CHFI Storage Forensics and File System Analysis Practice Test 5 — 15 Questions

Question 1

A forensic investigator is analyzing a USB drive formatted with FAT32 and finds that a deleted file's directory entry still exists but the first character of the filename is replaced with 0xE5. What does this indicate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The file has been deleted. In FAT32 file systems, when a file is deleted, the first byte of its directory entry's filename is replaced with the hexadecimal value 0xE5 (which displays as a lowercase sigma 'σ' in some viewers). This is the standard deletion marker for FAT file systems, indicating that the file's directory entry is available for reuse. The presence of 0xE5 in the first character position specifically signifies deletion, not any other attribute or state.

Answer

The file is marked as hidden

Answer

The file is encrypted

Answer

The file is fragmented

Question 2

An investigator is using Autopsy to analyze a disk image from a suspected hacker's computer. They want to recover deleted JPEG images that may have been stored in unallocated clusters. Which Autopsy feature is best suited for this task?

Accepted Answer

File Type Sorting. Autopsy's File Type Sorting feature allows the investigator to carve files from unallocated clusters based on their file signatures (magic bytes), such as JPEG headers (FF D8 FF). This enables recovery of deleted images even when the file system metadata is gone, making it the correct choice for recovering deleted JPEGs from unallocated space.

Answer

Hash Set Analysis

Answer

Timeline Analysis

Answer

Keyword Search

Question 3

During a forensic investigation of a Windows 10 system, you find that a suspect used the 'cipher /w:C:' command. What is the primary forensic implication of this action?

Accepted Answer

It wipes free space, hindering recovery of deleted files. The 'cipher /w:C:' command overwrites all free space on the C: drive with three passes of random data (0x00, 0xFF, and a random byte). This action permanently destroys the remnants of previously deleted files, making them unrecoverable by forensic tools. The primary forensic implication is that it severely hinders the recovery of deleted files, which is a common anti-forensic technique.

Answer

It encrypts all files on the C: drive

Answer

It enables file system journaling

Answer

It removes alternate data streams from files

Question 4

A forensic analyst needs to acquire RAM from a live Linux system for memory analysis. Which tool is specifically designed for this purpose and can capture memory without rebooting?

Accepted Answer

LiME. LiME (Linux Memory Extractor) is specifically designed to capture volatile memory from live Linux systems without requiring a reboot. It loads a kernel module that safely dumps RAM contents to a file, preserving the memory image for forensic analysis. Unlike dd, LiME handles memory-mapped I/O and avoids corrupting the system state during acquisition.

Answer

FTK Imager

Answer

Volatility

Answer

dd

Question 5

An investigator finds evidence of data hidden using Alternate Data Streams (ADS) on an NTFS volume. Which command would display all ADS associated with files in a directory?

Accepted Answer

dir /r. The `dir /r` command in Windows displays alternate data streams (ADS) associated with files on an NTFS volume. ADS are a feature of NTFS that allow additional data to be stored with a file, hidden from standard directory listings. The `/r` switch specifically lists all streams, including the main stream and any alternate streams, making it the correct choice for forensic identification of hidden data.

Answer

dir /s

Answer

dir /x

Answer

dir /a

Question 6

Which file system journal is commonly used in Linux ext3/ext4 to record metadata changes before they are committed to the main file system?

Accepted Answer

Journal (JBD/JBD2). The ext3 and ext4 file systems in Linux use the Journal (JBD/JBD2) layer to record metadata changes in a circular log before they are committed to the main file system. This journaling mechanism ensures file system consistency after a crash by allowing replay of committed transactions, with JBD2 specifically supporting ext4's 64-bit features and checksums.

Answer

$LogFile

Answer

Recycle Bin

Answer

USN Journal

Question 7

A security analyst examines a compromised Windows server and finds a file named 'readme.txt' that appears legitimate. However, using `dir /r`, they discover an alternate data stream named 'readme.txt:hidden.exe'. What is the most likely purpose of this alternate data stream?

Accepted Answer

It is a malicious executable hidden in the file. Alternate data streams (ADS) in NTFS allow a malicious executable to be hidden within a legitimate file without affecting its visible size or content. The `dir /r` command reveals the ADS 'readme.txt:hidden.exe', indicating that an executable is attached to the file, which is a common technique to evade detection and execute malware.

Answer

It is a backup copy of the file

Answer

It is a symbolic link to another file

Answer

It is a log file generated by the operating system

Question 8

An investigator uses the `volatility -f mem.dump netscan` command on a memory dump from a Windows 10 system. What information is this command primarily intended to reveal?

Accepted Answer

Network connections and listening ports. The `volatility -f mem.dump netscan` command is specifically designed to extract network connection artifacts from a memory dump, including active TCP/UDP connections, listening ports, and associated process identifiers (PIDs). It parses Windows network data structures such as `_TCPT_OBJECT` and `_UDP_HEADER` to reconstruct the network state at the time of acquisition, making it the correct tool for revealing network connections and listening ports.

Answer

List of running processes

Answer

File handles opened by each process

Answer

Registry hives loaded in memory

Question 9

Which TWO of the following are features of the NTFS file system that can be used to hide data? (Select TWO.)

