CHFI Storage Forensics and File System Analysis Practice Test 5 — 15 Questions

Question 1

An investigator images an SSD that has TRIM enabled. Which of the following challenges will MOST likely affect the recovery of deleted files from this SSD?

Accepted Answer

TRIM causes the SSD to zero out freed blocks, preventing recovery. When TRIM is enabled on an SSD, the operating system notifies the drive which blocks are no longer in use. The SSD's firmware then immediately zeroes out or internally marks those blocks as free, physically erasing the data. This prevents forensic tools from recovering deleted files because the underlying data is no longer present on the NAND flash cells.

Answer

The SSD uses a different partition table scheme

Answer

The SSD firmware encrypts all data, requiring a decryption key

Answer

Wear leveling spreads data across blocks, complicating recovery

Question 2

A forensic analyst is examining a disk image and needs to identify the file system structure. She looks for the Master File Table ($MFT) to begin analysis. Which file system is she most likely dealing with?

Accepted Answer

NTFS. The Master File Table ($MFT) is a core component of the NTFS file system, storing metadata about every file and directory on the volume. When a forensic analyst locates the $MFT, they are definitively working with an NTFS volume, as no other common file system uses this structure.

Answer

FAT32

Answer

HFS+

Answer

ext4

Question 3

In a memory forensics investigation using Volatility, an analyst wants to see a list of processes that were active at the time of acquisition, including hidden processes. Which Volatility command should be used?

Accepted Answer

psscan. Psscan, because it scans the physical memory for _EPROCESS structures, allowing it to detect processes that are hidden from the standard linked list used by pslist. This makes psscan the appropriate command for identifying hidden or unlinked processes that were active at the time of acquisition.

Answer

pslist

Answer

pstree

Answer

netscan

Question 4

A forensic investigator is analyzing a RAID 0 array consisting of two disks. She uses FTK Imager to acquire the logical drive. However, the data appears interleaved. What additional step is necessary to properly assemble the image?

Accepted Answer

Reconstruct the RAID by determining stripe size and order, then combine the images. RAID 0 uses striping to distribute data across multiple disks, so a logical acquisition of the array will appear interleaved without the stripe parameters. To properly assemble the image, the investigator must determine the stripe size and the order of the disks, then combine the raw images accordingly. This reconstruction ensures the data is read in the correct sequence, allowing file system analysis tools to interpret the logical volume correctly.

Answer

Use EnCase to acquire each disk separately and mount as a RAID volume

Answer

Simply reorder the disk images alphabetically

Answer

Use PhotoRec to carve files from raw images

Question 5

An analyst finds evidence that an attacker used steganography to hide data within image files on the suspect's computer. Which of the following tools is MOST appropriate for detecting steganography in these images?

Accepted Answer

Stegdetect. Stegdetect is specifically designed to detect steganographic content in images by analyzing statistical anomalies in pixel data, such as those introduced by LSB (Least Significant Bit) embedding. It can identify common steganography tools like JSteg, JPHide, and OutGuess, making it the most appropriate choice for this scenario.

Answer

Foremost

Answer

Autopsy

Answer

Volatility

Question 6

What is slack space in a file system?

Accepted Answer

The unused portion of a file's last cluster. Slack space is the unused portion of the last cluster allocated to a file. When a file does not exactly fill its final cluster, the remaining bytes in that cluster are slack space, which can contain remnants of previously deleted data. This is a critical area in file system forensics because it may hold hidden evidence.

Answer

Space used by the file system journal

Answer

Space reserved for the MBR

Answer

Space between partitions on a disk

Question 7

During a forensic examination, an analyst uses Autopsy to view the contents of the Recycle Bin on a Windows 10 system. However, some files that were deleted by the user do not appear in the Recycle Bin. What is the MOST likely reason?

Accepted Answer

The files were deleted using Shift+Delete. When a user deletes a file using Shift+Delete, the file bypasses the Recycle Bin entirely and is permanently removed from the file system. Autopsy, as a forensic tool, reads the Recycle Bin’s metadata (e.g., the $I and $R files) to list its contents, so files deleted with Shift+Delete will not appear there because they were never placed in the Recycle Bin.

Answer

The Recycle Bin stores only files smaller than 1 GB

Answer

The files were encrypted

Answer

The Recycle Bin was emptied

Question 8

Which THREE of the following are characteristics of the GPT (GUID Partition Table) compared to MBR?

Accepted Answer

Partitions are identified by a Globally Unique Identifier (GUID). Option C is correct because GPT identifies each partition and partition type with a Globally Unique Identifier (GUID), which avoids the MBR's reliance on simple numeric type bytes and enables robust, unique identification. Option D is correct because GPT by default provides space for 128 primary partitions in its partition entry array, unlike MBR's four-primary-partition limit. Option E is correct because GPT writes a primary partition table near the beginning of the disk and a backup copy at the end of the disk, allowing recovery if the primary table is damaged. Option A is incorrect because GPT stores partition information in the GPT header and partition entry array, not in the boot code area; that description better fits MBR, where the partition table resides in the master boot record. Option B is incorrect because GPT uses 64-bit Logical Block Addressing (LBA), whereas MBR uses 32-bit LBA fields.

