CHFI Storage Forensics and File System Analysis Practice Test 10 — 15 Questions

Question 1

In an ext4 file system, a forensic analyst needs to examine the journal to recover recently deleted files. Where is the journal typically stored?

Accepted Answer

In a special inode (inode 8). In ext4, the journal is stored as a regular file associated with a special inode, typically inode 8. This design allows the journal to be managed by the file system's standard inode and block allocation mechanisms, rather than being placed in a fixed reserved area. When a file is deleted, its data blocks may still be referenced in the journal until they are overwritten, enabling recovery by replaying or analyzing journal entries.

Answer

In a reserved area after the superblock

Answer

In the superblock

Answer

In the group descriptor table

Question 2

A forensic investigator analyzing a RAID 5 array of three disks notices that one disk has failed. Can the investigator still reconstruct the data?

Accepted Answer

Yes, using the parity information from the remaining disks. RAID 5 uses distributed parity across all disks in the array. When one disk fails, the data can be reconstructed by XORing the data and parity from the remaining disks. Since the parity is spread across all disks (not a dedicated parity disk), the investigator can rebuild the missing data as long as the remaining disks are functional.

Answer

No, RAID 5 requires all disks to be present

Answer

Yes, but only if the failed disk is the parity disk

Answer

No, because RAID 5 does not support hot swapping

Question 3

An analyst is examining a memory dump using Volatility and wants to identify network connections. Which TWO Volatility plugins can be used to list network connections?

Accepted Answer

netscan. The netscan plugin (option A) is correct because it scans memory for network artifacts such as TCP and UDP endpoints, including connections and listening sockets, and works across modern Windows versions by carving pool tags and structures. The connscan plugin (option D) is also correct because it scans physical memory for TCP connection objects (TCPT_OBJECT pool tags) and reports local and remote addresses and ports, making it suitable for older Windows memory images. The dlllist plugin (option B) only lists loaded DLLs per process, pstree (option C) shows parent-child process relationships, and pslist (option E) enumerates active processes; none of these directly list network connections.

Answer

dlllist

Answer

pstree

Answer

pslist

Question 4

A forensic analyst is recovering deleted files from an ext3 file system. Which TWO methods can be used to recover deleted inodes?

Accepted Answer

Analyzing the ext3 journal for deleted inode entries. Option C is correct because the ext3 journal (introduced with journaling) retains metadata transactions, including records of inode allocations and deletions, so analyzing the journal with tools like ext3grep or jls can reveal deleted inode entries and their associated block pointers. Option E is correct because deleted inodes often remain in the inode table with their link count set to zero and are not immediately overwritten; scanning the inode table (e.g., with debugfs's lsdel or by walking inode structures) can identify these orphan inodes and recover their data. Option A is incorrect because file carving tools like Foremost operate on raw data streams and file signatures, not on inode structures, so they do not recover deleted inodes. Option B is incorrect because dd merely creates a bit-for-bit raw image of the disk and performs no inode recovery itself. Option D is incorrect because using debugfs to display the superblock only shows file system metadata such as block counts and mount status, not deleted inode entries.

Answer

Using file carving tools like Foremost

Answer

Using dd to create a raw image

Answer

Using debugfs to display the superblock

Question 5

During a forensic investigation, you encounter a Windows system with an NTFS volume. The suspect claims they never used the recycle bin, but you find files in the $Recycle.bin folder. Which artifact can help you determine the original file path and deletion time?

Accepted Answer

The $I file in the $Recycle.bin folder. The $I file in the $Recycle.bin folder stores metadata about the deleted file, including its original file path and the deletion timestamp. When a file is moved to the Recycle Bin, Windows creates an $I file (e.g., $I<random>.dat) containing this information, which can be parsed to recover the original location and deletion time. This makes it the direct artifact for the investigator's needs.

Answer

The USN journal

Answer

The file slack space

Answer

The $MFT entry for the deleted file

Question 6

An analyst is investigating a Linux server that suffered a data breach. The attacker deleted several log files. The analyst runs `debugfs /dev/sda1` and issues the command `lsdel`. What is the purpose of this command in the context of file recovery?

Accepted Answer

List inodes of deleted files that still have allocated blocks. The `lsdel` command in `debugfs` lists inodes of deleted files that still have allocated data blocks. This is critical in forensic analysis because even after a file is deleted, its inode and data blocks may remain intact until overwritten, allowing recovery of the file's contents.

Answer

Recover deleted files from the journal

Answer

List all deleted directory entries in the journal

Answer

Display the current superblock information

Question 7

A forensic investigator recovers a hard drive from a suspect's computer. The drive is detected as 120 GB in BIOS, but forensic tools report only 100 GB of addressable space. Which data hiding technique is MOST likely being used?

Accepted Answer

Host Protected Area (HPA). The Host Protected Area (HPA) is a region on a hard drive that is hidden from the operating system by using the ATA SET MAX ADDRESS command to reduce the reported addressable space. Since the BIOS detects the full 120 GB but forensic tools see only 100 GB, the HPA is the most likely technique, as it creates a hidden area beyond the reported maximum LBA that is not visible to standard forensic acquisition tools unless specifically addressed.

Answer

Device Configuration Overlay (DCO)

Answer

Volume slack

Answer

Alternate Data Streams (ADS)

Question 8

During a forensic examination of a Windows 10 system, you find a file with an ADS named `:hidden.txt` attached to `legal.docx`. Using FTK Imager, you extract the ADS and discover it contains a list of passwords. Which tool or technique could also be used to identify this hidden data?

