CHFI Storage Forensics and File System Analysis Practice Test 10 — 15 Questions

Question 1

An analyst is examining a Windows 10 system and suspects the use of NTFS alternate data streams (ADS) to hide malicious executables. Which THREE methods can the analyst use to detect hidden ADS on the system?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Checking the $MFT for $DATA attributes where the attribute name is not empty. All three methods are valid for detecting NTFS alternate data streams (ADS). Option A is correct because the $MFT $DATA attribute for an ADS has a non-empty name (the stream name), while the primary data stream has an empty name. Option B is correct because Sysinternals streams.exe is a dedicated tool for listing all streams on a drive. Option E is correct because `dir /r` is a native Windows command (available in Command Prompt since Windows 2000) that displays files along with their alternate data streams. This command shows the stream names after the main file listing.

Answer

Comparing file sizes from `dir` output with raw disk sector counts

Answer

Running `sfc /scannow` to verify system file integrity

Question 2

An analyst is preparing to analyze a RAID 5 array of three disks. The analyst wants to reconstruct the logical volume for file system analysis. Which THREE steps are essential in this process?

Accepted Answer

Use a tool like `mdadm` (Linux) or RAID reconstructor (Windows) to assemble the array. `mdadm` (Linux) or RAID reconstructor (Windows) are standard tools used to assemble a RAID 5 array from its member disks. These tools read the RAID metadata (e.g., superblock) to automatically determine the disk order, stripe size, and parity rotation, allowing the logical volume to be reconstructed for file system analysis. Without this step, the analyst cannot access the logical volume as a single contiguous block device.

Answer

Zero out the first sector of each disk to remove remnants of previous arrays

Answer

Run `chkdsk` on each individual disk before reconstruction

Question 3

Which tool is specifically designed for file carving and can recover files based on headers and footers without relying on file system metadata?

Accepted Answer

Foremost. Foremost is a file carving tool that recovers files by scanning raw data for known header and footer signatures, such as JPEG headers (0xFFD8) and footers (0xFFD9), without relying on file system metadata like MFT entries or inodes. This makes it ideal for data recovery from damaged or formatted volumes where the file system structure is unavailable.

Answer

FTK Imager

Answer

Autopsy

Answer

Volatility

Question 4

An analyst notices that a file on an NTFS volume occupies 4096 bytes on disk but its actual data is only 100 bytes. The extra space contains remnants of a previously deleted file. What is this extra space called?

Accepted Answer

File slack. File slack is the unused space between the end of the actual file data and the end of the last allocated cluster for that file. On an NTFS volume with a 4096-byte cluster size, a 100-byte file leaves 3996 bytes of slack space, which may contain remnants of previously deleted files. This is why option D is correct.

Answer

Volume slack

Answer

Free space

Answer

RAM slack

Question 5

An analyst recovers a disk image from a Linux server that used ext4. The image shows a superblock backup at multiple offsets. Which dd command would correctly extract the backup superblock located at offset 32768 bytes?

Accepted Answer

dd if=image.dd of=superblock.bin bs=512 skip=64 count=2. Both options B and C correctly extract the backup superblock from the disk image. The ext4 superblock is 1024 bytes and starts at offset 32768 bytes. With bs=512, skip=64 gives offset 32768 (64*512=32768), and count=2 reads 1024 bytes (2*512=1024). With bs=1024, skip=32 gives offset 32768 (32*1024=32768), and count=1 reads 1024 bytes. Both commands extract exactly the superblock. Option A uses bs=4096 and count=1, reading 4096 bytes, which is too much and may include adjacent data. Option D uses bs=32768 and count=1, reading 32768 bytes, far exceeding the superblock size.

Answer

dd if=image.dd of=superblock.bin bs=4096 skip=8 count=1

Answer

dd if=image.dd of=superblock.bin bs=32768 skip=1 count=1

Question 6

What is the primary purpose of the Host Protected Area (HPA) on a hard disk drive?

Accepted Answer

To store diagnostic data or allow vendors to hide data from the OS. HPA is a reserved area on the disk that is not visible to the operating system, intended for vendor-specific data. It can be used to hide data from forensic acquisition.

Answer

To provide a write-cache for improved performance

Answer

To store the partition table when using GPT

Answer

To store the operating system boot loader

Question 7

An investigator notes that a file on an NTFS volume has a resident data size of 900 bytes, but the $DATA attribute lists an allocated size of 1024 bytes. What does this indicate?

Accepted Answer

The file has slack space that may contain remnants of previously deleted data. On an NTFS volume, when a file's data is stored as a resident attribute within the MFT, the $DATA attribute's allocated size is typically 0 because the data occupies space only within the MFT record itself. Here, the allocated size is 1024 bytes, which is larger than the resident data size of 900 bytes. This indicates that the file is stored non-resident (i.e., in clusters outside the MFT), and the allocated size reflects the cluster size (e.g., 1024 bytes per cluster). The difference between the allocated size (1024 bytes) and the actual data size (900 bytes) is slack space, which may contain remnants of previously deleted data.