Answer

Partition information is stored in the boot code area

Answer

Uses a 32-bit Logical Block Address (LBA)

Question 9

Which TWO of the following tools are commonly used for file carving during forensic investigations?

Accepted Answer

Foremost. Foremost (C) is correct because it is a classic file-carving tool that scans raw disk images or unallocated space and reconstructs files by matching known headers, footers, and internal structures defined in its configuration file. PhotoRec (E) is also correct because it performs signature-based carving to recover deleted files from disk images, memory cards, and other media, ignoring the filesystem to extract data by content type. Sleuth Kit (A) is a forensic analysis toolkit for examining filesystem metadata and timelines rather than a dedicated carving tool, WinPmem (B) is a memory acquisition tool for capturing RAM images, and Volatility (D) is a memory forensics framework for analyzing RAM dumps, so none of these are primarily used for file carving.

Answer

Sleuth Kit

Answer

WinPmem

Answer

Volatility

Question 10

During a forensic examination of a solid-state drive (SSD), you notice that files deleted several months ago cannot be recovered using traditional file carving tools. Which SSD feature is MOST likely preventing recovery?

Accepted Answer

TRIM. The TRIM command (ATA Data Set Management command) allows the operating system to inform the SSD which data blocks are no longer in use. When TRIM is enabled, the SSD's controller immediately erases those blocks internally, making the original file data unrecoverable by file carving tools because the physical NAND cells are zeroed or marked as invalid. For files deleted months ago, TRIM would have already been issued for those LBAs, so traditional carving that relies on residual data in unallocated space fails.

Answer

Over-provisioning

Answer

Garbage Collection

Answer

Wear levelling

Question 11

An investigator needs to recover a deleted partition from a disk that originally used an MBR partition table. Which tool can scan the disk for lost partitions and rebuild the partition table?

Accepted Answer

TestDisk. TestDisk is specifically designed for data recovery and can scan a disk for lost partitions by analyzing the underlying MBR (Master Boot Record) structure. It can rebuild the partition table by searching for partition boot sectors and file system signatures, allowing recovery of deleted or corrupted partitions. This makes it the correct tool for the scenario described.

Answer

FTK Imager

Answer

Autopsy

Answer

PhotoRec

Question 12

A forensic analyst is investigating a Windows system and needs to examine the contents of the Recycle Bin. Which file artifact contains metadata about deleted files, including original file paths and deletion times?

Accepted Answer

$Recycle.bin\$I. The $I file in the $Recycle.bin folder stores metadata about deleted files, including the original file path, deletion timestamp, and file size. This is the index file that the Recycle Bin uses to restore items to their original locations, making it the correct artifact for examining deletion metadata.

Answer

C:\Windows\System32\winevt\Logs

Answer

$Recycle.bin\$R

Answer

C:\Windows\Prefetch

Question 13

An analyst is analyzing a disk image and finds a 512-byte sector at LBA 0 that contains a bootloader and a partition table. The partition table has four entries, each 16 bytes. What type of partition table is this?

Accepted Answer

MBR. The Master Boot Record (MBR) partition table is defined by a 512-byte sector at LBA 0 that contains a bootloader (first 446 bytes) and four 16-byte partition entries (total 64 bytes), ending with a 2-byte signature (0x55AA). This matches the description exactly, making B the correct answer.

Answer

Apple Partition Map

Answer

GPT

Answer

BSD disklabel

Question 14

An investigator is examining a FAT32 filesystem and needs to recover a deleted file. In FAT32, the directory entry for a deleted file has the first byte of the filename set to 0xE5. What does this indicate?

Accepted Answer

The file has been deleted. In FAT32, when a file is deleted, the directory entry's first byte (the filename's first character) is overwritten with the value 0xE5. This is a deliberate marker used by the file system to indicate that the entry is available for reuse, meaning the file has been logically deleted. The data clusters remain intact until overwritten, which is why recovery tools look for entries with this byte to restore deleted files.

Answer

The file is a system file

Answer

The file is hidden

Answer

The file is encrypted

Question 15

Which file system artifact in NTFS records file system events such as file creation, deletion, and modification, and is often used to track attacker activities?

Accepted Answer

USN Journal. The USN (Update Sequence Number) Journal is a native NTFS feature that logs all changes to files and directories on a volume, including creation, deletion, and modification events. Forensic analysts use it to reconstruct timelines of attacker activity because it records the reason for the change (e.g., USN_REASON_FILE_CREATE, USN_REASON_FILE_DELETE) along with timestamps and file references, even if the file is later deleted or renamed.

Answer

Event Logs

Answer

Prefetch files

Answer

Registry