CHFI Storage Forensics and File System Analysis Practice Test 6 — 15 Questions

Question 1

During an investigation of a compromised system, the analyst discovers that the suspect used steganography to hide data within image files. Which forensic tool is BEST suited for detecting hidden data in images through statistical analysis?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Stegdetect [CORRECT]. Stegdetect is specifically designed to detect hidden data in images by applying statistical analysis to identify anomalies in pixel distributions that indicate steganographic embedding. It uses techniques like chi-square analysis and RS analysis to detect LSB (Least Significant Bit) steganography, making it the best choice for this task.

Answer

Binwalk [wrong]

Answer

Wireshark [wrong]

Answer

Foremost [wrong]

Question 2

An examiner is analyzing an SSD and notices that TRIM is enabled. Why does TRIM pose a challenge for digital forensics?

Accepted Answer

TRIM causes the SSD to physically overwrite deleted data with zeros, preventing recovery. When TRIM is enabled on an SSD, the operating system sends a TRIM command to the SSD controller for deleted data blocks. The controller then immediately physically zeroes or erases those blocks at the flash memory level, making it impossible to recover the deleted data using forensic tools. This is fundamentally different from traditional HDDs, where deleted data remains on the platters until overwritten.

Answer

TRIM increases the wear leveling, which reduces the lifespan of the SSD

Answer

TRIM encrypts the deleted data, making it inaccessible without the key

Answer

TRIM compresses data, altering the original content

Question 3

Which of the following partition table types uses a protective MBR and a GPT header, and is recommended for disks larger than 2 TB?

Accepted Answer

GPT. GPT (GUID Partition Table) is the correct answer because it uses a protective MBR at the first sector (LBA 0) to prevent legacy tools from misidentifying the disk as unformatted, followed by the GPT header at LBA 1. This structure is specifically designed to support disks larger than 2 TB by using 64-bit logical block addresses, overcoming the 2 TB limit of MBR’s 32-bit addressing.

Answer

MBR

Answer

Dynamic disk

Answer

APM (Apple Partition Map)

Question 4

An analyst is examining a hard drive that was seized from a suspect. The drive is detected as a smaller capacity than listed on the label. Which of the following is the MOST likely explanation?

Accepted Answer

The drive has a Host Protected Area (HPA) that hides sectors from the OS. A Host Protected Area (HPA) is a reserved region on an ATA/ATAPI hard drive that can hide sectors from the operating system, making the drive appear smaller than its physical capacity. This is a common anti-forensics technique used to conceal data, and it can be detected and removed using tools like hdparm or ATA Security commands.

Answer

The drive has been partitioned with a GPT table, which does not use the full capacity

Answer

The file system is FAT32, which has a 2 TB limit

Answer

The drive controller has a firmware bug reporting incorrect size

Question 5

An investigator needs to analyze the contents of the Windows Recycle Bin on a system running Windows 10. Which artifact(s) should the investigator examine to determine the original location and deletion time of a file in the Recycle Bin?

Accepted Answer

The '$I' and '$R' files in the $Recycle.Bin\<SID> folder. In Windows 10, the Recycle Bin is implemented as the `$Recycle.Bin` folder, with each user having a subfolder identified by their Security Identifier (SID). When a file is deleted, it is renamed to an `$R` file (the actual data) and an `$I` file (metadata including original path and deletion timestamp) is created. Examining these `$I` and `$R` files allows the investigator to determine the original location and deletion time of the file.

Answer

The 'System Volume Information' folder

Answer

The 'INFO2' file in the Recycled folder

Answer

The 'desktop.ini' file in the Recycle Bin

Question 6

Which THREE of the following are challenges specific to SSD forensics compared to HDD forensics?

Accepted Answer

Garbage collection that automatically erases stale blocks. SSD garbage collection automatically identifies and erases stale data blocks in the background to maintain write performance. This process can permanently destroy potential evidence without user intervention, unlike HDDs where data remains until explicitly overwritten. Forensic acquisition tools must account for this by issuing a freeze command or using hardware write-blockers that prevent the SSD controller from initiating garbage collection during imaging.

Answer

Platter rotation causing magnetic remanence

Answer

Controller-based compression reducing data size

Question 7

Which TWO of the following tools are commonly used for file carving in forensic investigations?

Accepted Answer

PhotoRec. PhotoRec is a specialized file carving tool that recovers lost files by scanning raw disk data for file signatures (magic bytes) and reconstructing files without relying on filesystem metadata. It supports hundreds of file formats and works on damaged or formatted drives, making it a standard choice for forensic file carving.

Answer

Autopsy

Answer

EnCase

Answer

Wireshark

Question 8

During a forensic analysis of a Windows 10 system, an investigator needs to locate the Master File Table ($MFT) to analyze file metadata. Which file system structure contains the $MFT?

Accepted Answer

NTFS volume's Master File Table. The $MFT is a core component of the NTFS file system, storing metadata for every file and directory on the volume. It is located in the NTFS volume's designated Master File Table area, not in any other file system structure. Option D correctly identifies this NTFS-specific structure.

