CHFI Storage Forensics and File System Analysis Practice Test 6 — 15 Questions

Question 1

A forensic examiner finds a file on an NTFS volume that appears to have data hidden in its alternate data stream. The file's size is reported as 10 KB, but the volume's cluster size is 4 KB. How many clusters of file slack could potentially contain hidden data in the primary stream?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

2 KB. The file's primary stream occupies 10 KB, which requires 3 clusters (3 × 4 KB = 12 KB). The slack space is the unused portion of the last cluster: 12 KB - 10 KB = 2 KB. This 2 KB of file slack in the primary stream could potentially contain hidden data, making option C correct.

Answer

12 KB

Answer

4 KB

Answer

0 KB

Question 2

During a forensic investigation, you need to acquire the RAM of a running Linux system. Which tool is specifically designed for memory acquisition on Linux?

Accepted Answer

LiME. LiME (Linux Memory Extractor) is the correct tool because it is specifically designed to capture volatile memory (RAM) from Linux systems, loading as a loadable kernel module (LKM) to dump memory contents to a file or over the network. Unlike generic tools, LiME handles kernel address space layout randomization (KASLR) and can acquire memory without altering the system state, making it the standard for Linux forensic memory acquisition.

Answer

Memdump

Answer

Volatility

Answer

WinPmem

Question 3

Which TWO tools are specifically designed for file carving (recovering files based on signatures) and are commonly used in digital forensics?

Accepted Answer

Scalpel. Scalpel (B) is correct because it is a signature-based file carving tool derived from Foremost that reads a configurable header/footer database to extract files from raw disk images or unallocated space without relying on filesystem metadata. Foremost (C) is correct because it was originally developed for the U.S. Air Force OSI and carves files by matching file headers and footers (e.g., JPEG, PDF, ZIP) in disk images, making it a canonical carving utility in digital forensics. Volatility (A) is a memory forensics framework for analyzing RAM dumps, not a file carver. EnCase (D) is a full commercial forensic suite that can recover files via filesystem parsing and some carving, but it is not specifically designed as a signature-based carving tool. Autopsy (E) is a graphical forensic platform that integrates carving modules (often via Scalpel or its own ingest modules) but is not itself a dedicated carving tool.

Answer

Volatility

Answer

EnCase

Answer

Autopsy

Question 4

Which THREE of the following are valid memory forensic artifacts that can be extracted using the Volatility framework?

Accepted Answer

pstree. The Volatility framework provides plugins that parse a memory image and reconstruct kernel-level data structures, so pstree (A) is valid because it walks the active process list and renders the parent-child process hierarchy from the EPROCESS structures. pslist (B) is also valid because it enumerates active processes by traversing the doubly linked list of EPROCESS objects in the kernel, a core memory-forensic artifact. netscan (D) is valid because it recovers network connection and socket artifacts (TCP/UDP endpoints, listening ports, owning PIDs) from memory pool structures. By contrast, ls -l (C) is a Linux shell command for listing filesystem directory entries, and dir /r (E) is a Windows CMD command for listing files with alternate data streams; neither is a Volatility plugin nor a memory artifact extraction technique.

Answer

ls -l

Answer

dir /r

Question 5

A forensic investigator examines a hard drive and needs to recover deleted files. Which tool is specifically designed for file carving by scanning raw data for file headers and footers without relying on the file system?

Accepted Answer

Foremost. Foremost is a file carving tool that scans raw disk data for known file headers and footers (e.g., JPEG, PDF, ZIP) to recover files independently of the file system metadata. This makes it ideal when the file system is damaged or deleted, as it relies solely on content signatures rather than directory structures.

Answer

Volatility

Answer

Autopsy

Answer

FTK Imager

Question 6

During a forensic analysis of an NTFS volume, an investigator finds a file that appears to be hidden. Which NTFS feature allows data to be stored in a file without affecting the file's visible size in the directory listing?

Accepted Answer

Alternate Data Streams (ADS). Alternate Data Streams (ADS) allow additional data to be attached to a file on an NTFS volume without altering the file's main data stream or its visible size in directory listings. This is possible because NTFS organizes file data into multiple streams; the default $DATA stream holds the visible content, while additional named streams can store hidden data. Tools like `dir` or Windows Explorer only report the size of the unnamed $DATA stream, making ADS an effective method for concealing data.

Answer

Volume Shadow Copy

Answer

USN Journal

Answer

Master File Table ($MFT)

Question 7

An analyst is investigating a compromised Linux system. Which file system structure holds metadata about every file and directory, including permissions, ownership, timestamps, and pointers to data blocks?

Accepted Answer

Inode. The inode is the fundamental data structure in Unix/Linux file systems (e.g., ext2/3/4) that stores metadata for each file and directory, including permissions, ownership, timestamps (access, modify, change), and pointers to data blocks. Unlike the superblock or block bitmap, the inode does not store the file name (which is in directory entries) but contains all other essential metadata required for file system operations.

Answer

Journal

Answer

Block bitmap

Answer

Superblock

Question 8

During a forensic investigation of a hard disk, the investigator finds that the partition table is missing. The disk was previously partitioned using GPT. Which area of the disk should be examined to recover the GPT partition table?

Accepted Answer

LBA 1 (sector 1). In GPT (GUID Partition Table) disks, the primary partition table is stored in LBA 1 (sector 1), immediately following the protective MBR at LBA 0. When the partition table is missing, examining LBA 1 allows recovery of the GPT header, which contains pointers to the partition entry array. This is the correct location because GPT uses LBA 1 for its header, not the last sector or the MBR.

