CHFI Storage Forensics and File System Analysis Practice Test 5 — 15 Questions

Question 1

A forensic investigator examines a hard drive and needs to recover deleted files. Which tool is specifically designed for file carving by scanning raw data for file headers and footers without relying on the file system?

Accepted Answer

Foremost. Foremost is a file carving tool that recovers files based on headers, footers, and data structures, independent of the file system metadata.

Answer

Volatility

Answer

Autopsy

Answer

FTK Imager

Question 2

During a forensic analysis of an NTFS volume, an investigator finds a file that appears to be hidden. Which NTFS feature allows data to be stored in a file without affecting the file's visible size in the directory listing?

Accepted Answer

Alternate Data Streams (ADS). Alternate Data Streams (ADS) in NTFS allow data to be attached to a file, and the size is not shown in the main directory listing.

Answer

Volume Shadow Copy

Answer

USN Journal

Answer

Master File Table ($MFT)

Question 3

An analyst is investigating a compromised Linux system. Which file system structure holds metadata about every file and directory, including permissions, ownership, timestamps, and pointers to data blocks?

Accepted Answer

Inode. Inodes are data structures in ext2/3/4 that store metadata about files and directories.

Answer

Journal

Answer

Block bitmap

Answer

Superblock

Question 4

A forensic examiner acquires a RAM image from a Windows 10 system and uses Volatility to analyze it. Which command would list all running processes along with their parent process IDs and command lines?

Accepted Answer

volatility -f mem.raw pstree. The pstree plugin shows processes in tree format with parent-child relationships, while pslist lists processes without parent info. For parent PIDs and command lines, pstree is appropriate.

Answer

volatility -f mem.raw pslist

Answer

volatility -f mem.raw netscan

Answer

volatility -f mem.raw cmdline

Question 5

During a forensic investigation of a hard disk, the investigator finds that the partition table is missing. The disk was previously partitioned using GPT. Which area of the disk should be examined to recover the GPT partition table?

Accepted Answer

LBA 1 (sector 1). GPT stores a primary partition table at LBA 1 (sector 1) and a backup at the end of the disk. The protective MBR is at LBA 0.

Answer

Last sector of the disk

Answer

Volume boot record

Answer

Master Boot Record (LBA 0)

Question 6

An investigator is analyzing a FAT32 drive and notices that a deleted file's directory entry still exists, but the first byte of the filename is changed to 0xE5. What does this indicate about the file?

Accepted Answer

The file is marked as deleted but its data clusters may still be intact. In FAT file systems, a deleted file's directory entry has the first byte of the filename set to 0xE5. The clusters in the FAT may still be allocated or marked as free.

Answer

The file is fragmented

Answer

The file has been securely overwritten

Answer

The file is encrypted

Question 7

In an ext4 file system, after a file is deleted, the inode's di_mode field is set to 0 and the block pointers are cleared. However, the file content may still be recoverable until what happens?

Accepted Answer

The data blocks are overwritten by new files. In ext4, when a file is deleted, its inode is marked as free, and data blocks are added to the free block bitmap. Recovery is possible if the blocks have not been reused.

Answer

The file system is unmounted

Answer

The superblock is updated

Answer

The journal is committed

Question 8

A forensic analyst is examining an SSD that may have had deleted files. The analyst is concerned about the TRIM command. What effect does TRIM have on forensic recovery of deleted files?

Accepted Answer

TRIM invalidates deleted data blocks, making them unreadable and unrecoverable. TRIM allows the SSD to erase data blocks immediately after deletion, making recovery nearly impossible because the data is actually zeroed out.

Answer

TRIM increases the chance of recovering deleted files

Answer

TRIM causes wear leveling that spreads data across blocks, aiding recovery

Answer

TRIM has no effect on forensic analysis

Question 9

During a forensic investigation, an analyst uses a tool to capture the contents of RAM from a live Linux system. Which tool is specifically designed for this purpose and can acquire memory over a network or via a local kernel module?

Accepted Answer

LiME. LiME (Linux Memory Extractor) is a tool that acquires RAM from Linux systems and can output to various formats, including over the network.

Answer

WinPmem

Answer

FTK Imager

Answer

Volatility

Question 10

A forensic examiner is analyzing a RAID 5 array consisting of three disks. One disk has failed and is not available. The remaining two disks contain data and parity. Which technique can be used to reconstruct the missing disk's data and recover the original data?

Accepted Answer

Use dd to image the two disks, then perform a XOR operation on the data stripes to reconstruct the third disk's data. In RAID 5, parity is distributed across all disks. With two disks and one missing, XOR operations can reconstruct the missing data.

Answer

Replace the failed disk and rebuild the array using the controller's rebuild function

Answer

Use FTK Imager to create a logical image of each disk and merge them

Answer

Simply image the two disks and use file carving tools to extract files

Question 11

An analyst discovers that a Windows system has hidden data in the Host Protected Area (HPA) of the hard drive. Which tool or method can be used to detect and access the HPA?

Accepted Answer

Using the hdparm command in Linux with the -N flag. HPA is a region of the disk that is normally hidden from the operating system. Tools like hdparm (Linux) or MBRTool can be used to detect and modify HPA settings. FTK and EnCase can also detect HPA when imaging at the device level.

Answer

Using the Windows Disk Management utility

Answer

Using the Volatility framework

Answer

Using the chkdsk command

Question 12

During a forensic analysis of an APFS volume, the investigator needs to examine file metadata such as creation time, modification time, and extended attributes. Which APFS structure contains this information?

Accepted Answer

Inode Table. In APFS, files and directories are represented by inodes. The inode contains basic metadata. Extended attributes are stored separately in B-tree structures.

Answer

Volume Superblock

Answer

Journal

Answer

Extent Reference Tree

Question 13

Which TWO of the following are valid methods to hide data on an NTFS volume? (Choose two.)

Accepted Answer

Storing data in the $Recycle.bin folder. Alternate Data Streams (ADS) allow data hiding in files, and the $Recycle.bin folder can be used to store deleted files that are not visible in normal browsing.

Answer

Using the volume boot record

Answer

Using the MFT resident data area

Answer

Using the USN journal

Question 14

Which THREE of the following are characteristics of the Master File Table ($MFT) in NTFS? (Choose three.)

Accepted Answer

It contains a record for every file and directory on the volume. The $MFT stores metadata (attributes) for each file and directory in records. Each record is typically 1 KB. Small files can be stored resident within the $MFT record.

Answer

It is located at a fixed position at the beginning of the volume

Answer

It is only used for directory metadata

Question 15

Which TWO of the following are challenges in SSD forensics compared to traditional HDD forensics? (Choose two.)

Accepted Answer

Wear leveling distributes data across blocks, making it harder to recover specific files. B is correct because wear leveling is a fundamental SSD technology that spreads write operations evenly across all memory blocks to prevent premature wear. This process scatters file fragments across different physical locations, making it significantly harder to recover specific files using traditional forensic methods that rely on contiguous data storage.

Answer

SSDs are not compatible with forensic imaging tools

Answer

SSDs have larger storage capacity than HDDs

Answer

SSDs are more resistant to physical damage