CHFI Storage Forensics and File System Analysis Practice Test 7 — 15 Questions

Question 1

Which TWO of the following are challenges in SSD forensics compared to traditional HDD forensics? (Choose two.)

Accepted Answer

Wear leveling distributes data across blocks, making it harder to recover specific files. Option B is correct because wear leveling is an SSD controller function that deliberately writes data to different physical NAND blocks to spread erase cycles evenly, so logical addresses no longer map predictably to physical locations and file fragments become scattered, making recovery of specific files far harder than on an HDD where LBAs map directly to fixed platters/sectors. Option C is correct because the TRIM command, issued by the OS (e.g., via ATA DATA SET MANAGEMENT or SCSI UNMAP), tells the SSD controller that deleted blocks are no longer needed, allowing garbage collection to erase them almost immediately, which destroys residual data that would otherwise remain recoverable on an HDD until overwritten. Option A is wrong because SSDs are fully compatible with standard forensic imaging tools such as dd, FTK Imager, and EnCase; the challenge is write-blocking and controller behavior, not tool compatibility. Option D is wrong because capacity is not a forensic challenge unique to SSDs, and SSDs are not inherently larger than HDDs. Option E is wrong because physical damage resistance is not a recognized forensic challenge distinguishing SSDs from HDDs in this context.

Answer

SSDs are not compatible with forensic imaging tools

Answer

SSDs have larger storage capacity than HDDs

Answer

SSDs are more resistant to physical damage

Question 2

A forensic analyst is examining a Windows 10 system and needs to view the Master File Table ($MFT) to identify recently deleted files. Which tool is most appropriate for parsing the $MFT directly?

Accepted Answer

EnCase. EnCase is a forensic suite that includes a dedicated parser for the Master File Table ($MFT) on NTFS volumes. It can directly read the raw $MFT file to recover metadata of deleted files, including their names, timestamps, and data runs, even after the directory entry is removed. This makes it the correct choice for examining the $MFT to identify recently deleted files.

Answer

Wireshark

Answer

John the Ripper

Answer

Nmap

Question 3

During a forensic examination of a Linux ext4 file system, an investigator runs the `ls -i` command and sees inode numbers. They need to examine the inode structure. Which command should they use to display detailed inode information?

Accepted Answer

debugfs -R 'stat ' /dev/sda1. The `debugfs` command is a native ext2/ext3/ext4 file system debugger that allows direct inode inspection. The `-R 'stat '` flag runs the `stat` command in debugfs to display the full inode structure, including permissions, timestamps, block pointers, and extended attributes, which is exactly what the investigator needs after seeing inode numbers from `ls -i`.

Answer

dd if=/dev/sda1 of=output.img

Answer

mount -o loop image.img /mnt

Answer

fsck /dev/sda1

Question 4

An analyst discovers a hidden partition on a hard drive that does not appear in the standard MBR partition table. The drive uses GPT partitioning. Which area of the disk should be examined to find evidence of a hidden partition?

Accepted Answer

The GPT header and partition entry array located after the protective MBR. In GPT partitioning, the protective MBR in sector 0 only contains a single partition entry of type 0xEE to prevent legacy tools from misinterpreting the disk. The actual partition information, including any hidden partitions, is stored in the GPT header (typically in sector 1) and the partition entry array that follows. Therefore, examining the GPT header and partition entry array is necessary to detect partitions not visible in the MBR.

Answer

The Master Boot Record (MBR) in sector 0

Answer

The Volume Boot Record (VBR) of the C: drive

Answer

The Host Protected Area (HPA) at the end of the disk

Question 5

A forensic investigator is analyzing a USB drive formatted with FAT32 and finds that a deleted file's directory entry still exists but the first character of the filename is replaced with 0xE5. What does this indicate?

Accepted Answer

The file has been deleted. In FAT32 file systems, when a file is deleted, the first byte of its directory entry's filename is replaced with the hexadecimal value 0xE5 (which displays as a lowercase sigma 'σ' in some viewers). This is the standard deletion marker for FAT file systems, indicating that the file's directory entry is available for reuse. The presence of 0xE5 in the first character position specifically signifies deletion, not any other attribute or state.

