CHFI Storage Forensics and File System Analysis Practice Test 3 — 15 Questions

Question 1

Which of the following is a Windows-based forensic suite that provides timeline analysis, keyword search, and file system browsing for forensic investigations?

Accepted Answer

Autopsy. Autopsy is a Windows-based forensic suite (also available on Linux/macOS) that provides timeline analysis, keyword search, and file system browsing. It is the graphical front-end to The Sleuth Kit (TSK), allowing investigators to parse file system metadata, recover deleted files, and generate timelines of file activity. These features directly match the question's description of a forensic suite with timeline analysis, keyword search, and file system browsing capabilities.

Answer

Wireshark

Answer

FTK

Answer

EnCase

Question 2

Which THREE of the following are types of slack space that can contain hidden data on a hard disk?

Accepted Answer

File slack. File slack (C) is correct because it refers to the unused space between the end of a file's data and the end of the allocated cluster. This area can contain remnants of previous file data or intentionally hidden data, and is a standard forensic artifact in file system analysis (e.g., NTFS or FAT).

Answer

Device Configuration Overlay

Answer

Host Protected Area

Question 3

A forensic analyst is examining a hard drive and needs to identify the number of sectors per track. Which component of the hard disk structure defines this?

Accepted Answer

Track. The track is the circular path on the platter surface where data is written, and the number of sectors per track is a property defined by the track's geometry. Each track is divided into arcs called sectors, and the track's physical layout determines how many sectors can fit along its circumference. Therefore, the track component directly defines the sector count per track.

Answer

Sector

Answer

Cluster

Answer

Cylinder

Question 4

Which TWO tools are commonly used for file carving during a forensic investigation?

Accepted Answer

Scalpel. Scalpel (D) is correct because it is a signature-based file carving tool derived from Foremost that reads a disk image or raw device and extracts files by matching header/footer patterns defined in its configuration file, making it a standard choice for recovering deleted or unallocated data. Foremost (E) is also correct because it is a classic open-source carving utility originally developed for the U.S. Air Force OSI that carves files from disk images using header/footer signatures and built-in file type definitions. The other options do not belong: fdisk (A) is a partition table editor used to create, delete, and manage disk partitions, not to carve files; Autopsy (B) is a full digital forensics platform/GUI that can invoke carving modules but is not itself a dedicated carving tool in the sense asked; and LiME (C) is a Linux Memory Extractor kernel module used to acquire volatile memory images, not to carve files from storage.

Answer

fdisk

Answer

Autopsy

Answer

LiME

Question 5

During an investigation, an analyst uses the `volatility -f mem.dmp windows.pslist` command and observes a process named 'svchost.exe' with PID 1234. Further analysis shows that this process has no parent process (PPID = 0). What is the MOST likely explanation for this anomaly?

Accepted Answer

The process has been hidden using a rootkit that manipulated kernel objects (DKOM). A process with PID 1234 and PPID 0 indicates that the process has no parent in the process list. This is a classic sign of Direct Kernel Object Manipulation (DKOM), where a rootkit removes the process from the doubly linked list of EPROCESS structures, effectively hiding it from tools like `pslist` that traverse that list. The PPID is set to 0 because the rootkit may have corrupted the parent pointer or the process was spawned outside the normal CreateProcess flow, bypassing the standard parent-child relationship.

Answer

The process is a child of the System process (PID 4) but Volatility misreported it

Answer

The process belongs to a different session and Volatility failed to resolve the parent

Answer

The process is a legitimate system process that was started during boot

Question 6

A forensic investigator is examining an NTFS volume from a Windows Server 2019 system. The investigator needs to identify evidence of file system tunneling, which can affect file timestamps and potentially obscure the true creation time of files. Which TWO of the following statements accurately describe file system tunneling in NTFS? (Choose two.)

Accepted Answer

File system tunneling preserves the original creation timestamp of a file when it is renamed or moved within the same volume, provided the operation occurs within a default 15-second window.. File system tunneling is an NTFS feature that preserves the original creation timestamp of a file when it is renamed or moved within the same volume, provided the operation occurs within the default 15-second tunnel cache window. This can cause a newly created file to inherit an older creation timestamp if it replaces a file with the same name within that window. Investigators must recognize this behavior to avoid misinterpretation of file timelines. The tunnel cache is not stored in a persistent on-disk index, and it does not affect modification timestamps in the same way.

Answer

File system tunneling applies only to files that are moved across different volumes, ensuring that the creation timestamp is updated to reflect the move.

Answer

File system tunneling affects the last modification timestamp of a file, ensuring that it remains unchanged when the file is renamed within the same volume.

Answer

The tunnel cache is stored in the `$Extend\$ObjId` index and can be examined to determine if tunneling has occurred.

Question 7

An analyst recovers a hard drive from a suspect's computer. The drive has a partition table that uses a 32-bit identifier and a maximum partition size of 2 TB. Which partition table type is present?

