CHFI Storage Forensics and File System Analysis Practice Test 6 — 15 Questions

Question 1

A forensic analyst is examining a Windows 10 system and needs to view the Master File Table ($MFT) to identify recently deleted files. Which tool is most appropriate for parsing the $MFT directly?

Accepted Answer

EnCase. The $MFT is a core component of NTFS. EnCase has built-in support for parsing $MFT and extracting file metadata.

Answer

Wireshark

Answer

John the Ripper

Answer

Nmap

Question 2

During a forensic examination of a Linux ext4 file system, an investigator runs the `ls -i` command and sees inode numbers. They need to examine the inode structure. Which command should they use to display detailed inode information?

Accepted Answer

debugfs -R 'stat <inode>' /dev/sda1. The `stat` command in Linux displays detailed inode metadata including permissions, timestamps, and block locations.

Answer

dd if=/dev/sda1 of=output.img

Answer

mount -o loop image.img /mnt

Answer

fsck /dev/sda1

Question 3

An analyst discovers a hidden partition on a hard drive that does not appear in the standard MBR partition table. The drive uses GPT partitioning. Which area of the disk should be examined to find evidence of a hidden partition?

Accepted Answer

The GPT header and partition entry array located after the protective MBR. GPT uses a Protective MBR in the first sector, followed by the GPT header and partition entries. A hidden partition might be created by modifying the GPT header or by using alternative partitioning schemes that are not listed in the main GPT table.

Answer

The Master Boot Record (MBR) in sector 0

Answer

The Volume Boot Record (VBR) of the C: drive

Answer

The Host Protected Area (HPA) at the end of the disk

Question 4

A forensic investigator is analyzing a USB drive formatted with FAT32 and finds that a deleted file's directory entry still exists but the first character of the filename is replaced with 0xE5. What does this indicate?

Accepted Answer

The file has been deleted. In FAT file systems, when a file is deleted, the first byte of the directory entry is set to 0xE5 to mark it as deleted, while the rest of the entry remains until overwritten.

Answer

The file is marked as hidden

Answer

The file is encrypted

Answer

The file is fragmented

Question 5

An investigator is using Autopsy to analyze a disk image from a suspected hacker's computer. They want to recover deleted JPEG images that may have been stored in unallocated clusters. Which Autopsy feature is best suited for this task?

Accepted Answer

File Type Sorting. Autopsy's 'File Recovery by Type' module (also known as 'PhotoRec Carver' or 'File Carving') can recover files based on their headers/footers, such as JPEG magic bytes.

Answer

Hash Set Analysis

Answer

Timeline Analysis

Answer

Keyword Search

Question 6

During a forensic investigation of a Windows 10 system, you find that a suspect used the 'cipher /w:C:' command. What is the primary forensic implication of this action?

Accepted Answer

It wipes free space, hindering recovery of deleted files. The `cipher /w:C:` command overwrites free space on the C: drive with zeros, making deleted file recovery from unallocated space much more difficult.

Answer

It encrypts all files on the C: drive

Answer

It enables file system journaling

Answer

It removes alternate data streams from files

Question 7

A forensic analyst needs to acquire RAM from a live Linux system for memory analysis. Which tool is specifically designed for this purpose and can capture memory without rebooting?

Accepted Answer

LiME. LiME (Linux Memory Extractor) is a kernel module that allows acquisition of volatile memory from Linux systems. It loads into the kernel and dumps RAM to a file or over the network.

Answer

FTK Imager

Answer

Volatility

Answer

dd

Question 8

An investigator finds evidence of data hidden using Alternate Data Streams (ADS) on an NTFS volume. Which command would display all ADS associated with files in a directory?

Accepted Answer

dir /r. The `dir /r` command in Windows Command Prompt lists all files, including their alternate data streams. Alternatively, tools like 'streams' from Sysinternals can be used.

Answer

dir /s

Answer

dir /x

Answer

dir /a

Question 9

During a forensic examination of a solid-state drive (SSD), the analyst notices that the TRIM command was enabled. What challenge does this pose for data recovery?

Accepted Answer

It erases data blocks immediately after deletion, preventing recovery. TRIM allows the SSD to erase data blocks immediately after deletion, making it impossible to recover data from those blocks using traditional file carving or undelete methods.

Answer

It causes fragmentation, making file recovery more complex

Answer

It causes the drive to encrypt data automatically

Answer

It physically destroys the NAND cells, making the drive unusable

Question 10

Which file system journal is commonly used in Linux ext3/ext4 to record metadata changes before they are committed to the main file system?

Accepted Answer

Journal (JBD/JBD2). The journal in ext3/ext4 logs metadata changes (and optionally data) to ensure filesystem consistency after a crash. It is a circular log that is replayed during mount.

Answer

$LogFile

Answer

Recycle Bin

Answer

USN Journal

Question 11

A security analyst examines a compromised Windows server and finds a file named 'readme.txt' that appears legitimate. However, using `dir /r`, they discover an alternate data stream named 'readme.txt:hidden.exe'. What is the most likely purpose of this alternate data stream?

Accepted Answer

It is a malicious executable hidden in the file. Alternate Data Streams can be used to hide malicious executables within seemingly innocuous files. The stream 'hidden.exe' suggests an executable is hidden in the file.

Answer

It is a backup copy of the file

Answer

It is a symbolic link to another file

Answer

It is a log file generated by the operating system

Question 12

An investigator uses the `volatility -f mem.dump netscan` command on a memory dump from a Windows 10 system. What information is this command primarily intended to reveal?

Accepted Answer

Network connections and listening ports. The `netscan` plugin in Volatility scans memory for network connections (TCP and UDP) and listening ports, including those from hidden or terminated processes.

Answer

List of running processes

Answer

File handles opened by each process

Answer

Registry hives loaded in memory

Question 13

Which TWO of the following are features of the NTFS file system that can be used to hide data? (Select TWO.)

Accepted Answer

$Recycle.bin. NTFS offers two key features for hiding data: Alternate Data Streams (ADS) allow attaching hidden data to files, and the USN Journal (while not primarily for hiding) can be manipulated to hide changes. However, USN Journal is more of a forensic artifact than a hiding technique. The best answers are ADS and the $Recycle.bin (which can be used to hide files). For this question, focus on ADS and HPA (Host Protected Area) is not NTFS-specific but can be used on NTFS drives. However, HPA is a disk-level feature, not NTFS-specific. The intended correct answers are Alternate Data Streams and the $Recycle.bin (which is a hidden folder).

Answer

Master File Table (MFT)

Answer

Host Protected Area (HPA)

Answer

Volume Shadow Copy

Question 14

Which THREE of the following present unique challenges for forensic analysis of solid-state drives (SSDs) compared to traditional hard disk drives (HDDs)? (Select THREE.)

Accepted Answer

Wear leveling that moves data around the NAND chips. SSDs use flash memory and have features like TRIM, wear leveling, and garbage collection that can destroy or relocate data, making recovery difficult. These are distinct from HDD behavior.

Answer

Slack space analysis due to 512-byte sector emulation

Answer

Fragmentation due to file system aging

Question 15

Which TWO of the following are commonly used tools for file carving (recovering files based on file signatures)? (Select TWO.)

Accepted Answer

Foremost. Foremost and Scalpel are well-known file carving tools that use header/footer signatures to recover files from disk images.

Answer

Nmap

Answer

Wireshark

Answer

John the Ripper