CHFI Storage Forensics and File System Analysis Practice Test 4 — 15 Questions

Question 1

During a forensic investigation, you find an NTFS volume with a file that has an alternate data stream (ADS). Which command in Windows can be used to list all ADS on a file?

Accepted Answer

dir /r. The dir /r command in Windows lists all alternate data streams associated with files in a directory. This is a standard forensic technique to detect hidden data.

Answer

dir /a

Answer

fsutil stream query

Answer

attrib /s

Question 2

An analyst is investigating a compromised Linux system and runs `ls -i` on a deleted file's directory. The inode number is 12345. Which tool can recover the file contents by referencing the inode?

Accepted Answer

debugfs. The debugfs tool can be used to examine and recover files by inode on ext2/3/4 filesystems. The command `debugfs -R 'cat <12345>' /dev/sda1` would output the file contents.

Answer

scalpel

Answer

foremost

Answer

icat

Question 3

During a forensic examination of a solid-state drive (SSD), you notice that files deleted several months ago cannot be recovered using traditional file carving tools. Which SSD feature is MOST likely preventing recovery?

Accepted Answer

TRIM. TRIM is a command that allows the operating system to inform the SSD which data blocks are no longer in use. When TRIM is enabled, the SSD internally erases those blocks, making file carving ineffective for deleted files.

Answer

Over-provisioning

Answer

Garbage Collection

Answer

Wear levelling

Question 4

An investigator needs to recover a deleted partition from a disk that originally used an MBR partition table. Which tool can scan the disk for lost partitions and rebuild the partition table?

Accepted Answer

TestDisk. TestDisk is a powerful tool designed to recover lost partitions and repair boot sectors. It can scan for partition tables and restore deleted partitions on MBR and GPT disks.

Answer

FTK Imager

Answer

Autopsy

Answer

PhotoRec

Question 5

In NTFS, the $MFT file contains metadata about every file and directory on the volume. When a file is deleted, its $MFT record is marked as free. What information in the $MFT record is MOST useful for recovering a deleted file?

Accepted Answer

The data attribute. The $MFT record contains data runs (extents) that point to the clusters where the file data is stored. Even after deletion, if the clusters have not been overwritten, these data runs can be used to recover the file content.

Answer

The file name attribute

Answer

The standard information attribute

Answer

The security descriptor

Question 6

A forensic analyst is investigating a Windows system and needs to examine the contents of the Recycle Bin. Which file artifact contains metadata about deleted files, including original file paths and deletion times?

Accepted Answer

$Recycle.bin\$I. The $Recycle.bin directory contains a file named $R (deleted file) and $I (info file). The $I file stores metadata such as original path, deletion time, and size. This is the standard Recycle Bin artifact in NTFS.

Answer

C:\Windows\System32\winevt\Logs

Answer

$Recycle.bin\$R

Answer

C:\Windows\Prefetch

Question 7

An analyst is analyzing a disk image and finds a 512-byte sector at LBA 0 that contains a bootloader and a partition table. The partition table has four entries, each 16 bytes. What type of partition table is this?

Accepted Answer

MBR. The MBR (Master Boot Record) uses a 512-byte sector at LBA 0, with the first 446 bytes for boot code, a 64-byte partition table (4 entries of 16 bytes each), and a 2-byte signature (0x55AA). This description matches MBR exactly.

Answer

Apple Partition Map

Answer

GPT

Answer

BSD disklabel

Question 8

During a forensic analysis of a compromised server, you discover that a rootkit has hidden itself by modifying the HPA (Host Protected Area) of the hard disk. Which tool can detect the presence of an HPA by comparing the reported size with the actual number of sectors?

Accepted Answer

hdparm. The hdparm tool in Linux can query the ATA security features, including HPA. The command `hdparm -N /dev/sda` displays the HPA settings and can reveal if an HPA is active by showing a reduced device size.

Answer

smartctl

Answer

dd

Answer

fdisk

Question 9

An investigator is examining a FAT32 filesystem and needs to recover a deleted file. In FAT32, the directory entry for a deleted file has the first byte of the filename set to 0xE5. What does this indicate?

Accepted Answer

The file has been deleted. In FAT filesystems, a deleted file's directory entry is marked with 0xE5 as the first byte of the filename. The file's cluster chain in the File Allocation Table is also marked as free. This is the standard deletion marker.

Answer

The file is a system file

Answer

The file is hidden

Answer

The file is encrypted

Question 10

Which file system artifact in NTFS records file system events such as file creation, deletion, and modification, and is often used to track attacker activities?

Accepted Answer

USN Journal. The USN (Update Sequence Number) journal, also known as the change journal, records all changes to files on an NTFS volume. It is a valuable artifact for tracking file activity and forensic timeline analysis.

Answer

Event Logs

Answer

Prefetch files

Answer

Registry

Question 11

A forensic examiner finds a file on an NTFS volume that appears to have data hidden in its alternate data stream. The file's size is reported as 10 KB, but the volume's cluster size is 4 KB. How many clusters of file slack could potentially contain hidden data in the primary stream?

Accepted Answer

2 KB. File slack is the unused space between the end of the file data and the end of the last cluster. A 10 KB file stored in 4 KB clusters occupies 3 clusters (12 KB), leaving 2 KB of slack space (cluster 3 unused portion). However, the question asks specifically about the primary stream's file slack, which is 2 KB. But note that ADS can also occupy clusters. The answer is 2 KB of slack in the primary stream.

Answer

12 KB

Answer

4 KB

Answer

0 KB

Question 12

During a forensic investigation, you need to acquire the RAM of a running Linux system. Which tool is specifically designed for memory acquisition on Linux?

Accepted Answer

LiME. LiME (Linux Memory Extractor) is a loadable kernel module that allows full system memory acquisition from Linux systems. It is the standard tool for Linux memory forensics.

Answer

Memdump

Answer

Volatility

Answer

WinPmem

Question 13

Which TWO of the following are common challenges in SSD forensics that can hinder data recovery?

Accepted Answer

TRIM. TRIM is a command that allows an operating system to inform an SSD which data blocks are no longer in use and can be wiped internally. When TRIM is enabled, the SSD's controller immediately erases those blocks, making the original data unrecoverable by forensic tools because the physical cells are reset to an unprogrammed state. This directly hinders data recovery because the data is permanently removed at the hardware level before any forensic acquisition can occur.

Answer

File fragmentation

Answer

Bad sectors

Answer

NTFS permissions

Question 14

Which TWO tools are specifically designed for file carving (recovering files based on signatures) and are commonly used in digital forensics?

Accepted Answer

Scalpel. Scalpel and Foremost are both purpose-built file carving tools that recover files by scanning raw data for known file headers and footers (signatures), without relying on filesystem metadata. Scalpel is a rewrite of Foremost with a more efficient configuration file, while Foremost was originally developed by the U.S. Air Force Office of Special Investigations. Both are widely used in digital forensics for data recovery from damaged or unallocated disk space.

Answer

Volatility

Answer

EnCase

Answer

Autopsy

Question 15

Which THREE of the following are valid memory forensic artifacts that can be extracted using the Volatility framework?

Accepted Answer

pstree. Volatility can extract process lists (pslist), network connections (netscan), and process trees (pstree). These are standard plugins for memory analysis.

Answer

ls -l

Answer

dir /r