Accepted Answer

Analyzing the $MFT using Autopsy. The $MFT (Master File Table) in NTFS stores metadata for every file and directory, including entries for Alternate Data Streams (ADS). By analyzing the $MFT with a tool like Autopsy, you can directly view the ADS names and their associated data, such as the `:hidden.txt` stream attached to `legal.docx`. This is a reliable forensic method because the $MFT is a critical file system structure that records all streams, even if the file system explorer hides them.

Answer

Running `strings` on the raw partition

Answer

Using `lsof` on a live system

Answer

Performing file carving with PhotoRec

Question 9

A security analyst is investigating a compromised Windows server and wants to capture the contents of RAM for analysis. Which of the following tools is specifically designed for this purpose?

Accepted Answer

WinPmem. WinPmem is a dedicated memory acquisition tool designed to capture the contents of RAM from a live Windows system. It creates a raw memory dump file that can be analyzed with tools like Volatility, making it the correct choice for this forensic task.

Answer

Foremost

Answer

Volatility

Answer

FTK Imager

Question 10

During a forensic investigation, you encounter a RAID 5 array consisting of three 1 TB disks. The array is failed, and you need to reconstruct the original data. Which of the following approaches is MOST appropriate for data recovery?

Accepted Answer

Use EnCase to perform a RAID rebuild with known parameters. EnCase Forensic has a built-in RAID reconstruction feature that can automatically rebuild a RAID 5 array from disk images when the RAID parameters (stripe size, parity rotation, disk order) are known or can be detected. This is the most appropriate approach for a failed RAID 5 array, as it handles the parity-based striping and reassembles the logical volume without requiring manual XOR operations or risking data corruption.

Answer

Mount each disk individually and copy files

Answer

Run `mdadm --assemble --scan` on the images

Answer

Use `dd` to image each disk and then XOR the three images together

Question 11

A forensic analyst is examining a USB drive formatted with FAT32. A suspect claims they deleted a file several weeks ago. The analyst uses a carving tool but cannot recover the file. What is the MOST likely reason for the failed recovery?

Accepted Answer

The file clusters were overwritten by new data. File carving relies on finding the file's content clusters on disk, typically by scanning for file headers and footers. If the suspect deleted the file weeks ago, the clusters that held the file's data were likely marked as free in the FAT32 file allocation table and subsequently overwritten by new data written to the drive. This is the most common reason for carving failure on a FAT32 volume that has been in active use after deletion.

Answer

The file was encrypted and cannot be carved

Answer

FAT32 does not support file carving

Answer

The file was stored in the MFT, which is only present in NTFS

Question 12

Which of the following best describes the purpose of the Master File Table (MFT) in the NTFS filesystem?

Accepted Answer

It contains metadata and file attribute records for all files and directories. The Master File Table (MFT) is the core of the NTFS filesystem, storing a record for every file and directory on the volume. Each MFT record contains metadata such as timestamps, security descriptors, and file attributes, including the data itself for small files (resident data). This makes C correct because the MFT is fundamentally a database of file and directory metadata.

Answer

It manages the file allocation table for cluster chains

Answer

It stores the partition table and boot sector

Answer

It maintains a journal of all filesystem changes

Question 13

An investigator acquires an SSD from a laptop that has been turned off for 24 hours. The suspect recently deleted several incriminating files. Using a forensic imager, the investigator creates a bit-for-bit copy. However, when analyzing the image, the deleted files' data appears to be zeros. What is the MOST likely cause?

Accepted Answer

The TRIM command was issued, causing the SSD to erase the freed blocks. The TRIM command is an ATA command that allows an operating system to inform an SSD which data blocks are no longer in use and can be wiped internally. When the suspect deleted the files, the OS likely issued a TRIM command to the SSD, causing the controller to erase the freed physical blocks. Since the laptop was off for 24 hours, the SSD had ample time to complete the garbage collection process, resulting in the deleted files' data appearing as zeros in the forensic image.

Answer

The files were stored in the paging file, which is volatile

Answer

The SSD controller performed wear leveling, moving data to unallocated blocks

Answer

The imaging tool incorrectly interpreted the data due to encryption

Question 14

A Linux system uses the ext4 filesystem. A forensic analyst needs to recover a recently deleted file. Which of the following methods is MOST likely to succeed if the file's inode has not been reallocated?

Accepted Answer

Run `extundelete /dev/sda1 --restore-file /path/to/file`. `extundelete` is a dedicated tool designed to recover deleted files from ext3/ext4 filesystems by leveraging the filesystem's journal and inode data. If the inode has not been reallocated, the tool can directly restore the file using its path, making it the most targeted and efficient method.

Answer

Mount the filesystem with `mount -o ro,noatime` and browse

Answer

Use `dd` to copy the entire partition and search for the file signature

Answer

Use `ls -la` to view deleted file entries

Question 15

During a forensic examination of a Windows system, an analyst runs the Volatility plugin `netscan` on a memory dump. What information does this plugin primarily provide?

Accepted Answer

Network connections and listening sockets with associated processes. The Volatility plugin `netscan` is specifically designed to extract network connection information from Windows memory dumps, including active TCP and UDP connections, listening sockets, and the associated processes that own them. It works by scanning kernel data structures such as `_TCPT_OBJECT` and `_UDP_OBJECT` to provide a snapshot of network activity at the time of capture, which is critical for identifying malicious connections or unauthorized services.

Answer

Open files and handles for each process

Answer

List of all running processes and their parent processes

Answer

The contents of the Windows firewall rules