CHFI Storage Forensics and File System Analysis Practice Test 10 — 15 Questions

Question 1

During a forensic investigation, you encounter a Windows system with an NTFS volume. The suspect claims they never used the recycle bin, but you find files in the $Recycle.bin folder. Which artifact can help you determine the original file path and deletion time?

Accepted Answer

The $I file in the $Recycle.bin folder. The $Recycle.bin contains $I (info) and $R (data) files. The $I file stores metadata including original filename, path, and deletion timestamp.

Answer

The USN journal

Answer

The file slack space

Answer

The $MFT entry for the deleted file

Question 2

An analyst is investigating a Linux server that suffered a data breach. The attacker deleted several log files. The analyst runs `debugfs /dev/sda1` and issues the command `lsdel`. What is the purpose of this command in the context of file recovery?

Accepted Answer

List inodes of deleted files that still have allocated blocks. debugfs is a tool for ext2/3/4 filesystem debugging. The `lsdel` command lists inodes of deleted files that still have allocated blocks, enabling recovery.

Answer

Recover deleted files from the journal

Answer

List all deleted directory entries in the journal

Answer

Display the current superblock information

Question 3

A forensic investigator recovers a hard drive from a suspect's computer. The drive is detected as 120 GB in BIOS, but forensic tools report only 100 GB of addressable space. Which data hiding technique is MOST likely being used?

Accepted Answer

Host Protected Area (HPA). Host Protected Area (HPA) is a region on ATA drives that can be hidden from the OS by using the SET MAX ADDRESS command. It is commonly used for hiding data.

Answer

Device Configuration Overlay (DCO)

Answer

Volume slack

Answer

Alternate Data Streams (ADS)

Question 4

During a forensic examination of a Windows 10 system, you find a file with an ADS named `:hidden.txt` attached to `legal.docx`. Using FTK Imager, you extract the ADS and discover it contains a list of passwords. Which tool or technique could also be used to identify this hidden data?

Accepted Answer

Analyzing the $MFT using Autopsy. Autopsy (Sleuth Kit) can list alternate data streams when viewing file metadata. The `istat` command in TSK also shows ADS, but Autopsy is a common GUI tool.

Answer

Running `strings` on the raw partition

Answer

Using `lsof` on a live system

Answer

Performing file carving with PhotoRec

Question 5

A security analyst is investigating a compromised Windows server and wants to capture the contents of RAM for analysis. Which of the following tools is specifically designed for this purpose?

Accepted Answer

WinPmem. WinPmem is a memory acquisition tool for Windows, part of the Rekall project, used to dump physical memory.

Answer

Foremost

Answer

Volatility

Answer

FTK Imager

Question 6

During a forensic investigation, you encounter a RAID 5 array consisting of three 1 TB disks. The array is failed, and you need to reconstruct the original data. Which of the following approaches is MOST appropriate for data recovery?

Accepted Answer

Use EnCase to perform a RAID rebuild with known parameters. Forensic tools like EnCase or FTK can reconstruct RAID arrays if the parameters (stripe size, parity order) are known. Manual reconstruction using dd and parity calculations is possible but error-prone.

Answer

Mount each disk individually and copy files

Answer

Run `mdadm --assemble --scan` on the images

Answer

Use `dd` to image each disk and then XOR the three images together

Question 7

A forensic analyst is examining a USB drive formatted with FAT32. A suspect claims they deleted a file several weeks ago. The analyst uses a carving tool but cannot recover the file. What is the MOST likely reason for the failed recovery?

Accepted Answer

The file clusters were overwritten by new data. On FAT32, when a file is deleted, the directory entry is marked as deleted (first byte set to 0xE5) and the FAT clusters are freed. If the clusters have been reallocated and overwritten, carving fails.

Answer

The file was encrypted and cannot be carved

Answer

FAT32 does not support file carving

Answer

The file was stored in the MFT, which is only present in NTFS

Question 8

Which of the following best describes the purpose of the Master File Table (MFT) in the NTFS filesystem?

Accepted Answer

It contains metadata and file attribute records for all files and directories. The MFT is a relational database containing one or more records for each file and directory on the volume, storing metadata such as timestamps, permissions, and data runs.

Answer

It manages the file allocation table for cluster chains

Answer

It stores the partition table and boot sector

Answer

It maintains a journal of all filesystem changes

Question 9

An investigator acquires an SSD from a laptop that has been turned off for 24 hours. The suspect recently deleted several incriminating files. Using a forensic imager, the investigator creates a bit-for-bit copy. However, when analyzing the image, the deleted files' data appears to be zeros. What is the MOST likely cause?

Accepted Answer

The TRIM command was issued, causing the SSD to erase the freed blocks. Many SSDs implement TRIM, which instructs the controller to erase blocks that are no longer in use. If the OS issued TRIM commands before shutdown, the deleted data may have been physically erased.

Answer

The files were stored in the paging file, which is volatile

Answer

The SSD controller performed wear leveling, moving data to unallocated blocks

Answer

The imaging tool incorrectly interpreted the data due to encryption

Question 10

A Linux system uses the ext4 filesystem. A forensic analyst needs to recover a recently deleted file. Which of the following methods is MOST likely to succeed if the file's inode has not been reallocated?

Accepted Answer

Run `extundelete /dev/sda1 --restore-file /path/to/file`. extundelete is a utility that can recover deleted files on ext3/4 by parsing the journal and inode information. It works best if the inode is still intact.

Answer

Mount the filesystem with `mount -o ro,noatime` and browse

Answer

Use `dd` to copy the entire partition and search for the file signature

Answer

Use `ls -la` to view deleted file entries

Question 11

During a forensic examination of a Windows system, an analyst runs the Volatility plugin `netscan` on a memory dump. What information does this plugin primarily provide?

Accepted Answer

Network connections and listening sockets with associated processes. netscan enumerates network connections (TCP and UDP) and listening sockets from the memory dump, including state, local/remote addresses, and owning process.

Answer

Open files and handles for each process

Answer

List of all running processes and their parent processes

Answer

The contents of the Windows firewall rules

Question 12

What is the primary difference between MBR and GPT partition tables?

Accepted Answer

GPT uses a cyclic redundancy check (CRC) for integrity; MBR does not. MBR uses 32-bit entries and supports up to 4 primary partitions and disks up to 2 TB. GPT uses 64-bit entries, supports up to 128 partitions, and disks larger than 2 TB, with backup partition table for redundancy.

Answer

MBR is used only on Linux; GPT is used on Windows

Answer

MBR supports larger disks than GPT

Answer

GPT stores the partition table only in the first sector

Question 13

Which TWO of the following are Volatility plugins used for process enumeration? (Select two.)

Accepted Answer

pslist. pslist lists processes by walking the doubly-linked list. pstree displays process hierarchy. Both are standard process enumeration plugins.

Answer

netscan

Answer

mftparser

Answer

hashdump

Question 14

Which THREE of the following are challenges specific to forensic analysis of solid-state drives (SSDs) compared to traditional hard disk drives (HDDs)? (Select three.)

Accepted Answer

The TRIM command can permanently erase deleted data. TRIM causes deleted data to be erased. Wear leveling moves data and complicates recovery. Encryption (e.g., built-in) can lock access. Bad block remapping is common in HDDs too. Fragmentation is less relevant.

Answer

SSDs have higher latency for read operations

Answer

Bad block remapping is more frequent on SSDs

Question 15

Which TWO of the following are examples of file carving tools? (Select two.)

Accepted Answer

PhotoRec. Foremost and PhotoRec are well-known file carving tools that recover files based on headers/footers.

Answer

WinPmem

Answer

FTK Imager

Answer

dd