CHFI Storage Forensics and File System Analysis Practice Test 2 — 15 Questions

Question 1

During a forensic analysis of a compromised server, you discover that a rootkit has hidden itself by modifying the HPA (Host Protected Area) of the hard disk. Which tool can detect the presence of an HPA by comparing the reported size with the actual number of sectors?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

hdparm. hdparm (option D) is correct because it can query the ATA IDENTIFY DEVICE data and compare the reported total number of sectors (words 60-61) with the actual number of sectors accessible via LBA, thereby detecting a discrepancy caused by an HPA. The `-N` flag specifically displays or sets the HPA size, making it the standard tool for HPA detection in forensic examinations.

Answer

smartctl

Answer

dd

Answer

fdisk

Question 2

Which TWO of the following are common challenges in SSD forensics that can hinder data recovery?

Accepted Answer

TRIM. TRIM (B) is a correct answer because the ATA TRIM command lets the SSD controller proactively erase blocks that the OS marks as deleted, so data can be physically wiped within seconds or minutes of deletion, defeating traditional file-recovery techniques. Wear levelling (E) is also correct because the SSD controller spreads writes across all flash blocks to equalize wear, so logical block addresses no longer map predictably to physical NAND locations, breaking the LBA-to-physical correspondence that forensic tools rely on. File fragmentation (A) is not SSD-specific and is generally handled by filesystem metadata, bad sectors (C) are a generic storage failure mode not unique to SSDs, and NTFS permissions (D) are a logical access-control feature that does not impede raw data recovery.

Answer

File fragmentation

Answer

Bad sectors

Answer

NTFS permissions

Question 3

A forensic examiner acquires a RAM image from a Windows 10 system and uses Volatility to analyze it. Which command would list all running processes along with their parent process IDs and command lines?

Accepted Answer

volatility -f mem.raw pstree. The `pstree` plugin in Volatility displays running processes in a tree format showing parent-child relationships, and by default includes the process name, PID, PPID, and command line. This meets the requirement of listing all running processes with their parent process IDs and command lines.

Answer

volatility -f mem.raw pslist

Answer

volatility -f mem.raw netscan

Answer

volatility -f mem.raw cmdline

Question 4

During a forensic analysis of an APFS volume, the investigator needs to examine file metadata such as creation time, modification time, and extended attributes. Which APFS structure contains this information?

Accepted Answer

Inode Table. In APFS, file metadata such as creation time, modification time, and extended attributes are stored in the inode table (also called the object map for files). Each file and directory is represented by an inode, which contains a fixed set of timestamps (e.g., creation, modification, access) and a field for extended attributes. The inode table is the primary structure for per-file metadata, making option C correct.

Answer

Volume Superblock

Answer

Journal

Answer

Extent Reference Tree

Question 5

Which TWO of the following are valid methods to hide data on an NTFS volume? (Choose two.)

Accepted Answer

Storing data in the $Recycle.bin folder. Option A is correct because the $Recycle.bin folder on an NTFS volume can be used to conceal data: files placed there are renamed to $R (recycled) or $I (metadata) entries and are not visible through normal directory listings, making it a recognized NTFS data-hiding location. Option D is correct because Alternate Data Streams (ADS) allow additional named streams (e.g., file.txt:hidden.txt) to be attached to an NTFS file; these streams are not shown by standard tools like dir or Windows Explorer, so they are a classic NTFS data-hiding method. Option B is incorrect because the volume boot record holds boot code and filesystem parameters, not a practical location for hiding user data. Option C is incorrect because MFT resident data is the normal storage for small files within their own MFT record, not a covert hiding technique. Option E is incorrect because the USN journal is a change-logging mechanism that records file system updates, not a data-hiding location.

Answer

Using the volume boot record

Answer

Using the MFT resident data area

Answer

Using the USN journal

Question 6

An investigator is using Autopsy to analyze a disk image from a suspected hacker's computer. They want to recover deleted JPEG images that may have been stored in unallocated clusters. Which Autopsy feature is best suited for this task?

Accepted Answer

File Type Sorting. Autopsy's File Type Sorting feature allows the investigator to carve files from unallocated clusters based on their file signatures (magic bytes), such as JPEG headers (FF D8 FF). This enables recovery of deleted images even when the file system metadata is gone, making it the correct choice for recovering deleted JPEGs from unallocated space.

Answer

Hash Set Analysis

Answer

Timeline Analysis

Answer

Keyword Search

Question 7

Which TWO of the following are features of the NTFS file system that can be used to hide data? (Select TWO.)

Accepted Answer

$Recycle.bin. Alternate Data Streams (ADS) (D) are an NTFS feature that lets additional named streams be attached to a file beyond the default $DATA stream, so hidden content can be stored in a stream that standard directory listings and many tools do not display. $Recycle.bin (C) is an NTFS system folder that holds deleted files per volume; because its contents are not shown in a normal directory listing and can be renamed or manipulated, it can be used to conceal data on an NTFS volume. The Master File Table (A) is the core NTFS metadata structure that indexes files and their attributes, not a hiding mechanism itself. Host Protected Area (B) is a hidden disk region defined by the ATA standard at the drive firmware level, not an NTFS feature. Volume Shadow Copy (E) is a Windows service/feature for point-in-time snapshots of volumes, not an NTFS data-hiding feature.