Answer

The file is marked as hidden

Answer

The file is encrypted

Answer

The file is fragmented

Question 6

During a forensic investigation of a Windows 10 system, you find that a suspect used the 'cipher /w:C:' command. What is the primary forensic implication of this action?

Accepted Answer

It wipes free space, hindering recovery of deleted files. The 'cipher /w:C:' command overwrites all free space on the C: drive with three passes of random data (0x00, 0xFF, and a random byte). This action permanently destroys the remnants of previously deleted files, making them unrecoverable by forensic tools. The primary forensic implication is that it severely hinders the recovery of deleted files, which is a common anti-forensic technique.

Answer

It encrypts all files on the C: drive

Answer

It enables file system journaling

Answer

It removes alternate data streams from files

Question 7

A forensic analyst needs to acquire RAM from a live Linux system for memory analysis. Which tool is specifically designed for this purpose and can capture memory without rebooting?

Accepted Answer

LiME. LiME (Linux Memory Extractor) is specifically designed to capture volatile memory from live Linux systems without requiring a reboot. It loads a kernel module that safely dumps RAM contents to a file, preserving the memory image for forensic analysis. Unlike dd, LiME handles memory-mapped I/O and avoids corrupting the system state during acquisition.

Answer

FTK Imager

Answer

Volatility

Answer

dd

Question 8

An investigator finds evidence of data hidden using Alternate Data Streams (ADS) on an NTFS volume. Which command would display all ADS associated with files in a directory?

Accepted Answer

dir /r. The `dir /r` command in Windows displays alternate data streams (ADS) associated with files on an NTFS volume. ADS are a feature of NTFS that allow additional data to be stored with a file, hidden from standard directory listings. The `/r` switch specifically lists all streams, including the main stream and any alternate streams, making it the correct choice for forensic identification of hidden data.

Answer

dir /s

Answer

dir /x

Answer

dir /a

Question 9

During a forensic examination of a solid-state drive (SSD), the analyst notices that the TRIM command was enabled. What challenge does this pose for data recovery?

Accepted Answer

It erases data blocks immediately after deletion, preventing recovery. The TRIM command (ATA Data Set Management command) instructs the SSD controller to immediately erase the physical NAND blocks corresponding to deleted logical block addresses (LBAs). This proactive garbage collection operation resets the cells to an erased state, making it impossible for forensic tools to recover the original data from those blocks, as the data is physically overwritten with null values or marked as invalid.

Answer

It causes fragmentation, making file recovery more complex

Answer

It causes the drive to encrypt data automatically

Answer

It physically destroys the NAND cells, making the drive unusable

Question 10

Which file system journal is commonly used in Linux ext3/ext4 to record metadata changes before they are committed to the main file system?

Accepted Answer

Journal (JBD/JBD2). The ext3 and ext4 file systems in Linux use the Journal (JBD/JBD2) layer to record metadata changes in a circular log before they are committed to the main file system. This journaling mechanism ensures file system consistency after a crash by allowing replay of committed transactions, with JBD2 specifically supporting ext4's 64-bit features and checksums.

Answer

$LogFile

Answer

Recycle Bin

Answer

USN Journal

Question 11

A security analyst examines a compromised Windows server and finds a file named 'readme.txt' that appears legitimate. However, using `dir /r`, they discover an alternate data stream named 'readme.txt:hidden.exe'. What is the most likely purpose of this alternate data stream?

Accepted Answer

It is a malicious executable hidden in the file. Alternate data streams (ADS) in NTFS allow a malicious executable to be hidden within a legitimate file without affecting its visible size or content. The `dir /r` command reveals the ADS 'readme.txt:hidden.exe', indicating that an executable is attached to the file, which is a common technique to evade detection and execute malware.

Answer

It is a backup copy of the file

Answer

It is a symbolic link to another file

Answer

It is a log file generated by the operating system

Question 12

An investigator uses the `volatility -f mem.dump netscan` command on a memory dump from a Windows 10 system. What information is this command primarily intended to reveal?