Answer

Last sector of the disk

Answer

Volume boot record

Answer

Master Boot Record (LBA 0)

Question 9

An investigator is analyzing a FAT32 drive and notices that a deleted file's directory entry still exists, but the first byte of the filename is changed to 0xE5. What does this indicate about the file?

Accepted Answer

The file is marked as deleted but its data clusters may still be intact. In FAT32 file systems, a deleted file's directory entry is marked by replacing the first byte of the filename with 0xE5. This indicates the file is logically deleted, but the data clusters referenced in the directory entry remain intact until overwritten by new data. Option B is correct because the 0xE5 marker is the standard FAT deletion marker, and the clusters are not erased.

Answer

The file is fragmented

Answer

The file has been securely overwritten

Answer

The file is encrypted

Question 10

In an ext4 file system, after a file is deleted, the inode's di_mode field is set to 0 and the block pointers are cleared. However, the file content may still be recoverable until what happens?

Accepted Answer

The data blocks are overwritten by new files. When a file is deleted in ext4, the inode's di_mode is set to 0 and block pointers are cleared, but the actual data blocks on disk remain unchanged. The file content remains recoverable until those specific data blocks are overwritten by new file data, because only then is the original content physically destroyed. This is why data recovery tools can often restore deleted files if the blocks have not been reused.

Answer

The file system is unmounted

Answer

The superblock is updated

Answer

The journal is committed

Question 11

A forensic analyst is examining an SSD that may have had deleted files. The analyst is concerned about the TRIM command. What effect does TRIM have on forensic recovery of deleted files?

Accepted Answer

TRIM invalidates deleted data blocks, making them unreadable and unrecoverable. The TRIM command allows the operating system to inform the SSD which data blocks are no longer in use. The SSD then internally marks those blocks as invalid and may immediately erase them or add them to its free pool for garbage collection. This process physically removes the data, making it unreadable and unrecoverable through standard forensic tools, which is why option C is correct.

Answer

TRIM increases the chance of recovering deleted files

Answer

TRIM causes wear leveling that spreads data across blocks, aiding recovery

Answer

TRIM has no effect on forensic analysis

Question 12

During a forensic investigation, an analyst uses a tool to capture the contents of RAM from a live Linux system. Which tool is specifically designed for this purpose and can acquire memory over a network or via a local kernel module?

Accepted Answer

LiME. LiME (Linux Memory Extractor) is specifically designed to capture RAM from live Linux systems. It can acquire memory either by loading a kernel module locally or by transmitting the memory dump over a network, making it the correct choice for this scenario.

Answer

WinPmem

Answer

FTK Imager

Answer

Volatility

Question 13

A forensic examiner is analyzing a RAID 5 array consisting of three disks. One disk has failed and is not available. The remaining two disks contain data and parity. Which technique can be used to reconstruct the missing disk's data and recover the original data?

Accepted Answer

Use dd to image the two disks, then perform a XOR operation on the data stripes to reconstruct the third disk's data. In a RAID 5 array with three disks, data and parity are striped across all disks. When one disk fails, the missing data can be reconstructed by performing an XOR operation on the corresponding stripes from the remaining two disks. This is because RAID 5 uses distributed parity where the parity block is the XOR of the data blocks in the same stripe, so XORing the surviving data and parity stripes recovers the lost data.

Answer

Replace the failed disk and rebuild the array using the controller's rebuild function

Answer

Use FTK Imager to create a logical image of each disk and merge them

Answer

Simply image the two disks and use file carving tools to extract files

Question 14

An analyst discovers that a Windows system has hidden data in the Host Protected Area (HPA) of the hard drive. Which tool or method can be used to detect and access the HPA?

Accepted Answer

Using the hdparm command in Linux with the -N flag. The Host Protected Area (HPA) is a reserved region on ATA/ATAPI hard drives that is not visible to the operating system's standard disk utilities. The `hdparm` command in Linux with the `-N` flag is specifically designed to detect and modify the HPA by querying the drive's native max address, revealing hidden sectors. Windows Disk Management and other OS-level tools cannot access the HPA because it is hidden at the firmware level via the ATA SET MAX ADDRESS command.

Answer

Using the Windows Disk Management utility

Answer

Using the Volatility framework

Answer

Using the chkdsk command

Question 15

Which THREE of the following are characteristics of the Master File Table ($MFT) in NTFS? (Choose three.)

Accepted Answer

It contains a record for every file and directory on the volume. Option A is correct because the $MFT in NTFS maintains at least one file record for every file and directory stored on the volume, serving as the central index of all objects. Option B is correct because NTFS supports resident data, meaning small files (and small attributes) can be stored directly inside the $MFT file record rather than in separate clusters, which improves access efficiency. Option C is correct because each $MFT file record is normally 1024 bytes in size, a standard NTFS structure size that holds the record header and its attributes. Option D is incorrect because the $MFT is not guaranteed to sit at a fixed position at the start of the volume; its location is recorded in the boot sector, and it can be moved or fragmented. Option E is incorrect because the $MFT is not limited to directory metadata; it indexes all files and directories and stores their attributes and, when resident, their data.

Answer

It is located at a fixed position at the beginning of the volume

Answer

It is only used for directory metadata