Answer

Master File Table (MFT)

Answer

Host Protected Area (HPA)

Answer

Volume Shadow Copy

Question 8

An examiner is analyzing an SSD and notices that TRIM is enabled. Why does TRIM pose a challenge for digital forensics?

Accepted Answer

TRIM causes the SSD to physically overwrite deleted data with zeros, preventing recovery. When TRIM is enabled on an SSD, the operating system sends a TRIM command to the SSD controller for deleted data blocks. The controller then immediately physically zeroes or erases those blocks at the flash memory level, making it impossible to recover the deleted data using forensic tools. This is fundamentally different from traditional HDDs, where deleted data remains on the platters until overwritten.

Answer

TRIM increases the wear leveling, which reduces the lifespan of the SSD

Answer

TRIM encrypts the deleted data, making it inaccessible without the key

Answer

TRIM compresses data, altering the original content

Question 9

During a forensic examination of a Linux system, the investigator runs the command 'ls -i /home/user/file.txt' and sees inode number 12345. The file was recently deleted. Which of the following is the most effective method to recover the file, assuming the inode is still accessible?

Accepted Answer

Use 'debugfs' to attempt to recover the inode and its data blocks. 'debugfs' can directly access the ext2/ext3/ext4 filesystem's inode table. Since the investigator knows the inode number (12345) and the inode is still accessible (not yet overwritten), 'debugfs' can use the 'lsdel' or 'logdump' commands to recover the inode's data block pointers and restore the file without relying on file carving heuristics.

Answer

Run 'scalpel' with a custom configuration for the file type

Answer

Use 'foremost' to scan the disk for the file header/footer

Answer

Run 'photorec' on the disk to carve the file from unallocated space

Question 10

An investigator is analyzing a memory dump from a compromised server using Volatility. The 'pslist' plugin shows a process with no parent PID (PPID). Which of the following is the most likely explanation?

Accepted Answer

The process is a system idle process. Volatility's pslist plugin enumerates processes via EPROCESS structures; every process has a PPID. The system idle process (PID 0) is the first process and has no parent, so its PPID is 0 (or absent in some outputs). Kernel threads are not separate processes and are not listed by pslist. Therefore, the correct answer is A.

Answer

The process is a kernel thread and has no parent

Answer

The process list is incomplete due to memory corruption

Answer

The process is a rootkit that has unlinked itself from the process list

Question 11

An analyst is examining an Apple Mac system and needs to recover deleted files from an APFS volume. Which tool is most appropriate for this task?

Accepted Answer

FTK Imager. FTK Imager is the most appropriate tool because it supports APFS (Apple File System) volume parsing and can recover deleted files by reading the volume's raw data and file system metadata, including the APFS container's object map and snapshots. Unlike tools designed for other file systems or memory analysis, FTK Imager provides a GUI and command-line interface for forensic imaging and file recovery from APFS volumes.

Answer

Foremost

Answer

LiME

Answer

Volatility

Question 12

When analyzing an NTFS volume, an investigator wants to identify files that were recently accessed or modified. Which NTFS artifact stores metadata about file system changes and can be parsed using tools like MFTEcmd or NTFSLogTracker?

Accepted Answer

$USN_Jrnl. The $USN_Jrnl (Update Sequence Number Journal) is the correct artifact because it records every change made to files and directories on an NTFS volume, including timestamps for when files were accessed or modified. Tools like MFTEcmd and NTFSLogTracker are specifically designed to parse this journal to extract metadata about file system changes, making it ideal for identifying recent activity.

Answer

$LogFile

Answer

$Recycle.Bin

Answer

$MFT

Question 13

A security analyst detects suspicious activity on a Windows workstation. They acquire RAM using WinPmem and analyze it with Volatility. Which Volatility command would list all active processes along with their parent process IDs?

Accepted Answer

volatility -f mem.dmp pstree. The `pstree` plugin in Volatility displays a tree of processes showing parent-child relationships, including parent process IDs (PPIDs). This is the standard command for visualizing process hierarchy and identifying suspicious parent-child associations, such as a child process spawned by an unexpected parent.

Answer

volatility -f mem.dmp pslist

Answer

volatility -f mem.dmp connscan

Answer

volatility -f mem.dmp netscan

Question 14

During an investigation of a Linux system, an analyst runs `ls -li` and sees that a file's inode number is 0. What does this indicate about the file?

Accepted Answer

The file has been deleted but is still open. In Linux, an inode number of 0 indicates that the file's directory entry has been removed (unlinked), but the file is still held open by a process. The inode remains allocated until the last file descriptor referencing it is closed. This is a common scenario in forensic analysis where deleted files can be recovered from /proc/<pid>/fd/.

Answer

The file is a symbolic link

Answer

The file is a device file

Answer

The file is a hard link

Question 15

A forensic examiner wants to recover deleted files from a USB drive formatted with FAT32. Which file carving tool is specifically designed to recover files based on file headers and footers?

Accepted Answer

Foremost. Foremost is a file carving tool that recovers deleted files by scanning raw data for known file headers and footers, making it ideal for FAT32 USB drives where file system metadata may be lost. It operates independently of the file system structure, which is crucial when the MFT or directory entries are damaged or overwritten.

Answer

Nmap

Answer

Wireshark

Answer

Sleuth Kit