CHFI Storage Forensics and File System Analysis — 50 Questions

Question 1

An investigator uses FTK Imager to capture a forensic image of a suspect's hard drive. During acquisition, the tool reports that the DCO (Device Configuration Overlay) is present. What does this indicate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The drive has been tampered with to hide data. The Device Configuration Overlay (DCO) is a reserved area on a hard drive that can be used to hide data from the operating system and standard forensic tools. Its presence during acquisition with FTK Imager indicates that the drive may have been deliberately tampered with to conceal data, as the DCO can be created or modified to store information outside the normally accessible user area.

Answer

The drive is failing and needs replacement

Answer

The drive supports hardware encryption

Answer

The drive has a GPT partition table

Question 2

Which THREE of the following are file systems that use journaling to maintain integrity?

Accepted Answer

NTFS. NTFS (A) is correct because it is a journaling file system that records metadata transactions in the $LogFile ($LogFile metadata file) so that the volume can be recovered to a consistent state after a crash. ext4 (C) is correct because it is a journaling file system that uses the JBD2 (Journaling Block Device 2) layer to journal metadata (and optionally data) operations, ensuring file system integrity after an unclean shutdown. HFS+ (D) is correct because it is a journaling file system that maintains a journal to protect the catalog and other metadata structures, allowing fast recovery and consistency checks. FAT32 (B) is not correct because it is a non-journaling file system that relies on FAT table copies and consistency-check tools rather than a transaction journal. APFS (E) is not correct in this context because, although it is a modern copy-on-write file system with crash protection, it does not use a traditional journaling mechanism like NTFS, ext4, or HFS+.

Answer

FAT32

Answer

APFS

Question 3

During a forensic investigation, an analyst finds a file with a creation timestamp earlier than the volume's formatted timestamp. Which of the following is the most likely explanation?

Accepted Answer

The file's timestamps were deliberately modified to mislead investigators. Timestamp manipulation is a known anti-forensic technique. File system metadata, including creation timestamps, can be altered using tools like `SetFile` (macOS) or `touch` (Linux) with the `-t` flag, or via direct hex editing of the MFT entry in NTFS. A creation timestamp earlier than the volume format timestamp is a strong indicator of deliberate tampering, as no legitimate file creation can occur before the volume itself exists.

Answer

The file is actually a link to another file, so its timestamps reflect the source

Answer

The system clock was incorrect at the time of file creation

Answer

The file was created on a different system and copied to this volume

Question 4

In an ext3 file system, after deleting a file, the inode's link count drops to 0, but the data blocks remain. Which of the following is true regarding recovery?

Accepted Answer

The file may be recovered through file carving by searching for known file signatures in the data blocks. After a file is deleted in ext3, the inode's link count drops to 0 and the inode is marked as free, but the inode structure and data blocks remain intact until overwritten. Therefore, file carving (B) can recover the file by searching for known file signatures in the unallocated data blocks. Additionally, tools like extundelete or debugfs can recover the file by scanning the inode table for inodes with link count 0 and using their still-valid block pointers (D). The journal does not provide a rollback mechanism for file deletion (A is false), and ext3 does not zero the inode on deletion (C is false).

Answer

The file can be recovered by reading the journal and replaying the deletion transaction

Answer

The file cannot be recovered because ext3 zeroes the inode on deletion

Question 5

An investigator uses the Volatility framework on a memory dump from a Windows 10 system. Which command would list all processes, including those hidden by rootkits?

Accepted Answer

volatility -f memory.dmp --profile=Win10x64 psxview. `psxview` in the Volatility framework is specifically designed to detect hidden processes by cross-referencing process listings from multiple sources (e.g., PsActiveProcessHead linked list, EPROCESS pool scanning, and CSRSS handle table). This allows it to reveal processes that rootkits have hidden by unlinking them from the standard list, which `pslist` and `pstree` rely on.

Answer

volatility -f memory.dmp --profile=Win10x64 psscan

Answer

volatility -f memory.dmp --profile=Win10x64 pslist

Answer

volatility -f memory.dmp --profile=Win10x64 pstree

Question 6

A forensic investigator is examining a Mac system with APFS. Which artifact would be most useful for determining the exact time a file was moved to the Trash?

Accepted Answer

The APFS journal (fsroot) records the move operation with a timestamp. The APFS journal (fsroot) records metadata changes, including file moves to the Trash, with precise timestamps. This is because APFS uses a copy-on-write design where each volume has a journal that logs all structural modifications, making it the most reliable source for the exact time of the move operation.

Answer

The file's creation timestamp in the directory entry

Answer

The .DS_Store file in the Trash folder

Answer

The 'com.apple.metadata:kMDItemWhereFroms' extended attribute

Question 7

In a RAID 5 array with three disks, one disk fails. The investigator images the remaining two disks and wants to reconstruct the missing data. Which approach is most appropriate?