Accepted Answer

$Recycle.bin. The $Recycle.bin folder is a hidden system folder on NTFS volumes that stores deleted files. Forensic investigators often find that malicious actors deliberately place incriminating data inside this folder, relying on the fact that it is hidden by default and users rarely browse it. This makes it a viable location for hiding data on an NTFS file system.

Answer

Master File Table (MFT)

Answer

Host Protected Area (HPA)

Answer

Volume Shadow Copy

Question 10

Which THREE of the following present unique challenges for forensic analysis of solid-state drives (SSDs) compared to traditional hard disk drives (HDDs)? (Select THREE.)

Accepted Answer

Wear leveling that moves data around the NAND chips. Wear leveling is a technique used in SSDs to distribute write and erase cycles evenly across NAND flash memory cells, preventing premature wear of specific cells. This process moves data around the NAND chips, which complicates forensic analysis because the logical block addresses (LBAs) seen by the operating system no longer correspond directly to the physical locations of the data, making it difficult to recover data based on physical position or to correlate file system metadata with actual storage locations.

Answer

Slack space analysis due to 512-byte sector emulation

Answer

Fragmentation due to file system aging

Question 11

Which TWO of the following are commonly used tools for file carving (recovering files based on file signatures)? (Select TWO.)

Accepted Answer

Foremost. Foremost is a widely used file carving tool that recovers files based on their headers, footers, and internal data structures (file signatures). It operates by scanning raw disk images or memory dumps for known file magic bytes, such as JPEG's `FF D8 FF` or PDF's `%PDF`, and then extracting the data between matching headers and footers.

Answer

Nmap

Answer

Wireshark

Answer

John the Ripper

Question 12

During a forensic investigation, an analyst needs to recover recently deleted files from a FAT32 partition. Which of the following techniques is MOST effective for recovering files whose directory entries have been marked as deleted but the clusters have not yet been overwritten?

Accepted Answer

Editing the directory entry's first byte from 0xE5 to the original character and recalculating the FAT chain. In FAT32, when a file is deleted, the first byte of its directory entry is set to 0xE5, but the FAT chain and cluster data remain intact until overwritten. By editing the first byte back to its original character (e.g., the first letter of the filename) and recalculating the FAT chain to restore cluster linkage, the file can be fully recovered without needing file carving. This technique directly reverses the deletion marker and restores the file system metadata, making it the most effective for files whose clusters are unallocated but not overwritten.

Answer

Running 'scalpel' to extract fragments and reassemble based on metadata

Answer

Using the 'foremost' tool to perform file carving based on file headers and footers

Answer

Using 'dd' to create a raw image and then 'photorec' to recover based on file signatures

Question 13

During a memory forensics analysis using Volatility, an examiner runs 'python vol.py -f memory.dmp pslist' and sees a suspicious process named 'expl0rer.exe' with a PPID of 4. What does a PPID of 4 indicate, and what should the examiner do next?

Accepted Answer

The process is probably a hidden or injected process; run 'psxview' and 'malfind' to detect anomalies. In Windows memory forensics, a PPID of 4 indicates the parent process is the System process (PID 4), which is the kernel-mode process responsible for starting system services and drivers. A suspicious process like 'expl0rer.exe' with PPID 4 is highly anomalous because legitimate user-mode processes are rarely direct children of the System process; the most notable legitimate exception is smss.exe. The examiner should run 'psxview' to check for hidden processes and 'malfind' to detect code injection, as this PPID can indicate a process masquerading as a system component or whose parent PID has been manipulated.

Answer

The process is a child of the System process, indicating it is a legitimate system process; no further action needed

Answer

The process is a child of the System Idle Process, which is normal; ignore it

Answer

The process has been injected into the System process and is likely a rootkit; run 'psscan' to verify

Question 14

An analyst is investigating a Linux server running ext4 and needs to recover deleted files that may have been overwritten partially. Which technique is BEST suited for recovering fragments of known file types when the inode metadata is lost?

Accepted Answer

Perform file carving using 'foremost' with custom signatures. When inode metadata is lost, file system-based recovery tools like extundelete cannot function because they rely on that metadata. File carving with foremost uses content-based signatures (magic bytes) to locate and extract file fragments, even from partially overwritten areas of the disk. This makes it the best choice for recovering fragments of known file types when the file system metadata is unavailable.

Answer

Use 'dd' to extract the partition and then 'grep' for strings

Answer

Manually reconstruct the inode table using 'debugfs'

Answer

Use 'extundelete' to recover files from the journal

Question 15

A forensic examiner needs to acquire the RAM from a Windows 10 system without altering the contents. Which tool is MOST appropriate for this task?

Accepted Answer

WinPmem. WinPmem is the most appropriate tool for acquiring RAM from a Windows 10 system because it is specifically designed for memory acquisition on Windows platforms, using the WinPmem driver to access physical memory without modifying the contents. It supports both 32-bit and 64-bit systems and can output raw memory images or other formats, ensuring forensic soundness by minimizing interaction with the target system.

Answer

FTK Imager

Answer

LiME

Answer

dd