CHFI Storage Forensics and File System Analysis Practice Test 7 — 15 Questions

Question 1

An analyst is examining an Apple Mac system and needs to recover deleted files from an APFS volume. Which tool is most appropriate for this task?

Accepted Answer

FTK Imager. FTK Imager is the most appropriate tool because it supports APFS (Apple File System) volume parsing and can recover deleted files by reading the volume's raw data and file system metadata, including the APFS container's object map and snapshots. Unlike tools designed for other file systems or memory analysis, FTK Imager provides a GUI and command-line interface for forensic imaging and file recovery from APFS volumes.

Answer

Foremost

Answer

LiME

Answer

Volatility

Question 2

Which two of the following are characteristics of the ext4 file system? (Choose TWO.)

Accepted Answer

Uses a journal to maintain file system consistency. Ext4 uses a journaling mechanism to maintain file system consistency. The journal records pending metadata and data changes before they are committed to the main file system, allowing recovery after an unclean shutdown or crash. This prevents corruption by replaying or discarding incomplete transactions.

Answer

Uses a Master File Table ($MFT) to store file metadata

Answer

Uses a file allocation table (FAT) to track clusters

Answer

Stores directory entries in a B-tree structure

Question 3

Which three of the following are common techniques used to hide data on a storage device? (Choose THREE.)

Accepted Answer

Host Protected Area (HPA). The Host Protected Area (HPA) is a region on a hard disk drive that is hidden from the operating system by using the ATA SET MAX ADDRESS command. This area can store data that is not visible to standard disk utilities, making it a common technique for data hiding.

Answer

File system journaling

Answer

TRIM command

Question 4

Which two of the following are tools used for memory forensics acquisition? (Choose TWO.)

Accepted Answer

WinPmem. WinPmem (option C) is a memory acquisition tool that captures the contents of physical RAM on Windows systems. It is part of the Rekall memory forensic framework and is specifically designed for acquiring memory images for later analysis. LiME (option E) is a Linux Memory Extractor that acquires volatile memory from Linux devices, often used in forensic acquisitions of RAM.

Answer

Autopsy

Answer

FTK Imager

Answer

Volatility

Question 5

During a forensic investigation, an analyst examines a hard disk and notices that the partition table uses a 64-bit scheme with a maximum of 128 partitions. Which partition table type is in use?

Accepted Answer

GPT. GPT (GUID Partition Table) uses a 64-bit scheme for logical block addressing and supports up to 128 partitions by default in its standard header layout. This matches the description of a 64-bit partition table with a maximum of 128 partitions, making D the correct answer.

Answer

MBR

Answer

LDM

Answer

APM

Question 6

A forensic analyst is examining a FAT32 file system and finds that the file allocation table indicates a cluster chain ending with 0x0FFFFFFF. What does this value signify?

Accepted Answer

End-of-file marker. In FAT32 file systems, the File Allocation Table (FAT) uses 32-bit entries to track cluster allocation. The value 0x0FFFFFFF is the defined end-of-file (EOF) marker, indicating that the current cluster is the last in a file's cluster chain. This is a standard FAT32 convention, distinct from other special values like free or bad clusters.

Answer

Free cluster

Answer

Reserved cluster

Answer

Bad cluster

Question 7

When analyzing an NTFS volume, an investigator wants to identify files that were recently accessed or modified. Which NTFS artifact stores metadata about file system changes and can be parsed using tools like MFTEcmd or NTFSLogTracker?

Accepted Answer

$USN_Jrnl. The $USN_Jrnl (Update Sequence Number Journal) is the correct artifact because it records every change made to files and directories on an NTFS volume, including timestamps for when files were accessed or modified. Tools like MFTEcmd and NTFSLogTracker are specifically designed to parse this journal to extract metadata about file system changes, making it ideal for identifying recent activity.

Answer

$LogFile

Answer

$Recycle.Bin

Answer

$MFT

Question 8

A security analyst detects suspicious activity on a Windows workstation. They acquire RAM using WinPmem and analyze it with Volatility. Which Volatility command would list all active processes along with their parent process IDs?

Accepted Answer

volatility -f mem.dmp pstree. The `pstree` plugin in Volatility displays a tree of processes showing parent-child relationships, including parent process IDs (PPIDs). This is the standard command for visualizing process hierarchy and identifying suspicious parent-child associations, such as a child process spawned by an unexpected parent.

