CHFI Storage Forensics and File System Analysis Practice Test 8 — 15 Questions

Question 1

During a forensic analysis of a Windows 10 system, an investigator needs to locate the Master File Table ($MFT) to analyze file metadata. Which file system structure contains the $MFT?

Accepted Answer

NTFS volume's Master File Table. The $MFT is a core NTFS system file that contains metadata for all files and directories on an NTFS volume.

Answer

ext4 superblock

Answer

FAT32's File Allocation Table

Answer

HFS+ catalog file

Question 2

An analyst suspects that sensitive data was hidden in the NTFS Alternate Data Streams (ADS) of a file on a suspect's drive. Which tool is specifically designed to enumerate and extract data from ADS on a live Windows system?

Accepted Answer

Streams.exe (Sysinternals). Streams.exe (from Sysinternals) is the standard tool to list and extract data from Alternate Data Streams on Windows.

Answer

Foremost

Answer

PhotoRec

Answer

dd

Question 3

During a forensic examination of a Linux system, the investigator runs the command 'ls -i /home/user/file.txt' and sees inode number 12345. The file was recently deleted. Which of the following is the most effective method to recover the file, assuming the inode is still accessible?

Accepted Answer

Use 'debugfs' to attempt to recover the inode and its data blocks. The 'debugfs' tool on ext filesystems can access inodes directly to recover deleted files if the inode is still present.

Answer

Run 'scalpel' with a custom configuration for the file type

Answer

Use 'foremost' to scan the disk for the file header/footer

Answer

Run 'photorec' on the disk to carve the file from unallocated space

Question 4

An analyst is examining a RAID 5 array of three disks. One disk has failed and been replaced; the array is rebuilding. Which of the following is the most significant forensic challenge regarding data acquisition from this array?

Accepted Answer

The rebuild process may overwrite unallocated space or remnants of deleted files. RAID 5 distributes parity across disks. During rebuild, write operations occur that can overwrite deleted data or alter metadata, complicating acquisition.

Answer

The failed disk cannot be imaged because it is physically damaged

Answer

RAID 5 arrays cannot be imaged using traditional tools like dd

Answer

The array must be imaged while degraded to preserve evidence

Question 5

In an investigation of a Windows system, the analyst uses Volatility's 'netscan' plugin and identifies a suspicious outbound connection to an IP address on port 4444. Which of the following is the most likely associated malicious activity?

Accepted Answer

Reverse shell connection from a backdoor. Port 4444 is commonly used by reverse shells (e.g., Metasploit default) and indicates a potential command and control session.

Answer

DNS tunneling exfiltration

Answer

HTTP data exfiltration

Answer

Remote desktop session

Question 6

An investigator needs to recover deleted files from a USB drive formatted with FAT32. Which of the following techniques would be most effective, assuming the files have not been overwritten?

Accepted Answer

Examine the FAT for unallocated clusters and reconstruct files. FAT32 stores directory entries that are marked as deleted but still contain file metadata; carving based on remnants of directory entries is effective.

Answer

Check the journal for recent changes

Answer

Analyze the $MFT for orphaned entries

Question 7

During a forensic acquisition of a suspect's SSD, the analyst notices that the drive supports TRIM. Which of the following is the most important consideration when acquiring the drive to preserve deleted data?

Accepted Answer

Use a hardware write-blocker and acquire the drive immediately to minimize TRIM interference. TRIM causes the SSD to erase deleted blocks immediately, making recovery impossible. Imaging the drive as soon as possible and using a write-blocker can prevent further TRIM commands.

Answer

Perform a full format of the SSD before acquisition to clear any TRIM-related issues

Answer

Enable TRIM in the forensic tool to ensure the drive is optimized before imaging

Answer

The SSD should be powered on for several hours to allow TRIM to complete before imaging

Question 8

An investigator is analyzing a memory dump from a compromised server using Volatility. The 'pslist' plugin shows a process with no parent PID (PPID). Which of the following is the most likely explanation?

Accepted Answer

The process is a kernel thread and has no parent. In Volatility, pslist may show processes without a parent if the parent process has exited or the process list is corrupted. However, a more common forensic scenario is that the process is a kernel-mode rootkit hiding its parent.

Answer

The process is a system idle process

Answer

The process list is incomplete due to memory corruption

Question 9

Which of the following best describes the purpose of the Host Protected Area (HPA) on a hard disk drive?

Accepted Answer

To provide a hidden storage area that is inaccessible through standard OS commands. HPA is a reserved area on the drive that is not normally accessible by the OS, often used by manufacturers for diagnostics or by investigators to hide data.

Answer

To accelerate read/write operations using flash cache

Answer

To store the file system journal

Answer

To store the Master Boot Record

Question 10

An analyst is examining an Apple Mac system and needs to recover deleted files from an APFS volume. Which tool is most appropriate for this task?

Accepted Answer

FTK Imager. APFS is the default file system on modern Macs. Tools like 'foremost' or 'photorec' can carve files from the raw device, but file system aware tools like 'apfs-fuse' or 'disk drill' are more appropriate. Among forensic suites, FTK and EnCase support APFS.

Answer

Foremost

Answer

LiME

Answer

Volatility

Question 11

During an investigation, an analyst recovers a file from unallocated space that contains fragments of a deleted document. The file size is 512 bytes, but the cluster size of the volume is 4096 bytes. What is the term for the unused bytes between the end of the file and the end of the last cluster?

Accepted Answer

File slack. File slack is the space between the end of the logical file and the end of the last cluster allocated to it.

Answer

Volume slack

Answer

Drive slack

Answer

RAM slack

Question 12

An analyst is examining a USB drive that appears to have a smaller capacity than expected. The drive is detected as 8 GB but only 7 GB is accessible. Which of the following is the most likely cause?

Accepted Answer

The drive has a Host Protected Area (HPA) hiding 1 GB. The missing space could be due to an HPA (Host Protected Area) or DCO (Device Configuration Overlay) configured to hide the additional space.

Answer

The file system uses a cluster size that wastes space

Answer

The drive is formatted with FAT32 which has a 4 GB file size limit

Question 13

Which two of the following are characteristics of the ext4 file system? (Choose TWO.)

Accepted Answer

Uses a journal to maintain file system consistency. ext4 uses extents for efficient space management and a journal for metadata consistency.

Answer

Uses a Master File Table ($MFT) to store file metadata

Answer

Uses a file allocation table (FAT) to track clusters

Answer

Stores directory entries in a B-tree structure

Question 14

Which three of the following are common techniques used to hide data on a storage device? (Choose THREE.)

Accepted Answer

Host Protected Area (HPA). HPA, ADS, and slack space are well-known data hiding techniques.

Answer

File system journaling

Answer

TRIM command

Question 15

Which two of the following are tools used for memory forensics acquisition? (Choose TWO.)

Accepted Answer

WinPmem. WinPmem and LiME are memory acquisition tools for Windows and Linux respectively.

Answer

Autopsy

Answer

FTK Imager

Answer

Volatility