining characteristic of the MBR scheme, limiting it to four primary partitions.

Answer

It uses a 128-bit Globally Unique Identifier (GUID) for partitions

Answer

It supports disks larger than 2 TiB

Answer

It stores a backup partition table at the end of the disk

Question 9

A security analyst is investigating a compromised Windows system and wants to see which processes were running at the time of memory capture. Which Volatility command should they use?

Accepted Answer

volatility -f mem.dump pslist. The `pslist` plugin in Volatility enumerates processes from the Windows kernel's EPROCESS structure list, showing all active processes at the time of memory capture. This is the correct command to identify running processes from a memory dump, as it directly parses the doubly-linked list of process objects maintained by the kernel.

Answer

volatility -f mem.dump hashdump

Answer

volatility -f mem.dump malfind

Answer

volatility -f mem.dump netscan

Question 10

During memory analysis, an examiner uses the Volatility 'malfind' plugin and discovers a process with executable code in an executable heap. Which technique is most likely being used by malware to avoid detection?

Accepted Answer

Heap spraying. The 'malfind' plugin in Volatility detects memory pages with executable code in non-standard locations, such as executable heaps. Heap spraying is a technique where malware allocates multiple heap blocks and fills them with malicious shellcode, then exploits a vulnerability to redirect execution to that heap. This results in executable code present in heap memory, which malfind flags.

Answer

Process hollowing

Answer

DLL injection

Answer

Reflective DLL loading

Question 11

Which tool is specifically designed to acquire RAM from a Linux system for forensic analysis?

Accepted Answer

LiME. LiME (Linux Memory Extractor) is a Loadable Kernel Module (LKM) specifically designed to capture volatile memory (RAM) from Linux systems. Unlike other tools that rely on user-space access, LiME operates at the kernel level, ensuring a more complete and forensically sound acquisition of the entire physical address space, including memory regions that user-space tools cannot reach.

Answer

WinPmem

Answer

EnCase

Answer

FTK Imager

Question 12

A security analyst suspects an attacker has hidden data in the Host Protected Area (HPA) of a suspect's hard drive. Which of the following tools is BEST suited to detect and access the HPA?

Accepted Answer

EnCase. EnCase is the best tool for detecting and accessing the Host Protected Area (HPA) because it has built-in support for reading ATA commands that identify and access the HPA, such as IDENTIFY DEVICE and SET MAX ADDRESS. It can bypass the operating system's abstraction layer to directly query the drive's native command set, allowing forensic acquisition of the HPA region that is normally hidden from standard disk utilities.

Answer

Foremost

Answer

WinPmem

Answer

PhotoRec

Question 13

A forensic investigator is analyzing a Linux ext4 file system. They suspect a file was deleted but its inode may still be intact. Which tool can be used to recover the file by referencing the inode?

Accepted Answer

debugfs. debugfs is an interactive file system debugger for ext2/ext3/ext4 that allows direct manipulation of inode structures. When a file is deleted but its inode remains intact, debugfs can recover the file by using the `lsdel` command to list deleted inodes and the `dump` command to extract the file contents by referencing the inode number.

Answer

dd

Answer

scalpel

Answer

foremost

Question 14

A security analyst is investigating a compromised Windows server and wants to capture the contents of RAM for analysis. Which of the following tools is specifically designed for this purpose?

Accepted Answer

WinPmem. WinPmem is a dedicated memory acquisition tool designed to capture the contents of RAM from a live Windows system. It creates a raw memory dump file that can be analyzed with tools like Volatility, making it the correct choice for this forensic task.

Answer

Foremost

Answer

Volatility

Answer

FTK Imager

Question 15

A Linux system uses the ext4 filesystem. A forensic analyst needs to recover a recently deleted file. Which of the following methods is MOST likely to succeed if the file's inode has not been reallocated?

Accepted Answer

Run `extundelete /dev/sda1 --restore-file /path/to/file`. `extundelete` is a dedicated tool designed to recover deleted files from ext3/ext4 filesystems by leveraging the filesystem's journal and inode data. If the inode has not been reallocated, the tool can directly restore the file using its path, making it the most targeted and efficient method.

Answer

Mount the filesystem with `mount -o ro,noatime` and browse

Answer

Use `dd` to copy the entire partition and search for the file signature

Answer

Use `ls -la` to view deleted file entries

Question 16

A forensic analyst is investigating a Windows system and needs to examine the contents of the Recycle Bin. Which file artifact contains metadata about deleted files, including original file paths and deletion times?

Accepted Answer

$Recycle.bin\$I. The $I file in the $Recycle.bin folder stores metadata about deleted files, including the original file path, deletion timestamp, and file size. This is the index file that the Recycle Bin uses to restore items to their original locations, making it the correct artifact for examining deletion metadata.

Answer

C:\Windows\System32\winevt\Logs

Answer

$Recycle.bin\$R

Answer

C:\Windows\Prefetch

Question 17

During a forensic analysis of a Windows 10 system, an investigator needs to locate the Master File Table ($MFT) to analyze file metadata. Which file system structure contains the $MFT?

Accepted Answer

NTFS volume's Master File Table. The $MFT is a core component of the NTFS file system, storing metadata for every file and directory on the volume. It is located in the NTFS volume's designated Master File Table area, not in any other file system structure. Option D correctly identifies this NTFS-specific structure.

Answer

ext4 superblock

Answer

FAT32's File Allocation Table

Answer

HFS+ catalog file

Question 18

An analyst suspects that sensitive data was hidden in the NTFS Alternate Data Streams (ADS) of a file on a suspect's drive. Which tool is specifically designed to enumerate and extract data from ADS on a live Windows system?

Accepted Answer

Streams.exe (Sysinternals). Streams.exe from Sysinternals is specifically designed to enumerate and extract data from NTFS Alternate Data Streams (ADS) on a live Windows system. It scans files and directories for hidden streams, displaying their names and sizes, and can optionally delete or extract them. This makes it the correct tool for the analyst's task.

Answer

Foremost

Answer

PhotoRec

Answer

dd

Question 19

An investigator finds evidence of data hidden using Alternate Data Streams (ADS) on an NTFS volume. Which command would display all ADS associated with files in a directory?

Accepted Answer

dir /r. The `dir /r` command in Windows displays alternate data streams (ADS) associated with files on an NTFS volume. ADS are a feature of NTFS that allow additional data to be stored with a file, hidden from standard directory listings. The `/r` switch specifically lists all streams, including the main stream and any alternate streams, making it the correct choice for forensic identification of hidden data.

Answer

dir /s

Answer

dir /x

Answer

dir /a

Question 20

Which of the following best describes the purpose of the Master File Table (MFT) in the NTFS filesystem?

Accepted Answer

It contains metadata and file attribute records for all files and directories. The Master File Table (MFT) is the core of the NTFS filesystem, storing a record for every file and directory on the volume. Each MFT record contains metadata such as timestamps, security descriptors, and file attributes, including the data itself for small files (resident data). This makes C correct because the MFT is fundamentally a database of file and directory metadata.

Answer

It manages the file allocation table for cluster chains

Answer

It stores the partition table and boot sector

Answer

It maintains a journal of all filesystem changes