CHFI Storage Forensics and File System Analysis Practice Test 8 — 15 Questions

Question 1

An analyst is examining a memory dump using Volatility and wants to identify network connections. Which TWO Volatility plugins can be used to list network connections?

Accepted Answer

netscan. (netscan) is correct because it is a Volatility plugin specifically designed to enumerate TCP and UDP endpoints from a memory dump, including both listening and established connections, and works on Windows 8 and later by parsing kernel network structures. (connscan) is also correct because it scans physical memory for TCP connection objects, which is a valid method for listing network connections, particularly on older Windows versions like XP/2003. Both are legitimate Volatility plugins for enumerating network connections, with connscan suited to legacy systems and netscan to modern ones.

Answer

dlllist

Answer

pstree

Answer

pslist

Question 2

A forensic analyst is recovering deleted files from an ext3 file system. Which TWO methods can be used to recover deleted inodes?

Accepted Answer

Analyzing the ext3 journal for deleted inode entries. The ext3 journal (stored in the .journal file or the journal inode) logs metadata changes before they are committed to the filesystem. When a file is deleted, the journal may contain the inode entry before it was freed, allowing the analyst to reconstruct the deleted inode by replaying or parsing the journal entries. This method is specific to ext3's journaling feature and is not available in non-journaled filesystems like ext2.

Answer

Using file carving tools like Foremost

Answer

Using dd to create a raw image

Answer

Using debugfs to display the superblock

Question 3

During a forensic investigation, you encounter a Windows system with an NTFS volume. The suspect claims they never used the recycle bin, but you find files in the $Recycle.bin folder. Which artifact can help you determine the original file path and deletion time?

Accepted Answer

The $I file in the $Recycle.bin folder. The $I file in the $Recycle.bin folder stores metadata about the deleted file, including its original file path and the deletion timestamp. When a file is moved to the Recycle Bin, Windows creates an $I file (e.g., $I<random>.dat) containing this information, which can be parsed to recover the original location and deletion time. This makes it the direct artifact for the investigator's needs.

Answer

The USN journal

Answer

The file slack space

Answer

The $MFT entry for the deleted file

Question 4

An analyst is investigating a Linux server that suffered a data breach. The attacker deleted several log files. The analyst runs `debugfs /dev/sda1` and issues the command `lsdel`. What is the purpose of this command in the context of file recovery?

Accepted Answer

List inodes of deleted files that still have allocated blocks. The `lsdel` command in `debugfs` lists inodes of deleted files that still have allocated data blocks. This is critical in forensic analysis because even after a file is deleted, its inode and data blocks may remain intact until overwritten, allowing recovery of the file's contents.

Answer

Recover deleted files from the journal

Answer

List all deleted directory entries in the journal

Answer

Display the current superblock information

Question 5

During a forensic examination of a Windows 10 system, you find a file with an ADS named `:hidden.txt` attached to `legal.docx`. Using FTK Imager, you extract the ADS and discover it contains a list of passwords. Which tool or technique could also be used to identify this hidden data?

Accepted Answer

Analyzing the $MFT using Autopsy. The $MFT (Master File Table) in NTFS stores metadata for every file and directory, including entries for Alternate Data Streams (ADS). By analyzing the $MFT with a tool like Autopsy, you can directly view the ADS names and their associated data, such as the `:hidden.txt` stream attached to `legal.docx`. This is a reliable forensic method because the $MFT is a critical file system structure that records all streams, even if the file system explorer hides them.

Answer

Running `strings` on the raw partition

Answer

Using `lsof` on a live system

Answer

Performing file carving with PhotoRec

Question 6

A security analyst is investigating a compromised Windows server and wants to capture the contents of RAM for analysis. Which of the following tools is specifically designed for this purpose?

Accepted Answer

WinPmem. WinPmem is a dedicated memory acquisition tool designed to capture the contents of RAM from a live Windows system. It creates a raw memory dump file that can be analyzed with tools like Volatility, making it the correct choice for this forensic task.

Answer

Foremost

Answer

Volatility

Answer

FTK Imager

Question 7

A forensic analyst is examining a USB drive formatted with FAT32. A suspect claims they deleted a file several weeks ago. The analyst uses a carving tool but cannot recover the file. What is the MOST likely reason for the failed recovery?

Accepted Answer

The file clusters were overwritten by new data. File carving relies on finding the file's content clusters on disk, typically by scanning for file headers and footers. If the suspect deleted the file weeks ago, the clusters that held the file's data were likely marked as free in the FAT32 file allocation table and subsequently overwritten by new data written to the drive. This is the most common reason for carving failure on a FAT32 volume that has been in active use after deletion.

