CHFI Storage Forensics and File System Analysis Practice Test 1 — 15 Questions

Question 1

An analyst recovers a hard drive from a suspect's computer. The drive has a partition table that uses a 32-bit identifier and a maximum partition size of 2 TB. Which partition table type is present?

Accepted Answer

MBR. MBR uses 32-bit partition table entries and supports up to 2 TB partitions. GPT uses 64-bit entries and supports larger disks.

Answer

HFS+

Answer

GPT

Answer

APFS

Question 2

During a forensic investigation, an examiner wants to recover deleted files from a FAT32 file system. Which structure is most critical for file recovery?

Accepted Answer

File Allocation Table (FAT). The File Allocation Table (FAT) contains cluster chains for files; deleted entries may still be recoverable if not overwritten.

Answer

Master File Table (MFT)

Answer

Journal

Answer

Inode table

Question 3

Which tool is specifically designed for file carving and can recover files based on headers and footers without relying on file system metadata?

Accepted Answer

Foremost. Foremost is a file carving tool that uses headers/footers. Autopsy and FTK have carving modules but Foremost is dedicated to it.

Answer

FTK Imager

Answer

Autopsy

Answer

Volatility

Question 4

An analyst notices that a file on an NTFS volume occupies 4096 bytes on disk but its actual data is only 100 bytes. The extra space contains remnants of a previously deleted file. What is this extra space called?

Accepted Answer

File slack. File slack is the unused space between the end of the file data and the end of the last cluster allocated to the file.

Answer

Volume slack

Answer

Free space

Answer

RAM slack

Question 5

A forensic investigator is analyzing a Linux ext4 file system. They suspect a file was deleted but its inode may still be intact. Which tool can be used to recover the file by referencing the inode?

Accepted Answer

debugfs. The 'debugfs' tool can access ext2/3/4 file systems directly and recover files from inodes. 'extundelete' also works, but debugfs is more versatile.

Answer

dd

Answer

scalpel

Answer

foremost

Question 6

During a forensic examination of an NTFS drive, an investigator finds that a file 'notes.txt' has an additional data stream named 'hidden.txt' attached. Which feature of NTFS allows this?

Accepted Answer

Alternate Data Streams (ADS). C is correct because NTFS supports Alternate Data Streams (ADS), a feature that allows multiple data streams to be associated with a single file. The 'hidden.txt' stream attached to 'notes.txt' is a classic example of ADS, which can be used to hide data or store metadata without affecting the file's primary content.

Answer

USN Journal

Answer

MFT

Answer

Slack space

Question 7

A security analyst is investigating a compromised Windows system and wants to see which processes were running at the time of memory capture. Which Volatility command should they use?

Accepted Answer

volatility -f mem.dump pslist. The 'pslist' plugin lists processes from the EPROCESS structures. 'pstree' shows parent-child relationships.

Answer

volatility -f mem.dump hashdump

Answer

volatility -f mem.dump malfind

Answer

volatility -f mem.dump netscan

Question 8

An examiner acquires a forensic image of an SSD from a suspect's laptop. The SSD was connected to a system with TRIM enabled. What challenge will the examiner most likely face when trying to recover deleted files?

Accepted Answer

Deleted files may have been physically erased by TRIM. TRIM causes the SSD to erase blocks that are no longer in use, making file recovery difficult because data is physically erased.

Answer

Wear leveling complicates data location

Answer

RAID striping interferes with imaging

Answer

The SSD is encrypted and cannot be imaged

Question 9

During a forensic analysis of a drive, the examiner discovers a Host Protected Area (HPA). What is the primary purpose of an HPA?

Accepted Answer

To provide a hidden storage area not visible to the OS. HPA is a region on ATA drives that is hidden from the operating system, often used by manufacturers for diagnostic tools or to hide data.

Answer

To store the file system journal

Answer

To accelerate disk read/write operations

Answer

To store backup copies of the MBR

Question 10

An investigator is analyzing a RAID 5 array consisting of three disks. One disk fails and is replaced. After rebuilding, the file system appears corrupted. What is the MOST likely cause?

Accepted Answer

The replacement disk is smaller than the original. RAID 5 can tolerate one disk failure. If the replacement disk is smaller than the original, the rebuild may fail or cause corruption.

Answer

Two disks failed simultaneously

Answer

The file system is not supported by the RAID controller

Answer

The array was configured with an incorrect stripe size

Question 11

During memory analysis, an examiner uses the Volatility 'malfind' plugin and discovers a process with executable code in an executable heap. Which technique is most likely being used by malware to avoid detection?

Accepted Answer

Heap spraying. Executable heap is a sign of code injection; malware may allocate memory with execute permissions and inject shellcode.

Answer

Process hollowing

Answer

DLL injection

Answer

Reflective DLL loading

Question 12

An investigator uses FTK Imager to capture a forensic image of a suspect's hard drive. During acquisition, the tool reports that the DCO (Device Configuration Overlay) is present. What does this indicate?

Accepted Answer

The drive has been tampered with to hide data. DCO is a region beyond the HPA that can hide data; its presence suggests possible data hiding.

Answer

The drive is failing and needs replacement

Answer

The drive supports hardware encryption

Answer

The drive has a GPT partition table

Question 13

Which TWO of the following are file systems that use journaling to maintain integrity?

Accepted Answer

NTFS. NTFS and ext4 both use journaling. FAT32 does not; APFS uses a copy-on-write mechanism but is also journal-like; HFS+ has journaling but the question may expect ext4. However, NTFS and ext4 are clear examples.

Answer

FAT32

Answer

HFS+

Answer

APFS

Question 14

Which THREE of the following are techniques used to hide data on a hard drive?

Accepted Answer

Host Protected Area (HPA). Alternate Data Streams (ADS) hide data in NTFS streams. Slack space can hide data in unused cluster space. HPA hides data in a reserved area on ATA drives. File carving is a recovery technique, not hiding. Hashing verifies integrity.

Answer

File carving

Answer

Hashing

Question 15

Which TWO of the following are challenges specific to SSD forensics compared to HDD forensics?

Accepted Answer

Wear leveling distributes writes, complicating data location. TRIM causes data erasure, and wear leveling makes data location unpredictable. The other options apply to both HDD and SSD.

Answer

File system metadata may be overwritten

Answer

Magnetic remanence allows data recovery

Answer

Slack space contains remnants of deleted files