CHFI Storage Forensics and File System Analysis Practice Test 4 — 15 Questions

Question 1

An investigator is analyzing a RAID 5 array consisting of three disks. One disk fails and is replaced. After rebuilding, the file system appears corrupted. What is the MOST likely cause?

Accepted Answer

The replacement disk is smaller than the original. In a RAID 5 array, all disks must have the same capacity for the array to function correctly. If a replacement disk is smaller than the original, the RAID controller will either refuse to rebuild or will rebuild using only the smaller disk's capacity, truncating data and causing file system corruption. This is a common cause of post-rebuild corruption because the parity and data stripes are misaligned or missing.

Answer

Two disks failed simultaneously

Answer

The file system is not supported by the RAID controller

Answer

The array was configured with an incorrect stripe size

Question 2

During memory analysis, an examiner uses the Volatility 'malfind' plugin and discovers a process with executable code in an executable heap. Which technique is most likely being used by malware to avoid detection?

Accepted Answer

Heap spraying. The 'malfind' plugin in Volatility detects memory pages with executable code in non-standard locations, such as executable heaps. Heap spraying is a technique where malware allocates multiple heap blocks and fills them with malicious shellcode, then exploits a vulnerability to redirect execution to that heap. This results in executable code present in heap memory, which malfind flags.

Answer

Process hollowing

Answer

DLL injection

Answer

Reflective DLL loading

Question 3

Which THREE of the following are techniques used to hide data on a hard drive?

Accepted Answer

Host Protected Area (HPA). Host Protected Area (HPA) is correct because it is a hidden region of the disk, outside the normal addressable sectors reported to the OS, that can be used to conceal data from standard file system tools. Slack space is correct because the unused bytes between the logical end of a file and the end of its allocated cluster can store hidden data without changing the file's apparent size. Alternate Data Streams (ADS) is correct because NTFS allows multiple data streams to be attached to a single file, and these streams are not shown by ordinary directory listings, making them a common hiding technique. File carving is not a hiding technique but a forensic recovery method for reconstructing files from raw disk data, and hashing is an integrity-verification technique that produces a fixed-length digest and does not conceal data.

Answer

File carving

Answer

Hashing

Question 4

Which TWO of the following are challenges specific to SSD forensics compared to HDD forensics?

Accepted Answer

Wear leveling distributes writes, complicating data location. Option A is correct because SSD controllers use wear leveling to spread writes across flash blocks, so logical block addresses no longer map predictably to physical NAND locations, making it hard to determine where data actually resides. Option E is correct because the ATA TRIM command (and SCSI UNMAP) tells the SSD controller that deleted blocks are no longer needed, allowing them to be erased during garbage collection, which can destroy evidence that would persist on an HDD. Option B is not SSD-specific, since file system metadata can be overwritten on any storage medium. Option C is incorrect because magnetic remanence is a property of magnetic HDD platters, not SSDs. Option D is not SSD-specific either, as slack space remnants of deleted files exist in file systems on both HDDs and SSDs.

Answer

File system metadata may be overwritten

Answer

Magnetic remanence allows data recovery

Answer

Slack space contains remnants of deleted files

Question 5

During a forensic examination of a Windows 10 system, an investigator runs the following command: 'fsutil usn readjournal C: > usn_output.txt'. What is the primary purpose of this action?

Accepted Answer

To analyze the Update Sequence Number (USN) journal for file system activity. The `fsutil usn readjournal` command reads the Update Sequence Number (USN) journal, which is a change journal that records all modifications to files and directories on an NTFS volume. This is the primary purpose of the command, as it allows an investigator to analyze file system activity, including file creations, deletions, and modifications, which is critical for forensic timeline reconstruction.

Answer

To recover deleted files from the Recycle Bin

Answer

To check the integrity of the NTFS file system

Answer

To extract the Master File Table ($MFT) from the volume

Question 6

An analyst recovers a disk image from a Linux server that used ext4. The image shows a superblock backup at multiple offsets. Which dd command would correctly extract the backup superblock located at offset 32768 bytes?

