CHFI Practice Test 6 — 10 Questions

Question 1

Which tool is specifically designed to acquire RAM from a Linux system for forensic analysis?

Accepted Answer

LiME. LiME (Linux Memory Extractor) is a Loadable Kernel Module (LKM) specifically designed to capture volatile memory (RAM) from Linux systems. Unlike other tools that rely on user-space access, LiME operates at the kernel level, ensuring a more complete and forensically sound acquisition of the entire physical address space, including memory regions that user-space tools cannot reach.

Answer

WinPmem

Answer

EnCase

Answer

FTK Imager

Question 2

A security analyst suspects an attacker has hidden data in the Host Protected Area (HPA) of a suspect's hard drive. Which of the following tools is BEST suited to detect and access the HPA?

Accepted Answer

EnCase. EnCase is the best tool for detecting and accessing the Host Protected Area (HPA) because it has built-in support for reading ATA commands that identify and access the HPA, such as IDENTIFY DEVICE and SET MAX ADDRESS. It can bypass the operating system's abstraction layer to directly query the drive's native command set, allowing forensic acquisition of the HPA region that is normally hidden from standard disk utilities.

Answer

Foremost

Answer

WinPmem

Answer

PhotoRec

Question 3

A forensic investigator is analyzing a Linux ext4 file system. They suspect a file was deleted but its inode may still be intact. Which tool can be used to recover the file by referencing the inode?

Accepted Answer

debugfs. debugfs is an interactive file system debugger for ext2/ext3/ext4 that allows direct manipulation of inode structures. When a file is deleted but its inode remains intact, debugfs can recover the file by using the `lsdel` command to list deleted inodes and the `dump` command to extract the file contents by referencing the inode number.

Answer

dd

Answer

scalpel

Answer

foremost

Question 4

A security analyst is investigating a compromised Windows server and wants to capture the contents of RAM for analysis. Which of the following tools is specifically designed for this purpose?

Accepted Answer

WinPmem. WinPmem is a dedicated memory acquisition tool designed to capture the contents of RAM from a live Windows system. It creates a raw memory dump file that can be analyzed with tools like Volatility, making it the correct choice for this forensic task.

Answer

Foremost

Answer

Volatility

Answer

FTK Imager

Question 5

A Linux system uses the ext4 filesystem. A forensic analyst needs to recover a recently deleted file. Which of the following methods is MOST likely to succeed if the file's inode has not been reallocated?

Accepted Answer

Run `extundelete /dev/sda1 --restore-file /path/to/file`. `extundelete` is a dedicated tool designed to recover deleted files from ext3/ext4 filesystems by leveraging the filesystem's journal and inode data. If the inode has not been reallocated, the tool can directly restore the file using its path, making it the most targeted and efficient method.

Answer

Mount the filesystem with `mount -o ro,noatime` and browse

Answer

Use `dd` to copy the entire partition and search for the file signature

Answer

Use `ls -la` to view deleted file entries

Question 6

A forensic analyst is investigating a Windows system and needs to examine the contents of the Recycle Bin. Which file artifact contains metadata about deleted files, including original file paths and deletion times?

Accepted Answer

$Recycle.bin\$I. The $I file in the $Recycle.bin folder stores metadata about deleted files, including the original file path, deletion timestamp, and file size. This is the index file that the Recycle Bin uses to restore items to their original locations, making it the correct artifact for examining deletion metadata.

Answer

C:\Windows\System32\winevt\Logs

Answer

$Recycle.bin\$R

Answer

C:\Windows\Prefetch

Question 7

During a forensic analysis of a Windows 10 system, an investigator needs to locate the Master File Table ($MFT) to analyze file metadata. Which file system structure contains the $MFT?

Accepted Answer

NTFS volume's Master File Table. The $MFT is a core component of the NTFS file system, storing metadata for every file and directory on the volume. It is located in the NTFS volume's designated Master File Table area, not in any other file system structure. Option D correctly identifies this NTFS-specific structure.

Answer

ext4 superblock

Answer

FAT32's File Allocation Table

Answer

HFS+ catalog file

Question 8

An analyst suspects that sensitive data was hidden in the NTFS Alternate Data Streams (ADS) of a file on a suspect's drive. Which tool is specifically designed to enumerate and extract data from ADS on a live Windows system?

Accepted Answer

Streams.exe (Sysinternals). Streams.exe from Sysinternals is specifically designed to enumerate and extract data from NTFS Alternate Data Streams (ADS) on a live Windows system. It scans files and directories for hidden streams, displaying their names and sizes, and can optionally delete or extract them. This makes it the correct tool for the analyst's task.

Answer

Foremost

Answer

PhotoRec

Answer

dd

Question 9

An investigator finds evidence of data hidden using Alternate Data Streams (ADS) on an NTFS volume. Which command would display all ADS associated with files in a directory?

Accepted Answer

dir /r. The `dir /r` command in Windows displays alternate data streams (ADS) associated with files on an NTFS volume. ADS are a feature of NTFS that allow additional data to be stored with a file, hidden from standard directory listings. The `/r` switch specifically lists all streams, including the main stream and any alternate streams, making it the correct choice for forensic identification of hidden data.

Answer

dir /s

Answer

dir /x

Answer

dir /a

Question 10

Which of the following best describes the purpose of the Master File Table (MFT) in the NTFS filesystem?

Accepted Answer

It contains metadata and file attribute records for all files and directories. The Master File Table (MFT) is the core of the NTFS filesystem, storing a record for every file and directory on the volume. Each MFT record contains metadata such as timestamps, security descriptors, and file attributes, including the data itself for small files (resident data). This makes C correct because the MFT is fundamentally a database of file and directory metadata.

Answer

It manages the file allocation table for cluster chains

Answer

It stores the partition table and boot sector

Answer

It maintains a journal of all filesystem changes