Accepted Answer

Network connections and listening ports. The `volatility -f mem.dump netscan` command is specifically designed to extract network connection artifacts from a memory dump, including active TCP/UDP connections, listening ports, and associated process identifiers (PIDs). It parses Windows network data structures such as `_TCPT_OBJECT` and `_UDP_HEADER` to reconstruct the network state at the time of acquisition, making it the correct tool for revealing network connections and listening ports.

Answer

List of running processes

Answer

File handles opened by each process

Answer

Registry hives loaded in memory

Question 13

Which THREE of the following present unique challenges for forensic analysis of solid-state drives (SSDs) compared to traditional hard disk drives (HDDs)? (Select THREE.)

Accepted Answer

Wear leveling that moves data around the NAND chips. Option B is correct because SSD controllers implement wear leveling, which continuously relocates logical blocks across physical NAND pages to spread erase cycles, so a logical address no longer maps predictably to a fixed physical location and traditional imaging/address-based recovery assumptions break down. Option D is correct because garbage collection runs in the background, copying valid pages into new blocks and erasing blocks containing stale data, which can destroy deleted-file remnants before an examiner images the drive and can alter the drive contents after acquisition. Option E is correct because the TRIM command (ATA DATA SET MANAGEMENT / SCSI UNMAP) notifies the SSD that deleted LBAs are no longer needed, prompting the controller to erase those NAND blocks and making deleted data unrecoverable, unlike HDDs where deleted clusters typically persist until overwritten. Option A is not a unique SSD challenge, since 512-byte sector emulation (512e/4Kn) and slack space issues also arise on modern HDDs and are not specific to flash media. Option C is not unique either, as fragmentation from file system aging occurs on HDDs as well and is actually mitigated on SSDs by the flash translation layer.

Answer

Slack space analysis due to 512-byte sector emulation

Answer

Fragmentation due to file system aging

Question 14

Which TWO of the following are commonly used tools for file carving (recovering files based on file signatures)? (Select TWO.)

Accepted Answer

Foremost. Foremost (B) is a classic file-carving tool originally developed for the U.S. Air Force OSI that scans raw disk images or unallocated space and reconstructs files by matching known file headers, footers, and internal structures defined in its configuration file (foremost.conf). Scalpel (E) is a high-performance carving tool derived from Foremost that uses a configurable header/footer signature database (scalpel.conf) to extract files from disk images, making it a standard choice for signature-based recovery. Nmap (A) is a network port scanner and host-discovery tool, not a file-carving utility. Wireshark (C) is a network protocol analyzer that captures and inspects packet data, not files on storage media. John the Ripper (D) is a password-cracking tool that tests hashes against wordlists and rules, which is unrelated to recovering files by their signatures.

Answer

Nmap

Answer

Wireshark

Answer

John the Ripper

Question 15

During a forensic investigation, an analyst needs to recover recently deleted files from a FAT32 partition. Which of the following techniques is MOST effective for recovering files whose directory entries have been marked as deleted but the clusters have not yet been overwritten?

Accepted Answer

Using 'dd' to create a raw image and then 'photorec' to recover based on file signatures. In FAT32, deleting a file normally marks the directory entry's first byte as 0xE5 while the data clusters may remain intact. The preferred recovery approach is to use forensic tools that parse the file system metadata (directory entries and FAT), such as Autopsy, FTK, EnCase, or a specialized FAT recovery utility. Manual editing of the directory entry and recalculation of the FAT chain is not a standard CHFI technique and can damage evidence. Among the listed options, creating a raw image with dd and using Photorec is the most forensically sound workflow; Photorec recovers file content by file signatures. It is not as ideal as metadata-based tools when directory entries are available, but it is better than manually modifying the file system structures.

Answer

Running 'scalpel' to extract fragments and reassemble based on metadata

Answer

Using the 'foremost' tool to perform file carving based on file headers and footers

Answer

Editing the directory entry's first byte from 0xE5 to the original character and recalculating the FAT chain