Answer

The file is compressed using NTFS compression

Answer

The file's data is stored in the MFT as a resident attribute

Answer

The file is stored in an alternate data stream

Question 8

Which TWO of the following are valid techniques for acquiring RAM in a Windows system?

Accepted Answer

WinPmem. WinPmem is a dedicated memory acquisition tool for Windows that uses the WinPmem driver to access physical memory directly, bypassing OS protections. It is widely used in forensic acquisitions because it can capture RAM with minimal interference and supports both 32-bit and 64-bit Windows systems.

Answer

Sleuth Kit

Answer

LiME

Answer

dd

Question 9

During a forensic examination of a solid-state drive (SSD), you notice that files deleted several months ago cannot be recovered using traditional file carving tools. Which SSD feature is MOST likely preventing recovery?

Accepted Answer

TRIM. The TRIM command (ATA Data Set Management command) allows the operating system to inform the SSD which data blocks are no longer in use. When TRIM is enabled, the SSD's controller immediately erases those blocks internally, making the original file data unrecoverable by file carving tools because the physical NAND cells are zeroed or marked as invalid. For files deleted months ago, TRIM would have already been issued for those LBAs, so traditional carving that relies on residual data in unallocated space fails.

Answer

Over-provisioning

Answer

Garbage Collection

Answer

Wear levelling

Question 10

An investigator needs to recover a deleted partition from a disk that originally used an MBR partition table. Which tool can scan the disk for lost partitions and rebuild the partition table?

Accepted Answer

TestDisk. TestDisk is specifically designed for data recovery and can scan a disk for lost partitions by analyzing the underlying MBR (Master Boot Record) structure. It can rebuild the partition table by searching for partition boot sectors and file system signatures, allowing recovery of deleted or corrupted partitions. This makes it the correct tool for the scenario described.

Answer

FTK Imager

Answer

Autopsy

Answer

PhotoRec

Question 11

An investigator is examining a FAT32 filesystem and needs to recover a deleted file. In FAT32, the directory entry for a deleted file has the first byte of the filename set to 0xE5. What does this indicate?

Accepted Answer

The file has been deleted. In FAT32, when a file is deleted, the directory entry's first byte (the filename's first character) is overwritten with the value 0xE5. This is a deliberate marker used by the file system to indicate that the entry is available for reuse, meaning the file has been logically deleted. The data clusters remain intact until overwritten, which is why recovery tools look for entries with this byte to restore deleted files.

Answer

The file is a system file

Answer

The file is hidden

Answer

The file is encrypted

Question 12

A forensic examiner finds a file on an NTFS volume that appears to have data hidden in its alternate data stream. The file's size is reported as 10 KB, but the volume's cluster size is 4 KB. How many clusters of file slack could potentially contain hidden data in the primary stream?

Accepted Answer

2 KB. The file's primary stream occupies 10 KB, which requires 3 clusters (3 × 4 KB = 12 KB). The slack space is the unused portion of the last cluster: 12 KB - 10 KB = 2 KB. This 2 KB of file slack in the primary stream could potentially contain hidden data, making option C correct.

Answer

12 KB

Answer

4 KB

Answer

0 KB

Question 13

During a forensic investigation, you need to acquire the RAM of a running Linux system. Which tool is specifically designed for memory acquisition on Linux?

Accepted Answer

LiME. LiME (Linux Memory Extractor) is the correct tool because it is specifically designed to capture volatile memory (RAM) from Linux systems, loading as a loadable kernel module (LKM) to dump memory contents to a file or over the network. Unlike generic tools, LiME handles kernel address space layout randomization (KASLR) and can acquire memory without altering the system state, making it the standard for Linux forensic memory acquisition.

Answer

Memdump

Answer

Volatility

Answer

WinPmem

Question 14

A forensic investigator examines a hard drive and needs to recover deleted files. Which tool is specifically designed for file carving by scanning raw data for file headers and footers without relying on the file system?

Accepted Answer

Foremost. Foremost is a file carving tool that scans raw disk data for known file headers and footers (e.g., JPEG, PDF, ZIP) to recover files independently of the file system metadata. This makes it ideal when the file system is damaged or deleted, as it relies solely on content signatures rather than directory structures.

Answer

Volatility

Answer

Autopsy

Answer

FTK Imager

Question 15

During a forensic analysis of an NTFS volume, an investigator finds a file that appears to be hidden. Which NTFS feature allows data to be stored in a file without affecting the file's visible size in the directory listing?

Accepted Answer

Alternate Data Streams (ADS). Alternate Data Streams (ADS) allow additional data to be attached to a file on an NTFS volume without altering the file's main data stream or its visible size in directory listings. This is possible because NTFS organizes file data into multiple streams; the default $DATA stream holds the visible content, while additional named streams can store hidden data. Tools like `dir` or Windows Explorer only report the size of the unnamed $DATA stream, making ADS an effective method for concealing data.

Answer

Volume Shadow Copy

Answer

USN Journal

Answer

Master File Table ($MFT)