Answer

ext4 superblock

Answer

FAT32's File Allocation Table

Answer

HFS+ catalog file

Question 9

An analyst suspects that sensitive data was hidden in the NTFS Alternate Data Streams (ADS) of a file on a suspect's drive. Which tool is specifically designed to enumerate and extract data from ADS on a live Windows system?

Accepted Answer

Streams.exe (Sysinternals). Streams.exe from Sysinternals is specifically designed to enumerate and extract data from NTFS Alternate Data Streams (ADS) on a live Windows system. It scans files and directories for hidden streams, displaying their names and sizes, and can optionally delete or extract them. This makes it the correct tool for the analyst's task.

Answer

Foremost

Answer

PhotoRec

Answer

dd

Question 10

During a forensic examination of a Linux system, the investigator runs the command 'ls -i /home/user/file.txt' and sees inode number 12345. The file was recently deleted. Which of the following is the most effective method to recover the file, assuming the inode is still accessible?

Accepted Answer

Use 'debugfs' to attempt to recover the inode and its data blocks. 'debugfs' can directly access the ext2/ext3/ext4 filesystem's inode table. Since the investigator knows the inode number (12345) and the inode is still accessible (not yet overwritten), 'debugfs' can use the 'lsdel' or 'logdump' commands to recover the inode's data block pointers and restore the file without relying on file carving heuristics.

Answer

Run 'scalpel' with a custom configuration for the file type

Answer

Use 'foremost' to scan the disk for the file header/footer

Answer

Run 'photorec' on the disk to carve the file from unallocated space

Question 11

An analyst is examining a RAID 5 array of three disks. One disk has failed and been replaced; the array is rebuilding. Which of the following is the most significant forensic challenge regarding data acquisition from this array?

Accepted Answer

The rebuild process may overwrite unallocated space or remnants of deleted files. During a RAID 5 rebuild, the array controller reads parity and data from the remaining healthy disks to reconstruct the missing data onto the replacement disk. This process writes to the entire replacement disk, including areas that previously held unallocated space or remnants of deleted files, potentially overwriting critical forensic evidence. The rebuild is a low-level write operation that does not respect file system boundaries, making it a significant challenge for data acquisition.

Answer

The failed disk cannot be imaged because it is physically damaged

Answer

RAID 5 arrays cannot be imaged using traditional tools like dd

Answer

The array must be imaged while degraded to preserve evidence

Question 12

In an investigation of a Windows system, the analyst uses Volatility's 'netscan' plugin and identifies a suspicious outbound connection to an IP address on port 4444. Which of the following is the most likely associated malicious activity?

Accepted Answer

Reverse shell connection from a backdoor. Port 4444 is the default port for the Metasploit Meterpreter reverse TCP payload. A Volatility netscan result showing an outbound connection to this port strongly indicates a reverse shell, where the compromised system initiates a connection back to an attacker's listener to bypass firewalls. This is a classic backdoor behavior, not a standard service.

Answer

DNS tunneling exfiltration

Answer

HTTP data exfiltration

Answer

Remote desktop session

Question 13

During a forensic acquisition of a suspect's SSD, the analyst notices that the drive supports TRIM. Which of the following is the most important consideration when acquiring the drive to preserve deleted data?

Accepted Answer

Use a hardware write-blocker and acquire the drive immediately to minimize TRIM interference. SSDs with TRIM support automatically issue commands to erase deallocated blocks, making deleted data unrecoverable. Using a hardware write-blocker and acquiring the drive immediately minimizes the time the drive is powered on, reducing the chance that the operating system or the SSD's garbage collection will issue TRIM commands that permanently wipe deleted data.

Answer

Perform a full format of the SSD before acquisition to clear any TRIM-related issues

Answer

Enable TRIM in the forensic tool to ensure the drive is optimized before imaging

Answer

The SSD should be powered on for several hours to allow TRIM to complete before imaging

Question 14

An investigator is analyzing a memory dump from a compromised server using Volatility. The 'pslist' plugin shows a process with no parent PID (PPID). Which of the following is the most likely explanation?

Accepted Answer

The process is a system idle process. Volatility's pslist plugin enumerates processes via EPROCESS structures; every process has a PPID. The system idle process (PID 0) is the first process and has no parent, so its PPID is 0 (or absent in some outputs). Kernel threads are not separate processes and are not listed by pslist. Therefore, the correct answer is A.

Answer

The process is a kernel thread and has no parent

Answer

The process list is incomplete due to memory corruption

Answer

The process is a rootkit that has unlinked itself from the process list

Question 15

Which of the following best describes the purpose of the Host Protected Area (HPA) on a hard disk drive?

Accepted Answer

To provide a hidden storage area that is inaccessible through standard OS commands. The Host Protected Area (HPA) is a reserved region on a hard disk drive defined by the ATA/ATAPI standards. It is hidden from the operating system and standard disk utilities, making it inaccessible through normal OS commands, which is why it is used for forensic purposes or vendor-specific recovery tools.

Answer

To accelerate read/write operations using flash cache

Answer

To store the file system journal

Answer

To store the Master Boot Record