CHFI Storage Forensics and File System Analysis Practice Test 11 — 15 Questions

Question 1

During a forensic investigation of a hard disk, the investigator finds that the partition table is missing. The disk was previously partitioned using GPT. Which area of the disk should be examined to recover the GPT partition table?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

LBA 1 (sector 1). In GPT (GUID Partition Table) disks, the primary partition table is stored in LBA 1 (sector 1), immediately following the protective MBR at LBA 0. When the partition table is missing, examining LBA 1 allows recovery of the GPT header, which contains pointers to the partition entry array. This is the correct location because GPT uses LBA 1 for its header, not the last sector or the MBR.

Answer

Last sector of the disk

Answer

Volume boot record

Answer

Master Boot Record (LBA 0)

Question 2

A forensic examiner is analyzing a RAID 5 array consisting of three disks. One disk has failed and is not available. The remaining two disks contain data and parity. Which technique can be used to reconstruct the missing disk's data and recover the original data?

Accepted Answer

Use dd to image the two disks, then perform a XOR operation on the data stripes to reconstruct the third disk's data. In a RAID 5 array with three disks, data and parity are striped across all disks. When one disk fails, the missing data can be reconstructed by performing an XOR operation on the corresponding stripes from the remaining two disks. This is because RAID 5 uses distributed parity where the parity block is the XOR of the data blocks in the same stripe, so XORing the surviving data and parity stripes recovers the lost data.

Answer

Replace the failed disk and rebuild the array using the controller's rebuild function

Answer

Use FTK Imager to create a logical image of each disk and merge them

Answer

Simply image the two disks and use file carving tools to extract files

Question 3

An analyst discovers that a Windows system has hidden data in the Host Protected Area (HPA) of the hard drive. Which tool or method can be used to detect and access the HPA?

Accepted Answer

Using the hdparm command in Linux with the -N flag. The Host Protected Area (HPA) is a reserved region on ATA/ATAPI hard drives that is not visible to the operating system's standard disk utilities. The `hdparm` command in Linux with the `-N` flag is specifically designed to detect and modify the HPA by querying the drive's native max address, revealing hidden sectors. Windows Disk Management and other OS-level tools cannot access the HPA because it is hidden at the firmware level via the ATA SET MAX ADDRESS command.

Answer

Using the Windows Disk Management utility

Answer

Using the Volatility framework

Answer

Using the chkdsk command

Question 4

During a forensic examination of a Linux ext4 file system, an investigator runs the `ls -i` command and sees inode numbers. They need to examine the inode structure. Which command should they use to display detailed inode information?

Accepted Answer

debugfs -R 'stat ' /dev/sda1. The `debugfs` command is a native ext2/ext3/ext4 file system debugger that allows direct inode inspection. The `-R 'stat '` flag runs the `stat` command in debugfs to display the full inode structure, including permissions, timestamps, block pointers, and extended attributes, which is exactly what the investigator needs after seeing inode numbers from `ls -i`.

Answer

dd if=/dev/sda1 of=output.img

Answer

mount -o loop image.img /mnt

Answer

fsck /dev/sda1

Question 5

An analyst discovers a hidden partition on a hard drive that does not appear in the standard MBR partition table. The drive uses GPT partitioning. Which area of the disk should be examined to find evidence of a hidden partition?

Accepted Answer

The GPT header and partition entry array located after the protective MBR. In GPT partitioning, the protective MBR in sector 0 only contains a single partition entry of type 0xEE to prevent legacy tools from misinterpreting the disk. The actual partition information, including any hidden partitions, is stored in the GPT header (typically in sector 1) and the partition entry array that follows. Therefore, examining the GPT header and partition entry array is necessary to detect partitions not visible in the MBR.

Answer

The Master Boot Record (MBR) in sector 0

Answer

The Volume Boot Record (VBR) of the C: drive

Answer

The Host Protected Area (HPA) at the end of the disk

Question 6

During a forensic examination of a solid-state drive (SSD), the analyst notices that the TRIM command was enabled. What challenge does this pose for data recovery?

Accepted Answer

It erases data blocks immediately after deletion, preventing recovery. The TRIM command (ATA Data Set Management command) instructs the SSD controller to immediately erase the physical NAND blocks corresponding to deleted logical block addresses (LBAs). This proactive garbage collection operation resets the cells to an erased state, making it impossible for forensic tools to recover the original data from those blocks, as the data is physically overwritten with null values or marked as invalid.

Answer

It causes fragmentation, making file recovery more complex

Answer

It causes the drive to encrypt data automatically

Answer

It physically destroys the NAND cells, making the drive unusable

Question 7

An examiner is analyzing an NTFS volume and suspects that a suspect hid data using Alternate Data Streams (ADS). Which tool or method is MOST appropriate to list all ADS on the volume?

Accepted Answer

Execute 'dir /r' in a Windows command prompt on the mounted image. The 'dir /r' command in Windows Command Prompt is specifically designed to display alternate data streams (ADS) on NTFS volumes. It lists all files and directories, including any hidden streams attached to them, making it the most direct and appropriate method for an examiner to enumerate all ADS on a mounted NTFS volume.

Answer

Run 'ls -la' from a Linux forensic environment

Answer

Use 'icacls' to view security descriptors and detect ADS

Answer

Mount the image in Autopsy and run the 'Find File' module

Question 8

A forensic analyst is examining a RAID 5 array consisting of three disks. One disk has failed and has been replaced. The array is rebuilt automatically. However, the analyst needs to recover deleted files that existed before the rebuild. What is the MOST significant challenge in this scenario?