Accepted Answer

Apply XOR operation between the two disk images to recover missing data. In a RAID 5 array with three disks, data is striped across all disks with distributed parity. The parity is computed using XOR (exclusive OR) across corresponding blocks. When one disk fails, the missing data can be reconstructed by applying XOR between the corresponding blocks of the remaining two disks, because XOR is its own inverse: A XOR B XOR C = 0, so C = A XOR B. This is the fundamental mathematical principle behind RAID 5 recovery.

Answer

Mount the two disks in a Linux mdadm array with a missing disk

Answer

Use dd to concatenate the two disk images linearly

Answer

Use a tool like R-Studio to perform a virtual RAID rebuild

Question 8

An investigator is analyzing a memory dump with Volatility and wants to identify network connections. Which TWO commands can provide information about TCP and UDP connections? (Select 2)

Accepted Answer

volatility -f mem.dmp netscan. Option A, `volatility -f mem.dmp netscan`, is correct because the netscan plugin scans the memory image for TCP and UDP endpoints and listening sockets across all supported Windows versions, reporting local/remote addresses, ports, and owning process. Option C, `volatility -f mem.dmp netstat`, is correct because the netstat plugin parses the kernel structures for active TCP connections and UDP endpoints (with version-specific support) to enumerate network connections in the dump. Option B is not a valid Volatility plugin, so `connections` would not produce network-connection data. Option D, `pslist`, only enumerates running processes and provides no socket information. Option E, `dlllist`, lists loaded DLLs per process and likewise does not report TCP/UDP connections.

Answer

volatility -f mem.dmp connections

Answer

volatility -f mem.dmp pslist

Answer

volatility -f mem.dmp dlllist

Question 9

During an investigation, an analyst recovers deleted files from an NTFS volume. She notices that some files have data hidden in a stream that is not visible in regular directory listings. This stream is associated with a file but not stored in the $MFT. Which NTFS feature is being used to hide the data?

Accepted Answer

Alternate Data Streams (ADS). Alternate Data Streams (ADS). In NTFS, ADS allows data to be hidden in a file stream that is not visible in standard directory listings (e.g., via `dir` or Explorer). This stream is associated with a file but is not stored in the $MFT; instead, it is referenced through the file's $DATA attributes, enabling data concealment without altering the visible file size.

Answer

Journaling in NTFS

Answer

Extended attributes in ext4

Answer

Volume shadow copy

Question 10

In FAT32, the File Allocation Table (FAT) is used to track which clusters are allocated to files. If a file is deleted, what happens to the FAT entries for that file?

Accepted Answer

The FAT entries are overwritten with zeros. When a file is deleted in FAT32, the operating system marks the corresponding FAT entries as free by overwriting them with zeros (0x0000). This indicates that the clusters are available for reuse, while the actual file data remains on the disk until overwritten. The directory entry is also marked as deleted by replacing the first byte of the filename with 0xE5.

Answer

The FAT entries are encrypted

Answer

The FAT entries are preserved intact

Answer

The FAT entries are moved to a journal

Question 11

During a forensic examination of an ext4 filesystem, the analyst discovers that a suspicious file was deleted but the inode still exists in the filesystem. Which of the following techniques would MOST likely recover the file's data?

Accepted Answer

Use the `debugfs` utility with the `undel` command. The `debugfs` utility with the `undel` command is specifically designed to recover deleted files on ext2/ext3/ext4 filesystems by linking the orphaned inode back into the directory structure. Since the inode still exists, the metadata (pointers to data blocks) is intact, allowing direct recovery without carving.

Answer

Analyze the USN journal in NTFS

Answer

Run PhotoRec to carve unallocated space

Answer

Mount the filesystem and copy the file

Question 12

Which TWO of the following are valid techniques for acquiring RAM in a Windows system?

Accepted Answer

WinPmem. WinPmem is a dedicated memory acquisition tool for Windows that uses the WinPmem driver to access physical memory directly, bypassing OS protections. It is widely used in forensic acquisitions because it can capture RAM with minimal interference and supports both 32-bit and 64-bit Windows systems.

Answer

Sleuth Kit

Answer

LiME

Answer

dd

Question 13

During a forensic investigation, you find an NTFS volume with a file that has an alternate data stream (ADS). Which command in Windows can be used to list all ADS on a file?

Accepted Answer

dir /r. The `dir /r` command in Windows displays all alternate data streams (ADS) associated with files on an NTFS volume. The `/r` switch specifically enumerates any ADS attached to files, showing the stream name and its size, which is essential for forensic analysis of hidden data.

Answer

dir /a

Answer

fsutil stream query

Answer

attrib /s

Question 14

An analyst is investigating a compromised Linux system and runs `ls -i` on a deleted file's directory. The inode number is 12345. Which tool can recover the file contents by referencing the inode?

