CHFI Storage Forensics and File System Analysis Practice Test 11 — 15 Questions

Question 1

What is the primary difference between MBR and GPT partition tables?

Accepted Answer

GPT uses a cyclic redundancy check (CRC) for integrity; MBR does not. GPT (GUID Partition Table) uses a cyclic redundancy check (CRC32) to verify the integrity of the partition table header and entries, detecting corruption or tampering. MBR (Master Boot Record) lacks any such integrity check, making it vulnerable to undetected corruption. This CRC mechanism is a fundamental design improvement in GPT over MBR.

Answer

MBR is used only on Linux; GPT is used on Windows

Answer

MBR supports larger disks than GPT

Answer

GPT stores the partition table only in the first sector

Question 2

Which TWO of the following are Volatility plugins used for process enumeration? (Select two.)

Accepted Answer

pslist. pslist (A) is a Volatility plugin that walks the active process list from the kernel's EPROCESS linked list (via PsActiveProcessHead) and prints each running process with its PID, PPID, and start time, making it a core process-enumeration plugin. pstree (C) is also a process-enumeration plugin: it uses the same process data but renders it as a parent/child tree based on PPID relationships, which helps reveal process ancestry and hidden or orphaned processes. The other options serve different forensic purposes: netscan (B) enumerates network sockets and connections, mftparser (D) parses the MFT to recover file-system metadata, and hashdump (E) extracts password hashes from the SAM registry hive, so none of them are process-enumeration plugins.

Answer

netscan

Answer

mftparser

Answer

hashdump

Question 3

Which THREE of the following are challenges specific to forensic analysis of solid-state drives (SSDs) compared to traditional hard disk drives (HDDs)? (Select three.)

Accepted Answer

The TRIM command can permanently erase deleted data. Option A is correct because the ATA TRIM command (and SCSI UNMAP) tells the SSD controller that blocks are no longer in use, allowing the drive to erase them via garbage collection, which can permanently destroy deleted data before an examiner images the drive. Option C is correct because wear leveling and garbage collection relocate logical blocks to different physical NAND pages transparently, so logical-to-physical mapping changes constantly and traditional file-carving based on physical offsets becomes unreliable. Option D is correct because many SSDs implement hardware-based full-disk encryption (e.g., OPAL/TCG or proprietary SED encryption) tied to the controller, and without the credential or a powered-on unlocked state the data is inaccessible even after chip-off. Option B is wrong because SSDs generally have lower, not higher, read latency than HDDs since there is no seek or rotational delay. Option E is wrong because bad-block remapping exists on both HDDs and SSDs and is not a challenge specific to SSD forensics.

Answer

SSDs have higher latency for read operations

Answer

Bad block remapping is more frequent on SSDs

Question 4

Which TWO of the following are examples of file carving tools? (Select two.)

Accepted Answer

PhotoRec. PhotoRec (C) is a file-carving tool that recovers files by scanning raw disk or image data for known file signatures and reconstructing content without relying on filesystem metadata. Foremost (D) is likewise a signature-based carving utility originally developed for law enforcement that recovers files from disk images and unallocated space using header/footer patterns. WinPmem (A) is a memory acquisition tool, not a carving tool, so it does not belong. FTK Imager (B) is primarily a forensic imaging and preview tool rather than a file carver. dd (E) is a low-level bit-stream imaging/copying utility, not a carving tool.

Answer

WinPmem

Answer

FTK Imager

Answer

dd

Question 5

During a forensic examination of a Windows system, an analyst finds a file that appears to be zero bytes in size when viewed in Windows Explorer, but the file's properties show a size on disk of 4 KB. What is the most likely explanation?

Accepted Answer

The file is stored in an alternate data stream (ADS). An alternate data stream (ADS) allows additional data to be stored with a file in NTFS. Windows Explorer typically displays only the size of the main file stream, not the ADS. Therefore, a file with a zero-byte main stream but an ADS containing data will show a logical size of 0 bytes, while the 'size on disk' reflects the allocated clusters for the ADS data (e.g., 4 KB). This is a common technique used to hide data.

Answer

The file contains only slack space

Answer

The file is compressed using NTFS compression

Answer

The file is a sparse file

Question 6

An analyst is investigating a Linux system that used ext4. The suspect deleted several files and then ran 'fstrim' on the partition. Which of the following best describes the challenge in recovering the deleted data?

Accepted Answer

The TRIM command instructs the SSD to permanently erase the blocks, and wear leveling may also have moved data. D is correct because the `fstrim` command sends the ATA TRIM (or SCSI UNMAP) command to the SSD, which instructs the drive to physically erase the blocks that are marked as free in the file system. This makes the original data unrecoverable at the block level, as the SSD's firmware permanently discards the data. Additionally, wear leveling may have already moved the data to different physical blocks before the TRIM command, further complicating recovery.

Answer

The ext4 journal will automatically purge the metadata of deleted files

Answer

Data recovery is still possible using file carving because fstrim only affects free space

Answer

The inodes are overwritten immediately, making recovery impossible

Question 7

A security analyst receives an image of a hard drive with a GPT partition table. Which of the following is a key difference between GPT and MBR that the analyst should consider?

Accepted Answer

GPT uses a protective MBR to prevent legacy tools from misinterpreting the disk. GPT uses a protective MBR (Master Boot Record) at sector 0 of the disk to maintain backward compatibility with legacy BIOS-based tools that expect an MBR. This protective MBR contains a single partition entry of type 0xEE that covers the entire disk (or up to 2 TiB), preventing older utilities from misinterpreting the GPT disk as unformatted or overwriting GPT structures. This is a key architectural difference from MBR, which has no such protective mechanism.