Accepted Answer

dd if=image.dd of=superblock.bin bs=512 skip=64 count=2. Both options B and C correctly extract the backup superblock from the disk image. The ext4 superblock is 1024 bytes and starts at offset 32768 bytes. With bs=512, skip=64 gives offset 32768 (64*512=32768), and count=2 reads 1024 bytes (2*512=1024). With bs=1024, skip=32 gives offset 32768 (32*1024=32768), and count=1 reads 1024 bytes. Both commands extract exactly the superblock. Option A uses bs=4096 and count=1, reading 4096 bytes, which is too much and may include adjacent data. Option D uses bs=32768 and count=1, reading 32768 bytes, far exceeding the superblock size.

Answer

dd if=image.dd of=superblock.bin bs=4096 skip=8 count=1

Answer

dd if=image.dd of=superblock.bin bs=32768 skip=1 count=1

Question 7

Which file system artifact in NTFS is used to hide data by appending a stream to an existing file without affecting its primary data stream?

Accepted Answer

Alternate Data Streams (ADS). Alternate Data Streams (ADS) are a feature of the NTFS file system that allows a file to have multiple data streams associated with it. Data written to an alternate stream does not appear in the primary stream, so the file's size and content as seen by standard tools remain unchanged, making it a common method for hiding data.

Answer

USN Journal

Answer

$Recycle.bin

Answer

Master File Table ($MFT)

Question 8

What is the primary purpose of the Host Protected Area (HPA) on a hard disk drive?

Accepted Answer

To store diagnostic data or allow vendors to hide data from the OS. HPA is a reserved area on the disk that is not visible to the operating system, intended for vendor-specific data. It can be used to hide data from forensic acquisition.

Answer

To provide a write-cache for improved performance

Answer

To store the partition table when using GPT

Answer

To store the operating system boot loader

Question 9

An analyst runs 'foremost -i disk.dd -o output' and recovers several JPEG files. However, some files are corrupted or incomplete. What is the most likely cause?

Accepted Answer

The files were fragmented across the disk, and foremost did not reassemble fragments. Foremost is a file carving tool that relies on file headers and footers to recover data. It does not handle fragmentation; if a JPEG file's data blocks are non-contiguous on the disk, Foremost will only recover the first fragment up to the point where the next fragment begins, resulting in a corrupted or incomplete file. This is a known limitation of header/footer carving without fragmentation support.

Answer

The files were stored in a journaling file system that overwrites deleted data quickly

Answer

The output directory had insufficient space to store the recovered files

Answer

The disk image contains bad sectors that could not be read

Question 10

Which tool is specifically designed to acquire RAM from a Linux system for forensic analysis?

Accepted Answer

LiME. LiME (Linux Memory Extractor) is a Loadable Kernel Module (LKM) specifically designed to capture volatile memory (RAM) from Linux systems. Unlike other tools that rely on user-space access, LiME operates at the kernel level, ensuring a more complete and forensically sound acquisition of the entire physical address space, including memory regions that user-space tools cannot reach.

Answer

WinPmem

Answer

EnCase

Answer

FTK Imager

Question 11

An investigator notes that a file on an NTFS volume has a resident data size of 900 bytes, but the $DATA attribute lists an allocated size of 1024 bytes. What does this indicate?

Accepted Answer

The file has slack space that may contain remnants of previously deleted data. On an NTFS volume, when a file's data is stored as a resident attribute within the MFT, the $DATA attribute's allocated size is typically 0 because the data occupies space only within the MFT record itself. Here, the allocated size is 1024 bytes, which is larger than the resident data size of 900 bytes. This indicates that the file is stored non-resident (i.e., in clusters outside the MFT), and the allocated size reflects the cluster size (e.g., 1024 bytes per cluster). The difference between the allocated size (1024 bytes) and the actual data size (900 bytes) is slack space, which may contain remnants of previously deleted data.