Answer

volatility -f mem.dmp pslist

Answer

volatility -f mem.dmp connscan

Answer

volatility -f mem.dmp netscan

Question 9

During an investigation of a Linux system, an analyst runs `ls -li` and sees that a file's inode number is 0. What does this indicate about the file?

Accepted Answer

The file has been deleted but is still open. In Linux, an inode number of 0 indicates that the file's directory entry has been removed (unlinked), but the file is still held open by a process. The inode remains allocated until the last file descriptor referencing it is closed. This is a common scenario in forensic analysis where deleted files can be recovered from /proc/<pid>/fd/.

Answer

The file is a symbolic link

Answer

The file is a device file

Answer

The file is a hard link

Question 10

An investigator recovers a file from unallocated space on an NTFS drive using file carving. The file appears to contain alternate data streams (ADS). Which tool can be used to list all ADS associated with a file on a live Windows system?

Accepted Answer

dir /r. The `dir /r` command is the correct tool because it is a native Windows command that lists all alternate data streams (ADS) associated with files on an NTFS volume. When used with the `/r` switch, `dir` displays the main file stream along with any named ADS, such as `:Zone.Identifier:$DATA`, which are hidden from standard directory listings. This makes it the most direct and built-in method for an investigator to enumerate ADS on a live Windows system.

Answer

ls -la

Answer

attrib

Answer

fsutil

Question 11

A forensic examiner wants to recover deleted files from a USB drive formatted with FAT32. Which file carving tool is specifically designed to recover files based on file headers and footers?

Accepted Answer

Foremost. Foremost is a file carving tool that recovers deleted files by scanning raw data for known file headers and footers, making it ideal for FAT32 USB drives where file system metadata may be lost. It operates independently of the file system structure, which is crucial when the MFT or directory entries are damaged or overwritten.

Answer

Nmap

Answer

Wireshark

Answer

Sleuth Kit

Question 12

During a forensic examination of an SSD, the analyst notes that TRIM is enabled. What challenge does TRIM pose for data recovery?

Accepted Answer

TRIM permanently erases deleted data at the block level, hindering recovery. TRIM is an ATA command that allows the operating system to inform the SSD which data blocks are no longer in use. When TRIM is enabled, the SSD's garbage collection process immediately erases these blocks at the physical level, making the data permanently unrecoverable through conventional forensic tools. This directly hinders data recovery because the deleted data is physically zeroed or marked as invalid before any forensic acquisition can occur.

Answer

TRIM reduces the lifespan of the SSD by excessive writes

Answer

TRIM compresses data, altering forensic signatures

Answer

TRIM encrypts data, preventing forensic access

Question 13

In an ext4 file system, a forensic analyst needs to examine the journal to recover recently deleted files. Where is the journal typically stored?

Accepted Answer

In a special inode (inode 8). In ext4, the journal is stored as a regular file associated with a special inode, typically inode 8. This design allows the journal to be managed by the file system's standard inode and block allocation mechanisms, rather than being placed in a fixed reserved area. When a file is deleted, its data blocks may still be referenced in the journal until they are overwritten, enabling recovery by replaying or analyzing journal entries.

Answer

In a reserved area after the superblock

Answer

In the superblock

Answer

In the group descriptor table

Question 14

Which of the following is a Windows-based forensic suite that provides timeline analysis, keyword search, and file system browsing for forensic investigations?

Accepted Answer

Autopsy. Autopsy is a Windows-based forensic suite (also available on Linux/macOS) that provides timeline analysis, keyword search, and file system browsing. It is the graphical front-end to The Sleuth Kit (TSK), allowing investigators to parse file system metadata, recover deleted files, and generate timelines of file activity. These features directly match the question's description of a forensic suite with timeline analysis, keyword search, and file system browsing capabilities.

Answer

Wireshark

Answer

FTK

Answer

EnCase

Question 15

A forensic investigator analyzing a RAID 5 array of three disks notices that one disk has failed. Can the investigator still reconstruct the data?

Accepted Answer

Yes, using the parity information from the remaining disks. RAID 5 uses distributed parity across all disks in the array. When one disk fails, the data can be reconstructed by XORing the data and parity from the remaining disks. Since the parity is spread across all disks (not a dedicated parity disk), the investigator can rebuild the missing data as long as the remaining disks are functional.

Answer

No, RAID 5 requires all disks to be present

Answer

Yes, but only if the failed disk is the parity disk

Answer

No, because RAID 5 does not support hot swapping