Answer

GPT stores partition information only in the first sector of the disk

Answer

GPT supports up to 4 primary partitions; MBR supports up to 128

Answer

MBR uses a GUID partition table; GPT uses a simple table at sector 0

Question 8

Which file system uses a Master File Table ($MFT) as its central catalog for file metadata?

Accepted Answer

NTFS. NTFS (New Technology File System) uses the Master File Table ($MFT) as its central catalog to store metadata about every file and directory on the volume. Each file or directory has at least one record in the $MFT, which contains attributes such as timestamps, security descriptors, data runs, and the file's name. This design is fundamental to NTFS's ability to support advanced features like journaling, hard links, and alternate data streams.

Answer

FAT32

Answer

APFS

Answer

ext4

Question 9

An analyst is recovering deleted files from a FAT32 file system. The file system uses a cluster size of 4096 bytes. The first cluster of a deleted file is cluster 100. Which structure contains the chain of clusters for this file?

Accepted Answer

File Allocation Table (FAT). The File Allocation Table (FAT) is the core structure that stores the chain of clusters for files in FAT32 file systems. When a file is deleted, its directory entry is marked as available, but the FAT entries for its clusters (starting at cluster 100) remain intact until overwritten, allowing recovery by following the cluster chain in the FAT.

Answer

Volume boot record

Answer

Directory entry

Answer

Boot sector

Question 10

During a forensic investigation, an analyst discovers data hidden in the Host Protected Area (HPA) of a hard drive. Which tool is commonly used to view and access the HPA?

Accepted Answer

hdparm. D (hdparm) is correct because the Host Protected Area (HPA) is a reserved area on an ATA/IDE hard drive that can be accessed and manipulated using ATA commands. The hdparm utility in Linux provides the -N flag to view and change the HPA size, allowing an analyst to detect and access hidden data stored in this region.

Answer

PhotoRec

Answer

fdisk

Answer

dd

Question 11

An analyst is examining an NTFS volume and finds that a file's $MFT record indicates it is resident. What does this imply about the file's data?

Accepted Answer

The file's data is stored within the $MFT record itself, suitable for small files. When a file's $MFT record indicates it is resident, the file's data is stored entirely within the $MFT record itself. This occurs for small files (typically under 512–1024 bytes) to optimize storage and access speed, as the data does not need to be placed in separate clusters on the NTFS volume.

Answer

The file is compressed and stored across multiple clusters

Answer

The file uses alternate data streams to hide data

Answer

The file is a directory junction point

Question 12

Which forensic tool is specifically designed to recover lost partitions or file system structures and can also be used for data carving?

Accepted Answer

TestDisk. TestDisk is specifically designed to recover lost partitions and repair file system structures, making it the correct choice for this scenario. It also includes data carving capabilities through its companion tool PhotoRec, allowing it to recover files from unallocated space or damaged volumes.

Answer

Sleuth Kit

Answer

EnCase

Answer

Volatility

Question 13

Which TWO of the following are challenges specific to SSD forensics compared to traditional HDD forensics?

Accepted Answer

Wear leveling. Wear leveling (B) is a challenge specific to SSD forensics because SSDs use a flash translation layer (FTL) to remap logical block addresses (LBAs) to physical NAND pages, so the same LBA can point to different physical locations over time and data may be spread across multiple dies, making it difficult to reconstruct the true physical layout or recover prior versions of data. The TRIM command (D) is also SSD-specific: when the OS issues TRIM (e.g., via ATA DATA SET MANAGEMENT or SCSI UNMAP), the drive marks deleted LBAs as invalid and may erase or garbage-collect those blocks, so deleted data can be unrecoverable and the drive's contents change even without user activity, complicating imaging and timeline analysis. By contrast, bad sectors (A), file fragmentation (C), and slack space (E) are challenges common to traditional HDD forensics as well, since they arise from magnetic platter media, file-system allocation behavior, and cluster-level storage rather than from SSD flash management.

Answer

Bad sectors

Answer

File fragmentation

Answer

Slack space

Question 14

An analyst is conducting memory forensics on a Windows system using Volatility. Which THREE commands can provide information about network connections?

Accepted Answer

netscan. Option A, netscan, is correct because it scans for network artifacts such as TCP endpoints, listening sockets, and UDP connections across all memory pools, making it the modern Volatility plugin for network connection discovery. Option C, connscan, is correct because it scans physical memory for TCP connection objects (pool tag TcpE), revealing local and remote IP addresses and ports for established connections. Option D, sockets, is correct because it enumerates socket objects in memory, showing socket handles, protocols, and associated connection details. Option B, pstree, is not correct because it displays parent-child process relationships, not network connections. Option E, pslist, is not correct because it lists active processes from the process list, which contains no network connection information.

Answer

pstree

Answer

pslist

Question 15

Which TWO of the following are methods used to hide data within the NTFS file system?

Accepted Answer

File slack space. File slack space (B) is correct because NTFS allocates disk space in clusters (typically 4 KB), so a file smaller than its last cluster leaves unused bytes between the logical end-of-file and the end of the allocated cluster; this residual space can be written with hidden data without altering the file's visible content. Alternate Data Streams (ADS) (D) are correct because NTFS supports multiple named data streams per file via the $DATA attribute, allowing extra data to be attached to a file (e.g., 'file.txt:hidden.txt') that standard directory listings and many tools do not display. The USN Journal (A) is a change-logging metadata feature that records file system modifications, not a concealment method. Volume Shadow Copy (C) creates point-in-time snapshots for backup/recovery, and EFS (E) provides encryption for confidentiality, neither of which is a technique for hiding data inside NTFS structures.

Answer

USN Journal

Answer

Volume Shadow Copy

Answer

Encrypting File System (EFS)