CHFI Storage Forensics and File System Analysis Practice Test 8 — 15 Questions

Question 1

An examiner is analyzing an NTFS volume and suspects that a suspect hid data using Alternate Data Streams (ADS). Which tool or method is MOST appropriate to list all ADS on the volume?

Accepted Answer

Execute 'dir /r' in a Windows command prompt on the mounted image. The 'dir /r' command in Windows Command Prompt is specifically designed to display alternate data streams (ADS) on NTFS volumes. It lists all files and directories, including any hidden streams attached to them, making it the most direct and appropriate method for an examiner to enumerate all ADS on a mounted NTFS volume.

Answer

Run 'ls -la' from a Linux forensic environment

Answer

Use 'icacls' to view security descriptors and detect ADS

Answer

Mount the image in Autopsy and run the 'Find File' module

Question 2

During a memory forensics analysis using Volatility, an examiner runs 'python vol.py -f memory.dmp pslist' and sees a suspicious process named 'expl0rer.exe' with a PPID of 4. What does a PPID of 4 indicate, and what should the examiner do next?

Accepted Answer

The process is probably a hidden or injected process; run 'psxview' and 'malfind' to detect anomalies. In Windows memory forensics, a PPID of 4 indicates the parent process is the System process (PID 4), which is the kernel-mode process responsible for starting system services and drivers. A suspicious process like 'expl0rer.exe' with PPID 4 is highly anomalous because legitimate user-mode processes are rarely direct children of the System process; the most notable legitimate exception is smss.exe. The examiner should run 'psxview' to check for hidden processes and 'malfind' to detect code injection, as this PPID can indicate a process masquerading as a system component or whose parent PID has been manipulated.

Answer

The process is a child of the System process, indicating it is a legitimate system process; no further action needed

Answer

The process is a child of the System Idle Process, which is normal; ignore it

Answer

The process has been injected into the System process and is likely a rootkit; run 'psscan' to verify

Question 3

An analyst is investigating a Linux server running ext4 and needs to recover deleted files that may have been overwritten partially. Which technique is BEST suited for recovering fragments of known file types when the inode metadata is lost?

Accepted Answer

Perform file carving using 'foremost' with custom signatures. When inode metadata is lost, file system-based recovery tools like extundelete cannot function because they rely on that metadata. File carving with foremost uses content-based signatures (magic bytes) to locate and extract file fragments, even from partially overwritten areas of the disk. This makes it the best choice for recovering fragments of known file types when the file system metadata is unavailable.

Answer

Use 'dd' to extract the partition and then 'grep' for strings

Answer

Manually reconstruct the inode table using 'debugfs'

Answer

Use 'extundelete' to recover files from the journal

Question 4

A forensic examiner needs to acquire the RAM from a Windows 10 system without altering the contents. Which tool is MOST appropriate for this task?

Accepted Answer

WinPmem. WinPmem is the most appropriate tool for acquiring RAM from a Windows 10 system because it is specifically designed for memory acquisition on Windows platforms, using the WinPmem driver to access physical memory without modifying the contents. It supports both 32-bit and 64-bit systems and can output raw memory images or other formats, ensuring forensic soundness by minimizing interaction with the target system.

Answer

FTK Imager

Answer

LiME

Answer

dd

Question 5

During an investigation of a compromised system, the analyst discovers that the suspect used steganography to hide data within image files. Which forensic tool is BEST suited for detecting hidden data in images through statistical analysis?

Accepted Answer

Stegdetect. Stegdetect is specifically designed to detect hidden data in images by applying statistical analysis to identify anomalies in pixel distributions that indicate steganographic embedding. It uses techniques like chi-square analysis and RS analysis to detect LSB (Least Significant Bit) steganography, making it the best choice for this task.

Answer

Binwalk

Answer

Wireshark

Answer

Foremost

Question 6

A forensic analyst is examining a RAID 5 array consisting of three disks. One disk has failed and has been replaced. The array is rebuilt automatically. However, the analyst needs to recover deleted files that existed before the rebuild. What is the MOST significant challenge in this scenario?

Accepted Answer

The rebuild process may overwrite data in slack space and previously unallocated clusters. When a RAID 5 array with a failed disk is rebuilt, the controller reconstructs data using parity information and writes it to the replacement disk. This rebuild process writes to all previously unallocated clusters and slack space across the array, potentially overwriting the very data the analyst hopes to recover. Deleted files that existed before the rebuild are at high risk of being overwritten during this automatic reconstruction, making recovery extremely difficult or impossible.

Answer

File carving techniques do not work on RAID volumes

Answer

The file system becomes corrupted after rebuild

Answer

The RAID controller encrypts data, preventing direct disk access

Question 7

Which of the following partition table types uses a protective MBR and a GPT header, and is recommended for disks larger than 2 TB?

Accepted Answer

GPT. GPT (GUID Partition Table) is the correct answer because it uses a protective MBR at the first sector (LBA 0) to prevent legacy tools from misidentifying the disk as unformatted, followed by the GPT header at LBA 1. This structure is specifically designed to support disks larger than 2 TB by using 64-bit logical block addresses, overcoming the 2 TB limit of MBR’s 32-bit addressing.

