CHFI Storage Forensics and File System Analysis — 40 Questions

Question 1

An analyst recovers a hard drive from a suspect's computer. The drive has a partition table that uses a 32-bit identifier and a maximum partition size of 2 TB. Which partition table type is present?

Accepted Answer

MBR. MBR uses 32-bit partition table entries and supports up to 2 TB partitions. GPT uses 64-bit entries and supports larger disks.

Answer

HFS+

Answer

GPT

Answer

APFS

Question 2

During a forensic investigation, an examiner wants to recover deleted files from a FAT32 file system. Which structure is most critical for file recovery?

Accepted Answer

File Allocation Table (FAT). The File Allocation Table (FAT) contains cluster chains for files; deleted entries may still be recoverable if not overwritten.

Answer

Master File Table (MFT)

Answer

Journal

Answer

Inode table

Question 3

Which tool is specifically designed for file carving and can recover files based on headers and footers without relying on file system metadata?

Accepted Answer

Foremost. Foremost is a file carving tool that uses headers/footers. Autopsy and FTK have carving modules but Foremost is dedicated to it.

Answer

FTK Imager

Answer

Autopsy

Answer

Volatility

Question 4

An analyst notices that a file on an NTFS volume occupies 4096 bytes on disk but its actual data is only 100 bytes. The extra space contains remnants of a previously deleted file. What is this extra space called?

Accepted Answer

File slack. File slack is the unused space between the end of the file data and the end of the last cluster allocated to the file.

Answer

Volume slack

Answer

Free space

Answer

RAM slack

Question 5

A forensic investigator is analyzing a Linux ext4 file system. They suspect a file was deleted but its inode may still be intact. Which tool can be used to recover the file by referencing the inode?

Accepted Answer

debugfs. The 'debugfs' tool can access ext2/3/4 file systems directly and recover files from inodes. 'extundelete' also works, but debugfs is more versatile.

Answer

dd

Answer

scalpel

Answer

foremost

Question 6

During a forensic examination of an NTFS drive, an investigator finds that a file 'notes.txt' has an additional data stream named 'hidden.txt' attached. Which feature of NTFS allows this?

Accepted Answer

Alternate Data Streams (ADS). C is correct because NTFS supports Alternate Data Streams (ADS), a feature that allows multiple data streams to be associated with a single file. The 'hidden.txt' stream attached to 'notes.txt' is a classic example of ADS, which can be used to hide data or store metadata without affecting the file's primary content.

Answer

USN Journal

Answer

MFT

Answer

Slack space

Question 7

A security analyst is investigating a compromised Windows system and wants to see which processes were running at the time of memory capture. Which Volatility command should they use?

Accepted Answer

volatility -f mem.dump pslist. The 'pslist' plugin lists processes from the EPROCESS structures. 'pstree' shows parent-child relationships.

Answer

volatility -f mem.dump hashdump

Answer

volatility -f mem.dump malfind

Answer

volatility -f mem.dump netscan

Question 8

An examiner acquires a forensic image of an SSD from a suspect's laptop. The SSD was connected to a system with TRIM enabled. What challenge will the examiner most likely face when trying to recover deleted files?

Accepted Answer

Deleted files may have been physically erased by TRIM. TRIM causes the SSD to erase blocks that are no longer in use, making file recovery difficult because data is physically erased.

Answer

Wear leveling complicates data location

Answer

RAID striping interferes with imaging

Answer

The SSD is encrypted and cannot be imaged

Question 9

During a forensic analysis of a drive, the examiner discovers a Host Protected Area (HPA). What is the primary purpose of an HPA?

Accepted Answer

To provide a hidden storage area not visible to the OS. HPA is a region on ATA drives that is hidden from the operating system, often used by manufacturers for diagnostic tools or to hide data.

Answer

To store the file system journal

Answer

To accelerate disk read/write operations

Answer

To store backup copies of the MBR

Question 10

An investigator is analyzing a RAID 5 array consisting of three disks. One disk fails and is replaced. After rebuilding, the file system appears corrupted. What is the MOST likely cause?

Accepted Answer

The replacement disk is smaller than the original. RAID 5 can tolerate one disk failure. If the replacement disk is smaller than the original, the rebuild may fail or cause corruption.

Answer

Two disks failed simultaneously

Answer

The file system is not supported by the RAID controller

Answer

The array was configured with an incorrect stripe size

Question 11

During memory analysis, an examiner uses the Volatility 'malfind' plugin and discovers a process with executable code in an executable heap. Which technique is most likely being used by malware to avoid detection?

