CHFI Storage Forensics and File System Analysis Practice Test 7 — 15 Questions

Question 1

During a forensic investigation, an analyst needs to recover recently deleted files from a FAT32 partition. Which of the following techniques is MOST effective for recovering files whose directory entries have been marked as deleted but the clusters have not yet been overwritten?

Accepted Answer

Editing the directory entry's first byte from 0xE5 to the original character and recalculating the FAT chain. FAT32 marks deleted files by setting the first byte of the directory entry to 0xE5. If the clusters are not overwritten, the file can be recovered by restoring the original first byte and using the FAT chain. File carving is used when directory entries are gone or clusters are fragmented.

Answer

Running 'scalpel' to extract fragments and reassemble based on metadata

Answer

Using the 'foremost' tool to perform file carving based on file headers and footers

Answer

Using 'dd' to create a raw image and then 'photorec' to recover based on file signatures

Question 2

An examiner is analyzing an NTFS volume and suspects that a suspect hid data using Alternate Data Streams (ADS). Which tool or method is MOST appropriate to list all ADS on the volume?

Accepted Answer

Execute 'dir /r' in a Windows command prompt on the mounted image. Native Windows commands can list ADS: 'dir /r' shows alternate streams. Streams.exe from Sysinternals also lists streams. FTK and EnCase have built-in ADS detection.

Answer

Run 'ls -la' from a Linux forensic environment

Answer

Use 'icacls' to view security descriptors and detect ADS

Answer

Mount the image in Autopsy and run the 'Find File' module

Question 3

During a memory forensics analysis using Volatility, an examiner runs 'python vol.py -f memory.dmp pslist' and sees a suspicious process named 'expl0rer.exe' with a PPID of 4. What does a PPID of 4 indicate, and what should the examiner do next?

Accepted Answer

The process is probably a hidden or injected process; run 'psxview' and 'malfind' to detect anomalies. PPID 4 is the System process (PID 4) in Windows. Legitimate processes should not have System as parent; this suggests process hollowing or injection. The examiner should investigate the process further with process dump and memory analysis.

Answer

The process is a child of the System process, indicating it is a legitimate system process; no further action needed

Answer

The process is a child of the System Idle Process, which is normal; ignore it

Answer

The process has been injected into the System process and is likely a rootkit; run 'psscan' to verify

Question 4

An analyst is investigating a Linux server running ext4 and needs to recover deleted files that may have been overwritten partially. Which technique is BEST suited for recovering fragments of known file types when the inode metadata is lost?

Accepted Answer

Perform file carving using 'foremost' with custom signatures. File carving recovers files based on headers and footers without relying on file system metadata. Foremost and PhotoRec are common carving tools. Inode recovery fails if metadata is overwritten.

Answer

Use 'dd' to extract the partition and then 'grep' for strings

Answer

Manually reconstruct the inode table using 'debugfs'

Answer

Use 'extundelete' to recover files from the journal

Question 5

A forensic examiner needs to acquire the RAM from a Windows 10 system without altering the contents. Which tool is MOST appropriate for this task?

Accepted Answer

WinPmem. WinPmem is a memory acquisition tool for Windows that supports capturing RAM. It is widely used in forensics. LiME is for Linux, FTK Imager can acquire disk images but not RAM.

Answer

FTK Imager

Answer

LiME

Answer

dd

Question 6

During an investigation of a compromised system, the analyst discovers that the suspect used steganography to hide data within image files. Which forensic tool is BEST suited for detecting hidden data in images through statistical analysis?

Accepted Answer

Stegdetect. Stegdetect is a tool that uses statistical analysis to detect steganography in JPEG images. Autopsy has steganography detection modules but Stegdetect is specialized.

Answer

Binwalk

Answer

Wireshark

Answer

Foremost

Question 7

A forensic analyst is examining a RAID 5 array consisting of three disks. One disk has failed and has been replaced. The array is rebuilt automatically. However, the analyst needs to recover deleted files that existed before the rebuild. What is the MOST significant challenge in this scenario?

Accepted Answer

The rebuild process may overwrite data in slack space and previously unallocated clusters. RAID rebuild writes parity and data across disks, potentially overwriting slack space and previously deleted file data. The rebuilt array may have altered the original data layout, complicating recovery.

