CHFI Practice Test 27 — 15 Questions

Question 1

An analyst retrieves a forensic image of a hard drive and discovers that the size reported by the operating system is smaller than the actual physical capacity. The extra space is not accessible through standard partition tools. This hidden area is MOST likely:

Accepted Answer

Host Protected Area. The Host Protected Area (HPA) is an area on the hard drive that is not accessible through standard ATA commands. It can be used to hide data.

Answer

Device Configuration Overlay

Answer

Volume slack

Answer

RAM slack

Question 2

Which THREE of the following are types of slack space that can contain hidden data on a hard disk?

Accepted Answer

File slack. File slack, volume slack, and RAM slack are types of slack space. HPA and DCO are hidden areas, not slack space.

Answer

Device Configuration Overlay

Answer

Host Protected Area

Question 3

Which TWO of the following are challenges specific to SSD forensics compared to traditional HDD forensics?

Accepted Answer

Wear leveling. TRIM command causes SSDs to erase deleted blocks immediately, and wear leveling spreads data across cells to extend lifespan, both complicating data recovery.

Answer

Bad sectors

Answer

File fragmentation

Answer

Slack space

Question 4

An investigator finds evidence of data hidden using Alternate Data Streams (ADS) on an NTFS volume. Which command would display all ADS associated with files in a directory?

Accepted Answer

dir /r. The `dir /r` command in Windows Command Prompt lists all files, including their alternate data streams. Alternatively, tools like 'streams' from Sysinternals can be used.

Answer

dir /s

Answer

dir /x

Answer

dir /a

Question 5

Which of the following is a Windows-based forensic suite that provides timeline analysis, keyword search, and file system browsing for forensic investigations?

Accepted Answer

Autopsy. Autopsy is an open-source digital forensics platform that runs on Windows, Linux, and macOS. It provides timeline analysis, keyword search, and file system browsing.

Answer

Wireshark

Answer

FTK

Answer

EnCase

Question 6

Which file system journal is commonly used in Linux ext3/ext4 to record metadata changes before they are committed to the main file system?

Accepted Answer

Journal (JBD/JBD2). The journal in ext3/ext4 logs metadata changes (and optionally data) to ensure filesystem consistency after a crash. It is a circular log that is replayed during mount.

Answer

$LogFile

Answer

Recycle Bin

Answer

USN Journal

Question 7

A forensic examiner wants to recover deleted files from a USB drive formatted with FAT32. Which file carving tool is specifically designed to recover files based on file headers and footers?

Accepted Answer

Foremost. Foremost is a file carving tool that uses headers and footers to recover files. It is widely used for data recovery from FAT, NTFS, and other file systems.

Answer

Nmap

Answer

Wireshark

Answer

Sleuth Kit

Question 8

A forensic investigator analyzing a RAID 5 array of three disks notices that one disk has failed. Can the investigator still reconstruct the data?

Accepted Answer

Yes, using the parity information from the remaining disks. RAID 5 uses distributed parity. With one disk failure, data can be reconstructed using the parity information on the remaining two disks.

Answer

No, RAID 5 requires all disks to be present

Answer

Yes, but only if the failed disk is the parity disk

Answer

No, because RAID 5 does not support hot swapping

Question 9

During a forensic investigation, an analyst needs to recover recently deleted files from a FAT32 partition. Which of the following techniques is MOST effective for recovering files whose directory entries have been marked as deleted but the clusters have not yet been overwritten?

Accepted Answer

Editing the directory entry's first byte from 0xE5 to the original character and recalculating the FAT chain. FAT32 marks deleted files by setting the first byte of the directory entry to 0xE5. If the clusters are not overwritten, the file can be recovered by restoring the original first byte and using the FAT chain. File carving is used when directory entries are gone or clusters are fragmented.

Answer

Running 'scalpel' to extract fragments and reassemble based on metadata

Answer

Using the 'foremost' tool to perform file carving based on file headers and footers

Answer

Using 'dd' to create a raw image and then 'photorec' to recover based on file signatures

Question 10

During an investigation of a compromised system, the analyst discovers that the suspect used steganography to hide data within image files. Which forensic tool is BEST suited for detecting hidden data in images through statistical analysis?

Accepted Answer

Stegdetect. Stegdetect is a tool that uses statistical analysis to detect steganography in JPEG images. Autopsy has steganography detection modules but Stegdetect is specialized.

Answer

Binwalk

Answer

Wireshark

Answer

Foremost

Question 11

During a forensic investigation, an analyst examines a hard disk and notices that the partition table uses a 64-bit scheme with a maximum of 128 partitions. Which partition table type is in use?

Accepted Answer

GPT. GPT (GUID Partition Table) uses a 64-bit scheme and supports up to 128 partitions by default. MBR uses 32-bit and supports only 4 primary partitions.

Answer

MBR

Answer

LDM

Answer

APM

Question 12

An investigator recovers a file from unallocated space on an NTFS drive using file carving. The file appears to contain alternate data streams (ADS). Which tool can be used to list all ADS associated with a file on a live Windows system?

Accepted Answer

dir /r. The `dir /r` command in Windows displays alternate data streams. `streams.exe` from Sysinternals is also commonly used, but among the options, `dir /r` is the native method.

Answer

ls -la

Answer

attrib

Answer

fsutil

Question 13

A forensic examiner needs to acquire the RAM from a Windows 10 system without altering the contents. Which tool is MOST appropriate for this task?

Accepted Answer

WinPmem. WinPmem is a memory acquisition tool for Windows that supports capturing RAM. It is widely used in forensics. LiME is for Linux, FTK Imager can acquire disk images but not RAM.

Answer

FTK Imager

Answer

LiME

Answer

dd

Question 14

Which two of the following are tools used for memory forensics acquisition? (Choose TWO.)

Accepted Answer

WinPmem. WinPmem and LiME are memory acquisition tools for Windows and Linux respectively.

Answer

Autopsy

Answer

FTK Imager

Answer

Volatility

Question 15

During an investigation of a Linux system, an analyst runs `ls -li` and sees that a file's inode number is 0. What does this indicate about the file?

Accepted Answer

The file has been deleted but is still open. In Linux, an inode number of 0 typically indicates a file that has been deleted but is still open by a process. The directory entry may be removed but the inode remains until the file is closed.

Answer

The file is a symbolic link

Answer

The file is a device file

Answer

The file is a hard link