Accepted Answer

MBR. The Master Boot Record (MBR) partition table uses a 32-bit identifier for partition entries and, with traditional 512-byte sectors, supports a maximum partition size of 2 TB. This matches the description exactly, making MBR the correct answer.

Answer

HFS+

Answer

GPT

Answer

APFS

Question 8

During a forensic investigation, an examiner wants to recover deleted files from a FAT32 file system. Which structure is most critical for file recovery?

Accepted Answer

File Allocation Table (FAT). In FAT32, the File Allocation Table (FAT) is the primary structure that tracks cluster allocation chains for files. When a file is deleted, the directory entry is marked as available, but the FAT entries (cluster chains) often remain intact until overwritten, making the FAT the most critical structure for recovering deleted files by reconstructing their cluster sequences.

Answer

Master File Table (MFT)

Answer

Journal

Answer

Inode table

Question 9

Which tool is specifically designed for file carving and can recover files based on headers and footers without relying on file system metadata?

Accepted Answer

Foremost. Foremost is a file carving tool that recovers files by scanning raw data for known header and footer signatures, such as JPEG headers (0xFFD8) and footers (0xFFD9), without relying on file system metadata like MFT entries or inodes. This makes it ideal for data recovery from damaged or formatted volumes where the file system structure is unavailable.

Answer

FTK Imager

Answer

Autopsy

Answer

Volatility

Question 10

An analyst notices that a file on an NTFS volume occupies 4096 bytes on disk but its actual data is only 100 bytes. The extra space contains remnants of a previously deleted file. What is this extra space called?

Accepted Answer

File slack. File slack is the unused space between the end of the actual file data and the end of the last allocated cluster for that file. On an NTFS volume with a 4096-byte cluster size, a 100-byte file leaves 3996 bytes of slack space, which may contain remnants of previously deleted files. This is why option D is correct.

Answer

Volume slack

Answer

Free space

Answer

RAM slack

Question 11

A forensic investigator is analyzing a Linux ext4 file system. They suspect a file was deleted but its inode may still be intact. Which tool can be used to recover the file by referencing the inode?

Accepted Answer

debugfs. debugfs is an interactive file system debugger for ext2/ext3/ext4 that allows direct manipulation of inode structures. When a file is deleted but its inode remains intact, debugfs can recover the file by using the `lsdel` command to list deleted inodes and the `dump` command to extract the file contents by referencing the inode number.

Answer

dd

Answer

scalpel

Answer

foremost

Question 12

During a forensic examination of an NTFS drive, an investigator finds that a file 'notes.txt' has an additional data stream named 'hidden.txt' attached. Which feature of NTFS allows this?

Accepted Answer

Alternate Data Streams (ADS). C is correct because NTFS supports Alternate Data Streams (ADS), a feature that allows multiple data streams to be associated with a single file. The 'hidden.txt' stream attached to 'notes.txt' is a classic example of ADS, which can be used to hide data or store metadata without affecting the file's primary content.

Answer

USN Journal

Answer

MFT

Answer

Slack space

Question 13

A security analyst is investigating a compromised Windows system and wants to see which processes were running at the time of memory capture. Which Volatility command should they use?

Accepted Answer

volatility -f mem.dump pslist. The `pslist` plugin in Volatility enumerates processes from the Windows kernel's EPROCESS structure list, showing all active processes at the time of memory capture. This is the correct command to identify running processes from a memory dump, as it directly parses the doubly-linked list of process objects maintained by the kernel.

Answer

volatility -f mem.dump hashdump

Answer

volatility -f mem.dump malfind

Answer

volatility -f mem.dump netscan

Question 14

An examiner acquires a forensic image of an SSD from a suspect's laptop. The SSD was connected to a system with TRIM enabled. What challenge will the examiner most likely face when trying to recover deleted files?

Accepted Answer

Deleted files may have been physically erased by TRIM. When TRIM is enabled on an SSD, the operating system sends ATA DATA SET MANAGEMENT commands to the drive to immediately erase the physical blocks corresponding to deleted files. This means the deleted file data is permanently and irreversibly erased at the flash memory level, making recovery via traditional file carving or forensic tools impossible. Option D correctly identifies this as the primary challenge.

Answer

Wear leveling complicates data location

Answer

RAID striping interferes with imaging

Answer

The SSD is encrypted and cannot be imaged

Question 15

During a forensic analysis of a drive, the examiner discovers a Host Protected Area (HPA). What is the primary purpose of an HPA?

Accepted Answer

To provide a hidden storage area not visible to the OS. The Host Protected Area (HPA) is a reserved region on an ATA/ATAPI hard drive that is not accessible through standard operating system interfaces. Its primary purpose is to provide a hidden storage area that remains invisible to the OS, often used by manufacturers for diagnostic tools, system recovery images, or other vendor-specific data. This is defined by the ATA-4 standard (ANSI NCITS 317-1998) and is accessed via the SET MAX ADDRESS command.

Answer

To store the file system journal

Answer

To accelerate disk read/write operations

Answer

To store backup copies of the MBR