CHFI Storage Forensics and File System Analysis Practice Test 2 — 15 Questions

Question 1

During a forensic examination of a Windows 10 system, an investigator runs the following command: 'fsutil usn readjournal C: > usn_output.txt'. What is the primary purpose of this action?

Accepted Answer

To analyze the Update Sequence Number (USN) journal for file system activity. The USN journal records changes to files and directories. This command reads the journal, which can reveal file creation, deletion, and modification timestamps, even if the MFT entry is modified.

Answer

To recover deleted files from the Recycle Bin

Answer

To check the integrity of the NTFS file system

Answer

To extract the Master File Table ($MFT) from the volume

Question 2

An analyst recovers a disk image from a Linux server that used ext4. The image shows a superblock backup at multiple offsets. Which dd command would correctly extract the backup superblock located at offset 32768 bytes?

Accepted Answer

dd if=image.dd of=superblock.bin bs=512 skip=64 count=2. To extract the backup superblock at offset 32768 with size 1024 bytes, dd needs skip=32768/512=64 and count=1024/512=2.

Answer

dd if=image.dd of=superblock.bin bs=4096 skip=8 count=1

Answer

dd if=image.dd of=superblock.bin bs=1024 skip=32 count=1

Answer

dd if=image.dd of=superblock.bin bs=32768 skip=1 count=1

Question 3

Which file system artifact in NTFS is used to hide data by appending a stream to an existing file without affecting its primary data stream?

Accepted Answer

Alternate Data Streams (ADS). Alternate Data Streams (ADS) allow hiding data by attaching additional streams to files. They are not visible in standard directory listings.

Answer

USN Journal

Answer

$Recycle.bin

Answer

Master File Table ($MFT)

Question 4

During a forensic investigation, an analyst finds a file with a creation timestamp earlier than the volume's formatted timestamp. Which of the following is the most likely explanation?

Accepted Answer

The file's timestamps were deliberately modified to mislead investigators. File timestamps can be manipulated by anti-forensics tools. A creation time before the volume format is a strong indicator of timestamp manipulation.

Answer

The file is actually a link to another file, so its timestamps reflect the source

Answer

The system clock was incorrect at the time of file creation

Answer

The file was created on a different system and copied to this volume

Question 5

In an ext3 file system, after deleting a file, the inode's link count drops to 0, but the data blocks remain. Which of the following is true regarding recovery?

Accepted Answer

The file may be recovered through file carving by searching for known file signatures in the data blocks. In ext3, deleting a file clears the inode and data block pointers. Recovery requires scanning the raw disk for file signatures (file carving) because the inode no longer points to the data.

Answer

The file can be recovered by reading the journal and replaying the deletion transaction

Answer

The file cannot be recovered because ext3 zeroes the inode on deletion

Answer

The file can be recovered by undeleting the inode using debugfs or extundelete

Question 6

An investigator uses the Volatility framework on a memory dump from a Windows 10 system. Which command would list all processes, including those hidden by rootkits?

Accepted Answer

volatility -f memory.dmp --profile=Win10x64 psxview. The 'psxview' plugin in Volatility compares process lists from various sources to detect hidden processes.

Answer

volatility -f memory.dmp --profile=Win10x64 psscan

Answer

volatility -f memory.dmp --profile=Win10x64 pslist

Answer

volatility -f memory.dmp --profile=Win10x64 pstree

Question 7

What is the primary purpose of the Host Protected Area (HPA) on a hard disk drive?

Accepted Answer

To store diagnostic data or allow vendors to hide data from the OS. HPA is a reserved area on the disk that is not visible to the operating system, intended for vendor-specific data. It can be used to hide data from forensic acquisition.

Answer

To provide a write-cache for improved performance

Answer

To store the partition table when using GPT

Answer

To store the operating system boot loader

Question 8

A forensic investigator is examining a Mac system with APFS. Which artifact would be most useful for determining the exact time a file was moved to the Trash?

Accepted Answer

The APFS journal (fsroot) records the move operation with a timestamp. APFS maintains a journal (fsroot) that records file system operations, including moves to Trash.

Answer

The file's creation timestamp in the directory entry

Answer

The .DS_Store file in the Trash folder

Answer

The 'com.apple.metadata:kMDItemWhereFroms' extended attribute

Question 9

In a RAID 5 array with three disks, one disk fails. The investigator images the remaining two disks and wants to reconstruct the missing data. Which approach is most appropriate?

Accepted Answer

Apply XOR operation between the two disk images to recover missing data. RAID 5 uses parity distributed across disks. Given two data disks, the third can be reconstructed by XORing the parity with the remaining data. However, the investigator must know the stripe size and parity layout.

Answer

Mount the two disks in a Linux mdadm array with a missing disk

Answer

Use dd to concatenate the two disk images linearly

Answer

Use a tool like R-Studio to perform a virtual RAID rebuild

Question 10

An analyst runs 'foremost -i disk.dd -o output' and recovers several JPEG files. However, some files are corrupted or incomplete. What is the most likely cause?

Accepted Answer

The files were fragmented across the disk, and foremost did not reassemble fragments. Foremost uses file headers/footers for carving. If the file was fragmented, the tool may only recover the first fragment, leading to corruption.

Answer

The files were stored in a journaling file system that overwrites deleted data quickly

Answer

The output directory had insufficient space to store the recovered files

Answer

The disk image contains bad sectors that could not be read

Question 11

Which tool is specifically designed to acquire RAM from a Linux system for forensic analysis?

Accepted Answer

LiME. LiME (Linux Memory Extractor) is a tool for capturing RAM on Linux systems, often used with the Volatility framework.

Answer

WinPmem

Answer

EnCase

Answer

FTK Imager

Question 12

An investigator notes that a file on an NTFS volume has a resident data size of 900 bytes, but the $DATA attribute lists an allocated size of 1024 bytes. What does this indicate?

Accepted Answer

The file has slack space that may contain remnants of previously deleted data. The difference between actual data size and allocated size is slack space. The file was allocated a cluster of 1024 bytes, but only 900 bytes are used, leaving 124 bytes of slack space that could contain residual data.

Answer

The file is compressed using NTFS compression

Answer

The file's data is stored in the MFT as a resident attribute

Answer

The file is stored in an alternate data stream

Question 13

Which TWO of the following are valid methods for hiding data on an NTFS volume without using third-party tools? (Select 2)

Accepted Answer

Slack space (file slack or volume slack). Alternate Data Streams (ADS) and slack space are native NTFS features that can be used to conceal data.

Answer

Creating a symbolic link to a hidden file

Answer

Encrypting the file with EFS

Answer

Using the $Recycle.bin folder

Question 14

Which THREE of the following are challenges specific to forensic analysis of solid-state drives (SSDs) compared to traditional hard disk drives? (Select 3)

Accepted Answer

TRIM command may permanently erase deleted data. SSDs have TRIM, wear leveling, and garbage collection that can destroy data or make recovery difficult.

Answer

SSDs have platters that can be degaussed to destroy data

Answer

SSDs are slower to image because of rotational latency

Question 15

An investigator is analyzing a memory dump with Volatility and wants to identify network connections. Which TWO commands can provide information about TCP and UDP connections? (Select 2)

Accepted Answer

volatility -f mem.dmp netscan. Volatility's netscan and netstat plugins list network connections from memory.

Answer

volatility -f mem.dmp connections

Answer

volatility -f mem.dmp pslist

Answer

volatility -f mem.dmp dlllist