Accepted Answer

debugfs. debugfs is a native Linux ext2/ext3/ext4 file system debugger that can recover deleted files by their inode number. To recover a deleted file, the analyst should open the device with `debugfs /dev/sdX`, use `lsdel` to identify the deleted inode (or use an inode previously recorded), then use `cat` or `rdump` inside debugfs to extract the file contents directly from the inode. A standard `ls -i` on the live directory would not reveal the inode of an already-deleted file.

Answer

scalpel

Answer

foremost

Answer

icat

Question 15

In NTFS, the $MFT file contains metadata about every file and directory on the volume. When a file is deleted, its $MFT record is marked as free. What information in the $MFT record is MOST useful for recovering a deleted file?

Accepted Answer

The data attribute. When a file is deleted in NTFS, the $MFT record is marked as free, but the data attribute (which contains the actual file content or pointers to clusters on disk) often remains intact until overwritten. This makes the data attribute the most useful for recovering the file's contents, as it directly provides access to the stored data.

Answer

The file name attribute

Answer

The standard information attribute

Answer

The security descriptor

Question 16

During a forensic analysis of a compromised server, you discover that a rootkit has hidden itself by modifying the HPA (Host Protected Area) of the hard disk. Which tool can detect the presence of an HPA by comparing the reported size with the actual number of sectors?

Accepted Answer

hdparm. hdparm (option D) is correct because it can query the ATA IDENTIFY DEVICE data and compare the reported total number of sectors (words 60-61) with the actual number of sectors accessible via LBA, thereby detecting a discrepancy caused by an HPA. The `-N` flag specifically displays or sets the HPA size, making it the standard tool for HPA detection in forensic examinations.

Answer

smartctl

Answer

dd

Answer

fdisk

Question 17

Which TWO of the following are common challenges in SSD forensics that can hinder data recovery?

Accepted Answer

TRIM. TRIM (B) is a correct answer because the ATA TRIM command lets the SSD controller proactively erase blocks that the OS marks as deleted, so data can be physically wiped within seconds or minutes of deletion, defeating traditional file-recovery techniques. Wear levelling (E) is also correct because the SSD controller spreads writes across all flash blocks to equalize wear, so logical block addresses no longer map predictably to physical NAND locations, breaking the LBA-to-physical correspondence that forensic tools rely on. File fragmentation (A) is not SSD-specific and is generally handled by filesystem metadata, bad sectors (C) are a generic storage failure mode not unique to SSDs, and NTFS permissions (D) are a logical access-control feature that does not impede raw data recovery.

Answer

File fragmentation

Answer

Bad sectors

Answer

NTFS permissions

Question 18

A forensic examiner acquires a RAM image from a Windows 10 system and uses Volatility to analyze it. Which command would list all running processes along with their parent process IDs and command lines?

Accepted Answer

volatility -f mem.raw pstree. The `pstree` plugin in Volatility displays running processes in a tree format showing parent-child relationships, and by default includes the process name, PID, PPID, and command line. This meets the requirement of listing all running processes with their parent process IDs and command lines.

Answer

volatility -f mem.raw pslist

Answer

volatility -f mem.raw netscan

Answer

volatility -f mem.raw cmdline

Question 19

During a forensic analysis of an APFS volume, the investigator needs to examine file metadata such as creation time, modification time, and extended attributes. Which APFS structure contains this information?

Accepted Answer

Inode Table. In APFS, file metadata such as creation time, modification time, and extended attributes are stored in the inode table (also called the object map for files). Each file and directory is represented by an inode, which contains a fixed set of timestamps (e.g., creation, modification, access) and a field for extended attributes. The inode table is the primary structure for per-file metadata, making option C correct.

Answer

Volume Superblock

Answer

Journal

Answer

Extent Reference Tree

Question 20

Which TWO of the following are valid methods to hide data on an NTFS volume? (Choose two.)

Accepted Answer

Storing data in the $Recycle.bin folder. Option A is correct because the $Recycle.bin folder on an NTFS volume can be used to conceal data: files placed there are renamed to $R (recycled) or $I (metadata) entries and are not visible through normal directory listings, making it a recognized NTFS data-hiding location. Option D is correct because Alternate Data Streams (ADS) allow additional named streams (e.g., file.txt:hidden.txt) to be attached to an NTFS file; these streams are not shown by standard tools like dir or Windows Explorer, so they are a classic NTFS data-hiding method. Option B is incorrect because the volume boot record holds boot code and filesystem parameters, not a practical location for hiding user data. Option C is incorrect because MFT resident data is the normal storage for small files within their own MFT record, not a covert hiding technique. Option E is incorrect because the USN journal is a change-logging mechanism that records file system updates, not a data-hiding location.

Answer

Using the volume boot record

Answer

Using the MFT resident data area

Answer

Using the USN journal