CHFI Practice Test 5 — 10 Questions

Question 1

An analyst is investigating a compromised Linux system. Which file system structure holds metadata about every file and directory, including permissions, ownership, timestamps, and pointers to data blocks?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Inode. The inode is the fundamental data structure in Unix/Linux file systems (e.g., ext2/3/4) that stores metadata for each file and directory, including permissions, ownership, timestamps (access, modify, change), and pointers to data blocks. Unlike the superblock or block bitmap, the inode does not store the file name (which is in directory entries) but contains all other essential metadata required for file system operations.

Answer

Journal

Answer

Block bitmap

Answer

Superblock

Question 2

During a forensic examination, the analyst encounters a file that is not automatically readable by forensic tools. The analyst suspects the file contains contraband images. Which of the following is the BEST approach to handle this evidence in accordance with the rules of evidence?

Accepted Answer

Create a forensic copy and use a write blocker to access the copy with appropriate software.. Forensic best practices require creating a bit-for-bit forensic copy of the original evidence and using a write blocker to prevent any alteration to the original. The analyst can then use specialized software (e.g., a hex editor, file carving tools, or a viewer that supports the file's raw format) to access the copy and extract contraband images without violating the integrity of the evidence, which is essential for admissibility under rules of evidence such as the Federal Rules of Evidence (FRE) 901.

Answer

Delete the file to prevent accidental distribution.

Answer

Ignore the file because it cannot be easily read.

Answer

Open the file using the original application on the suspect's computer.

Question 3

An analyst is investigating a Linux server running ext4 and needs to recover deleted files that may have been overwritten partially. Which technique is BEST suited for recovering fragments of known file types when the inode metadata is lost?

Accepted Answer

Perform file carving using 'foremost' with custom signatures. When inode metadata is lost, file system-based recovery tools like extundelete cannot function because they rely on that metadata. File carving with foremost uses content-based signatures (magic bytes) to locate and extract file fragments, even from partially overwritten areas of the disk. This makes it the best choice for recovering fragments of known file types when the file system metadata is unavailable.

Answer

Use 'dd' to extract the partition and then 'grep' for strings

Answer

Manually reconstruct the inode table using 'debugfs'

Answer

Use 'extundelete' to recover files from the journal

Question 4

An analyst recovers a hard drive from a suspect's computer. The drive has a partition table that uses a 32-bit identifier and a maximum partition size of 2 TB. Which partition table type is present?

Accepted Answer

MBR. The Master Boot Record (MBR) partition table uses a 32-bit identifier for partition entries and, with traditional 512-byte sectors, supports a maximum partition size of 2 TB. This matches the description exactly, making MBR the correct answer.

Answer

HFS+

Answer

GPT

Answer

APFS

Question 5

What is slack space in a file system?

Accepted Answer

The unused portion of a file's last cluster. Slack space is the unused portion of the last cluster allocated to a file. When a file does not exactly fill its final cluster, the remaining bytes in that cluster are slack space, which can contain remnants of previously deleted data. This is a critical area in file system forensics because it may hold hidden evidence.

Answer

Space used by the file system journal

Answer

Space reserved for the MBR

Answer

Space between partitions on a disk

Question 6

Which TWO artifacts are commonly used to identify USB device insertion history on a Windows system? (Select TWO.)

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR. The USBSTOR registry key and setupapi.dev.log contain information about USB devices connected to the system, including device IDs and timestamps.

Answer

NTUSER.DAT

Answer

prefetch files

Answer

Event ID 7045

Question 7

A forensic analyst is examining a disk image and needs to identify the file system structure. She looks for the Master File Table ($MFT) to begin analysis. Which file system is she most likely dealing with?

Accepted Answer

NTFS. The Master File Table ($MFT) is a core component of the NTFS file system, storing metadata about every file and directory on the volume. When a forensic analyst locates the $MFT, they are definitively working with an NTFS volume, as no other common file system uses this structure.

Answer

FAT32

Answer

HFS+

Answer

ext4

Question 8

A forensic analyst finds a partition that uses the Master Boot Record (MBR) scheme. Which of the following is TRUE about the MBR partition table?

Accepted Answer

It stores partition information in a 64-byte table. The MBR partition table is exactly 64 bytes in size, divided into four 16-byte entries. Each entry stores the starting and ending CHS/LBA addresses, partition type, and boot flag. This fixed-size table is the defining characteristic of the MBR scheme, limiting it to four primary partitions.

Answer

It uses a 128-bit Globally Unique Identifier (GUID) for partitions

Answer

It supports disks larger than 2 TiB

Answer

It stores a backup partition table at the end of the disk

Question 9

A security analyst is investigating a compromised Windows system and wants to see which processes were running at the time of memory capture. Which Volatility command should they use?

Accepted Answer

volatility -f mem.dump pslist. The `pslist` plugin in Volatility enumerates processes from the Windows kernel's EPROCESS structure list, showing all active processes at the time of memory capture. This is the correct command to identify running processes from a memory dump, as it directly parses the doubly-linked list of process objects maintained by the kernel.

Answer

volatility -f mem.dump hashdump

Answer

volatility -f mem.dump malfind

Answer

volatility -f mem.dump netscan

Question 10

During memory analysis, an examiner uses the Volatility 'malfind' plugin and discovers a process with executable code in an executable heap. Which technique is most likely being used by malware to avoid detection?

Accepted Answer

Heap spraying. The 'malfind' plugin in Volatility detects memory pages with executable code in non-standard locations, such as executable heaps. Heap spraying is a technique where malware allocates multiple heap blocks and fills them with malicious shellcode, then exploits a vulnerability to redirect execution to that heap. This results in executable code present in heap memory, which malfind flags.

Answer

Process hollowing

Answer

DLL injection

Answer

Reflective DLL loading