Answer

The file was encrypted and cannot be carved

Answer

FAT32 does not support file carving

Answer

The file was stored in the MFT, which is only present in NTFS

Question 8

Which of the following best describes the purpose of the Master File Table (MFT) in the NTFS filesystem?

Accepted Answer

It contains metadata and file attribute records for all files and directories. The Master File Table (MFT) is the core of the NTFS filesystem, storing a record for every file and directory on the volume. Each MFT record contains metadata such as timestamps, security descriptors, and file attributes, including the data itself for small files (resident data). This makes C correct because the MFT is fundamentally a database of file and directory metadata.

Answer

It manages the file allocation table for cluster chains

Answer

It stores the partition table and boot sector

Answer

It maintains a journal of all filesystem changes

Question 9

A Linux system uses the ext4 filesystem. A forensic analyst needs to recover a recently deleted file. Which of the following methods is MOST likely to succeed if the file's inode has not been reallocated?

Accepted Answer

Run `extundelete /dev/sda1 --restore-file /path/to/file`. `extundelete` is a dedicated tool designed to recover deleted files from ext3/ext4 filesystems by leveraging the filesystem's journal and inode data. If the inode has not been reallocated, the tool can directly restore the file using its path, making it the most targeted and efficient method.

Answer

Mount the filesystem with `mount -o ro,noatime` and browse

Answer

Use `dd` to copy the entire partition and search for the file signature

Answer

Use `ls -la` to view deleted file entries

Question 10

During a forensic examination of a Windows system, an analyst runs the Volatility plugin `netscan` on a memory dump. What information does this plugin primarily provide?

Accepted Answer

Network connections and listening sockets with associated processes. The Volatility plugin `netscan` is specifically designed to extract network connection information from Windows memory dumps, including active TCP and UDP connections, listening sockets, and the associated processes that own them. It works by scanning kernel data structures such as `_TCPT_OBJECT` and `_UDP_OBJECT` to provide a snapshot of network activity at the time of capture, which is critical for identifying malicious connections or unauthorized services.

Answer

Open files and handles for each process

Answer

List of all running processes and their parent processes

Answer

The contents of the Windows firewall rules

Question 11

What is the primary difference between MBR and GPT partition tables?

Accepted Answer

GPT uses a cyclic redundancy check (CRC) for integrity; MBR does not. GPT (GUID Partition Table) uses a cyclic redundancy check (CRC32) to verify the integrity of the partition table header and entries, detecting corruption or tampering. MBR (Master Boot Record) lacks any such integrity check, making it vulnerable to undetected corruption. This CRC mechanism is a fundamental design improvement in GPT over MBR.

Answer

MBR is used only on Linux; GPT is used on Windows

Answer

MBR supports larger disks than GPT

Answer

GPT stores the partition table only in the first sector

Question 12

Which TWO of the following are Volatility plugins used for process enumeration? (Select two.)

Accepted Answer

pslist. The `pslist` plugin enumerates processes by walking the doubly linked list of `_EPROCESS` structures in kernel memory, providing a snapshot of active processes. This is a fundamental method for process enumeration in memory forensics, making it a correct choice for the CHFI exam.

Answer

netscan

Answer

mftparser

Answer

hashdump

Question 13

Which THREE of the following are challenges specific to forensic analysis of solid-state drives (SSDs) compared to traditional hard disk drives (HDDs)? (Select three.)

Accepted Answer

The TRIM command can permanently erase deleted data. The TRIM command (ATA Data Set Management command) allows the SSD firmware to immediately erase data blocks that are no longer in use by the file system. This means that when a file is deleted, the TRIM command can permanently wipe the physical NAND cells, making it impossible to recover the data using traditional forensic tools. This is a unique challenge for SSDs because HDDs do not have a similar command that actively erases deleted data at the hardware level.

Answer

SSDs have higher latency for read operations

Answer

Bad block remapping is more frequent on SSDs

Question 14

Which TWO of the following are examples of file carving tools? (Select two.)

Accepted Answer

PhotoRec. PhotoRec is a dedicated file carving tool that recovers files by scanning raw data for known file signatures (headers/footers) rather than relying on filesystem metadata. It is commonly used in digital forensics to recover deleted files from unallocated space or damaged media.

Answer

WinPmem

Answer

FTK Imager

Answer

dd

Question 15

A forensic analyst is examining a hard drive and needs to identify the number of sectors per track. Which component of the hard disk structure defines this?

Accepted Answer

Track. The track is the circular path on the platter surface where data is written, and the number of sectors per track is a property defined by the track's geometry. Each track is divided into arcs called sectors, and the track's physical layout determines how many sectors can fit along its circumference. Therefore, the track component directly defines the sector count per track.

Answer

Sector

Answer

Cluster

Answer

Cylinder