Answer

The file is compressed using NTFS compression

Answer

The file's data is stored in the MFT as a resident attribute

Answer

The file is stored in an alternate data stream

Question 12

Which TWO of the following are valid methods for hiding data on an NTFS volume without using third-party tools? (Select 2)

Accepted Answer

Slack space (file slack or volume slack). Option C is correct because NTFS allocates disk space in clusters, and when a file's logical size is smaller than the allocated cluster(s), the unused bytes form file slack (and unused clusters at the end of the volume form volume slack); data written into that slack is not visible through normal file reads and requires no third-party tool—just native OS utilities. Option D is correct because NTFS natively supports Alternate Data Streams, allowing extra data to be attached to a file via syntax like 'type secret > file.txt:stream', and this stream is not shown by default in Explorer or a standard 'dir' listing, making it a built-in hiding method. Option A is not a hiding method—a symbolic link is simply a reparse point that redirects to a target, and the link itself is visible; it does not conceal data. Option B, EFS encryption, protects confidentiality but does not hide the file's existence, as the file and its metadata remain visible. Option E, the $Recycle.bin folder, is a normal system folder for deleted items and does not provide a native concealment mechanism beyond ordinary file attributes.

Answer

Creating a symbolic link to a hidden file

Answer

Encrypting the file with EFS

Answer

Using the $Recycle.bin folder

Question 13

Which THREE of the following are challenges specific to forensic analysis of solid-state drives (SSDs) compared to traditional hard disk drives? (Select 3)

Accepted Answer

TRIM command may permanently erase deleted data. Option A is correct because the ATA TRIM command (and SCSI UNMAP) tells the SSD controller which LBAs are no longer in use, allowing those flash pages to be erased during idle garbage collection, so deleted data may be irrecoverably gone rather than merely unallocated as on an HDD. Option D is correct because garbage collection operates autonomously in the background, erasing whole flash blocks that still contain remnants of deleted files, so evidence can disappear between the time of seizure and acquisition. Option E is correct because wear leveling transparently relocates logical blocks to different physical NAND pages to spread erase cycles, breaking the fixed LBA-to-physical-sector mapping that forensic tools rely on and complicating file-system and deleted-file reconstruction. Option B is wrong because SSDs use NAND flash memory, not magnetic platters, so degaussing is inapplicable (and would not affect flash). Option C is wrong because SSDs have no rotating platters or actuator arms, so rotational latency is not a factor; they are generally faster to image than HDDs.

Answer

SSDs have platters that can be degaussed to destroy data

Answer

SSDs are slower to image because of rotational latency

Question 14

A forensic analyst finds a partition that uses the Master Boot Record (MBR) scheme. Which of the following is TRUE about the MBR partition table?

Accepted Answer

It stores partition information in a 64-byte table. The MBR partition table is exactly 64 bytes in size, divided into four 16-byte entries. Each entry stores the starting and ending CHS/LBA addresses, partition type, and boot flag. This fixed-size table is the defining characteristic of the MBR scheme, limiting it to four primary partitions.

Answer

It uses a 128-bit Globally Unique Identifier (GUID) for partitions

Answer

It supports disks larger than 2 TiB

Answer

It stores a backup partition table at the end of the disk

Question 15

A security analyst suspects an attacker has hidden data in the Host Protected Area (HPA) of a suspect's hard drive. Which of the following tools is BEST suited to detect and access the HPA?

Accepted Answer

EnCase. EnCase is the best tool for detecting and accessing the Host Protected Area (HPA) because it has built-in support for reading ATA commands that identify and access the HPA, such as IDENTIFY DEVICE and SET MAX ADDRESS. It can bypass the operating system's abstraction layer to directly query the drive's native command set, allowing forensic acquisition of the HPA region that is normally hidden from standard disk utilities.

Answer

Foremost

Answer

WinPmem

Answer

PhotoRec