Accepted Answer

Heap spraying. Executable heap is a sign of code injection; malware may allocate memory with execute permissions and inject shellcode.

Answer

Process hollowing

Answer

DLL injection

Answer

Reflective DLL loading

Question 12

An investigator uses FTK Imager to capture a forensic image of a suspect's hard drive. During acquisition, the tool reports that the DCO (Device Configuration Overlay) is present. What does this indicate?

Accepted Answer

The drive has been tampered with to hide data. DCO is a region beyond the HPA that can hide data; its presence suggests possible data hiding.

Answer

The drive is failing and needs replacement

Answer

The drive supports hardware encryption

Answer

The drive has a GPT partition table

Question 13

Which TWO of the following are file systems that use journaling to maintain integrity?

Accepted Answer

NTFS. NTFS and ext4 both use journaling. FAT32 does not; APFS uses a copy-on-write mechanism but is also journal-like; HFS+ has journaling but the question may expect ext4. However, NTFS and ext4 are clear examples.

Answer

FAT32

Answer

HFS+

Answer

APFS

Question 14

Which THREE of the following are techniques used to hide data on a hard drive?

Accepted Answer

Host Protected Area (HPA). Alternate Data Streams (ADS) hide data in NTFS streams. Slack space can hide data in unused cluster space. HPA hides data in a reserved area on ATA drives. File carving is a recovery technique, not hiding. Hashing verifies integrity.

Answer

File carving

Answer

Hashing

Question 15

Which TWO of the following are challenges specific to SSD forensics compared to HDD forensics?

Accepted Answer

Wear leveling distributes writes, complicating data location. TRIM causes data erasure, and wear leveling makes data location unpredictable. The other options apply to both HDD and SSD.

Answer

File system metadata may be overwritten

Answer

Magnetic remanence allows data recovery

Answer

Slack space contains remnants of deleted files

Question 16

During a forensic examination of a Windows 10 system, an investigator runs the following command: 'fsutil usn readjournal C: > usn_output.txt'. What is the primary purpose of this action?

Accepted Answer

To analyze the Update Sequence Number (USN) journal for file system activity. The USN journal records changes to files and directories. This command reads the journal, which can reveal file creation, deletion, and modification timestamps, even if the MFT entry is modified.

Answer

To recover deleted files from the Recycle Bin

Answer

To check the integrity of the NTFS file system

Answer

To extract the Master File Table ($MFT) from the volume

Question 17

An analyst recovers a disk image from a Linux server that used ext4. The image shows a superblock backup at multiple offsets. Which dd command would correctly extract the backup superblock located at offset 32768 bytes?

Accepted Answer

dd if=image.dd of=superblock.bin bs=512 skip=64 count=2. To extract the backup superblock at offset 32768 with size 1024 bytes, dd needs skip=32768/512=64 and count=1024/512=2.

Answer

dd if=image.dd of=superblock.bin bs=4096 skip=8 count=1

Answer

dd if=image.dd of=superblock.bin bs=1024 skip=32 count=1

Answer

dd if=image.dd of=superblock.bin bs=32768 skip=1 count=1

Question 18

Which file system artifact in NTFS is used to hide data by appending a stream to an existing file without affecting its primary data stream?

Accepted Answer

Alternate Data Streams (ADS). Alternate Data Streams (ADS) allow hiding data by attaching additional streams to files. They are not visible in standard directory listings.

Answer

USN Journal

Answer

$Recycle.bin

Answer

Master File Table ($MFT)

Question 19

During a forensic investigation, an analyst finds a file with a creation timestamp earlier than the volume's formatted timestamp. Which of the following is the most likely explanation?

Accepted Answer

The file's timestamps were deliberately modified to mislead investigators. File timestamps can be manipulated by anti-forensics tools. A creation time before the volume format is a strong indicator of timestamp manipulation.

Answer

The file is actually a link to another file, so its timestamps reflect the source

Answer

The system clock was incorrect at the time of file creation

Answer

The file was created on a different system and copied to this volume

Question 20

In an ext3 file system, after deleting a file, the inode's link count drops to 0, but the data blocks remain. Which of the following is true regarding recovery?

Accepted Answer

The file may be recovered through file carving by searching for known file signatures in the data blocks. In ext3, deleting a file clears the inode and data block pointers. Recovery requires scanning the raw disk for file signatures (file carving) because the inode no longer points to the data.

Answer

The file can be recovered by reading the journal and replaying the deletion transaction

Answer

The file cannot be recovered because ext3 zeroes the inode on deletion

Answer

The file can be recovered by undeleting the inode using debugfs or extundelete