Answer

File carving techniques do not work on RAID volumes

Answer

The file system becomes corrupted after rebuild

Answer

The RAID controller encrypts data, preventing direct disk access

Question 8

An examiner is analyzing an SSD and notices that TRIM is enabled. Why does TRIM pose a challenge for digital forensics?

Accepted Answer

TRIM causes the SSD to physically overwrite deleted data with zeros, preventing recovery. TRIM allows the SSD to erase data blocks that are no longer in use, making it difficult to recover deleted files because the data is physically erased by the SSD's garbage collection.

Answer

TRIM increases the wear leveling, which reduces the lifespan of the SSD

Answer

TRIM encrypts the deleted data, making it inaccessible without the key

Answer

TRIM compresses data, altering the original content

Question 9

Which of the following partition table types uses a protective MBR and a GPT header, and is recommended for disks larger than 2 TB?

Accepted Answer

GPT. GPT (GUID Partition Table) uses a protective MBR for compatibility and supports disks larger than 2 TB. MBR is limited to 2 TB.

Answer

MBR

Answer

Dynamic disk

Answer

APM (Apple Partition Map)

Question 10

During a forensic examination of an NTFS drive, an analyst runs 'fsutil usn readjournal C:' and observes a large number of USN journal entries for a specific file after a certain date. The file's $MFT record shows a last modified timestamp far earlier than the journal entries. What does this discrepancy suggest?

Accepted Answer

The file's metadata was modified without changing its content, possibly using timestomping or ADS manipulation. The USN journal records changes to files. If the journal shows many entries after the last modified timestamp, it indicates that the file was accessed or modified in ways that did not update the $MFT timestamps (e.g., via alternate data streams, timestomping, or changes to metadata). This could be evidence of anti-forensics.

Answer

The file is a system file that is excluded from USN journaling

Answer

The file system is corrupted and the MFT is not updating correctly

Answer

The file was accessed via a mounted volume shadow copy, which does not update MFT

Question 11

An analyst is examining a hard drive that was seized from a suspect. The drive is detected as a smaller capacity than listed on the label. Which of the following is the MOST likely explanation?

Accepted Answer

The drive has a Host Protected Area (HPA) that hides sectors from the OS. The Host Protected Area (HPA) or Device Configuration Overlay (DCO) can hide portions of the drive. HPA is set by the manufacturer or user, DCO can be set by the manufacturer. Both reduce the visible capacity. This is a common data hiding technique.

Answer

The drive has been partitioned with a GPT table, which does not use the full capacity

Answer

The file system is FAT32, which has a 2 TB limit

Answer

The drive controller has a firmware bug reporting incorrect size

Question 12

An investigator needs to analyze the contents of the Windows Recycle Bin on a system running Windows 10. Which artifact(s) should the investigator examine to determine the original location and deletion time of a file in the Recycle Bin?

Accepted Answer

The '$I' and '$R' files in the $Recycle.Bin\ folder. In Windows Vista and later, the Recycle Bin uses $Recycle.Bin folder with each user having a subfolder named by SID. The file 'Info2' or '$I' files contain metadata such as original path and deletion time.

Answer

The 'System Volume Information' folder

Answer

The 'INFO2' file in the Recycled folder

Answer

The 'desktop.ini' file in the Recycle Bin

Question 13

Which TWO of the following are valid methods to hide data on an NTFS file system without using external tools?

Accepted Answer

Embedding data in file slack space. Alternate Data Streams (ADS) allow hiding data within a file's stream. Slack space (file slack) can hide data in unused bytes between the end of file and end of cluster. Both are native NTFS features.

Answer

Storing data in the NTFS file system journal ($LogFile)

Answer

Using the $Volume attribute in the MFT

Answer

Encrypting data with EFS

Question 14

Which THREE of the following are challenges specific to SSD forensics compared to HDD forensics?

Accepted Answer

Garbage collection that automatically erases stale blocks. SSDs have unique features: TRIM command erases data blocks, wear leveling moves data around complicating recovery, and garbage collection can erase deleted data without OS intervention. Platter rotation is HDD-specific.

Answer

Platter rotation causing magnetic remanence

Answer

Controller-based compression reducing data size

Question 15

Which TWO of the following tools are commonly used for file carving in forensic investigations?

Accepted Answer

PhotoRec. Foremost and PhotoRec are popular file carving tools. EnCase and FTK are suites that include carving but are not exclusively carving tools; the question asks for tools commonly used for carving.

Answer

Autopsy

Answer

EnCase

Answer

Wireshark