Accepted Answer

The rebuild process may overwrite data in slack space and previously unallocated clusters. When a RAID 5 array with a failed disk is rebuilt, the controller reconstructs data using parity information and writes it to the replacement disk. This rebuild process writes to all previously unallocated clusters and slack space across the array, potentially overwriting the very data the analyst hopes to recover. Deleted files that existed before the rebuild are at high risk of being overwritten during this automatic reconstruction, making recovery extremely difficult or impossible.

Answer

File carving techniques do not work on RAID volumes

Answer

The file system becomes corrupted after rebuild

Answer

The RAID controller encrypts data, preventing direct disk access

Question 9

During a forensic examination of an NTFS drive, an analyst runs 'fsutil usn readjournal C:' and observes a large number of USN journal entries for a specific file after a certain date. The file's $MFT record shows a last modified timestamp far earlier than the journal entries. What does this discrepancy suggest?

Accepted Answer

The file's metadata was modified without changing its content, possibly using timestomping or ADS manipulation. The USN journal records all changes to files and directories on an NTFS volume, including metadata modifications. When the USN journal shows numerous entries after a date but the $MFT record's last modified timestamp is earlier, it indicates that the file's metadata (e.g., timestamps, ADS) was altered without updating the $MFT's last modified field—a classic sign of timestomping or ADS manipulation. This discrepancy arises because timestomping tools can directly modify $MFT attributes while the USN journal still logs the change event.

Answer

The file is a system file that is excluded from USN journaling

Answer

The file system is corrupted and the MFT is not updating correctly

Answer

The file was accessed via a mounted volume shadow copy, which does not update MFT

Question 10

Which TWO of the following are valid methods to hide data on an NTFS file system without using external tools?

Accepted Answer

Embedding data in file slack space. A is correct because file slack space is the unused bytes between the end of a file's logical data and the end of its allocated cluster. On NTFS, when a file does not fill its last cluster, the remaining bytes (RAM slack and drive slack) can be written to without affecting the file's visible content. This is a native hiding method that requires no external tools, as the data is simply written to the slack region using standard file I/O operations.

Answer

Storing data in the NTFS file system journal ($LogFile)

Answer

Using the $Volume attribute in the MFT

Answer

Encrypting data with EFS

Question 11

An investigator needs to recover deleted files from a USB drive formatted with FAT32. Which of the following techniques would be most effective, assuming the files have not been overwritten?

Accepted Answer

Examine the FAT for unallocated clusters and reconstruct files. FAT32 does not have a journal (eliminating A). The Master File Table ($MFT) is used by NTFS, not FAT32 (eliminating C). While file carving with tools like 'foremost' (D) can recover files based on signatures, it is less effective for deleted files on FAT32 because it may fail to recover fragmented files and does not leverage the file system's own structure. The most effective technique is to examine the File Allocation Table (FAT) for unallocated clusters and reconstruct the files from the directory entry's starting cluster and size (B), assuming the clusters have not been overwritten. This uses the file system metadata to directly locate the file's data.

Answer

Check the journal for recent changes

Answer

Analyze the $MFT for orphaned entries

Answer

Use the 'foremost' tool to carve based on file signatures

Question 12

During an investigation, an analyst recovers a file from unallocated space that contains fragments of a deleted document. The file size is 512 bytes, but the cluster size of the volume is 4096 bytes. What is the term for the unused bytes between the end of the file and the end of the last cluster?

Accepted Answer

File slack. File slack refers to the unused bytes between the end of a file and the end of the last cluster allocated to that file. In this scenario, the file is 512 bytes but resides in a 4096-byte cluster, leaving 3584 bytes of slack space. This area can contain remnants of previously deleted data or metadata, making it a critical forensic artifact.

Answer

Volume slack

Answer

Drive slack

Answer

RAM slack

Question 13

An analyst is examining a USB drive that appears to have a smaller capacity than expected. The drive is detected as 8 GB but only 7 GB is accessible. Which of the following is the most likely cause?

Accepted Answer

The drive has a Host Protected Area (HPA) hiding 1 GB. The difference between detected capacity (8 GB) and accessible space (7 GB) is most likely due to a Host Protected Area (HPA). HPA uses the ATA SET MAX ADDRESS command to reduce the total capacity reported by the drive, effectively hiding 1 GB from the operating system. A hidden partition does not change the total reported capacity; it only makes a portion of the space inaccessible by not assigning a drive letter. Therefore, only HPA directly reduces the total capacity, making option C the most likely cause.

Answer

The file system uses a cluster size that wastes space

Answer

The drive is formatted with FAT32 which has a 4 GB file size limit

Answer

The drive contains a hidden partition

Question 14

An analyst retrieves a forensic image of a hard drive and discovers that the size reported by the operating system is smaller than the actual physical capacity. The extra space is not accessible through standard partition tools. This hidden area is MOST likely:

Accepted Answer

Host Protected Area. The Host Protected Area (HPA) is a region on a hard drive that is hidden from the operating system by using the ATA SET MAX ADDRESS command to reduce the reported capacity. This area is not accessible through standard partition tools because the OS sees only the reduced address space, making it ideal for storing forensic or diagnostic data. The analyst's observation of a smaller reported size than physical capacity directly matches HPA behavior.

Answer

Device Configuration Overlay

Answer

Volume slack

Answer

RAM slack

Question 15

Which THREE of the following are types of slack space that can contain hidden data on a hard disk?

Accepted Answer

File slack. File slack (C) is correct because it refers to the unused space between the end of a file's data and the end of the allocated cluster. This area can contain remnants of previous file data or intentionally hidden data, and is a standard forensic artifact in file system analysis (e.g., NTFS or FAT).

Answer

Device Configuration Overlay

Answer

Host Protected Area