Answer

MBR

Answer

Dynamic disk

Answer

APM (Apple Partition Map)

Question 8

During a forensic examination of an NTFS drive, an analyst runs 'fsutil usn readjournal C:' and observes a large number of USN journal entries for a specific file after a certain date. The file's $MFT record shows a last modified timestamp far earlier than the journal entries. What does this discrepancy suggest?

Accepted Answer

The file's metadata was modified without changing its content, possibly using timestomping or ADS manipulation. The USN journal records all changes to files and directories on an NTFS volume, including metadata modifications. When the USN journal shows numerous entries after a date but the $MFT record's last modified timestamp is earlier, it indicates that the file's metadata (e.g., timestamps, ADS) was altered without updating the $MFT's last modified field—a classic sign of timestomping or ADS manipulation. This discrepancy arises because timestomping tools can directly modify $MFT attributes while the USN journal still logs the change event.

Answer

The file is a system file that is excluded from USN journaling

Answer

The file system is corrupted and the MFT is not updating correctly

Answer

The file was accessed via a mounted volume shadow copy, which does not update MFT

Question 9

An analyst is examining a hard drive that was seized from a suspect. The drive is detected as a smaller capacity than listed on the label. Which of the following is the MOST likely explanation?

Accepted Answer

The drive has a Host Protected Area (HPA) that hides sectors from the OS. A Host Protected Area (HPA) is a reserved region on an ATA/ATAPI hard drive that can hide sectors from the operating system, making the drive appear smaller than its physical capacity. This is a common anti-forensics technique used to conceal data, and it can be detected and removed using tools like hdparm or ATA Security commands.

Answer

The drive has been partitioned with a GPT table, which does not use the full capacity

Answer

The file system is FAT32, which has a 2 TB limit

Answer

The drive controller has a firmware bug reporting incorrect size

Question 10

An investigator needs to analyze the contents of the Windows Recycle Bin on a system running Windows 10. Which artifact(s) should the investigator examine to determine the original location and deletion time of a file in the Recycle Bin?

Accepted Answer

The '$I' and '$R' files in the $Recycle.Bin\<SID> folder. In Windows 10, the Recycle Bin is implemented as the `$Recycle.Bin` folder, with each user having a subfolder identified by their Security Identifier (SID). When a file is deleted, it is renamed to an `$R` file (the actual data) and an `$I` file (metadata including original path and deletion timestamp) is created. Examining these `$I` and `$R` files allows the investigator to determine the original location and deletion time of the file.

Answer

The 'System Volume Information' folder

Answer

The 'INFO2' file in the Recycled folder

Answer

The 'desktop.ini' file in the Recycle Bin

Question 11

Which TWO of the following are valid methods to hide data on an NTFS file system without using external tools?

Accepted Answer

Embedding data in file slack space. A is correct because file slack space is the unused bytes between the end of a file's logical data and the end of its allocated cluster. On NTFS, when a file does not fill its last cluster, the remaining bytes (RAM slack and drive slack) can be written to without affecting the file's visible content. This is a native hiding method that requires no external tools, as the data is simply written to the slack region using standard file I/O operations.

Answer

Storing data in the NTFS file system journal ($LogFile)

Answer

Using the $Volume attribute in the MFT

Answer

Encrypting data with EFS

Question 12

Which THREE of the following are challenges specific to SSD forensics compared to HDD forensics?

Accepted Answer

Garbage collection that automatically erases stale blocks. Option A is correct because SSD garbage collection proactively erases blocks containing stale or invalid pages in the background, so data that would remain recoverable on an HDD platter can be destroyed without any user action. Option B is correct because the TRIM command tells the SSD controller which LBAs are no longer in use, allowing those flash pages to be erased and making deleted data unrecoverable far faster and more thoroughly than on an HDD. Option C is correct because wear leveling relocates data across NAND blocks to spread erase cycles, so logical-to-physical mapping changes constantly and forensic tools cannot rely on fixed physical locations the way they can with HDD platters. Option D is not correct because platter rotation and magnetic remanence are characteristics of HDDs, not SSD-specific challenges. Option E is not correct because controller-based compression is not a defining SSD forensic challenge in the way garbage collection, TRIM, and wear leveling are, and it is not marked as a correct answer here.

Answer

Platter rotation causing magnetic remanence

Answer

Controller-based compression reducing data size

Question 13

Which TWO of the following tools are commonly used for file carving in forensic investigations?

Accepted Answer

PhotoRec. PhotoRec (B) is a free, open-source file carving utility from the TestDisk suite that recovers files by scanning raw disk images or devices for known file signatures (headers/footers), ignoring the filesystem, which is exactly what file carving means. Foremost (C) is another classic carving tool originally developed for the U.S. Air Force OSI, which uses a configurable header/footer signature database (foremost.conf) to extract files from disk images and is widely cited in forensic curricula. Autopsy (A) is a full digital forensics platform (a GUI front-end to The Sleuth Kit) that performs timeline, keyword, and artifact analysis; although it can invoke carving, it is not primarily a carving tool. EnCase (D) is a commercial forensic suite for imaging and analysis rather than a dedicated carver. Wireshark (E) is a network protocol analyzer that captures and inspects packet traffic, unrelated to recovering files from storage media.

Answer

Autopsy

Answer

EnCase

Answer

Wireshark

Question 14

During a forensic analysis of a Windows 10 system, an investigator needs to locate the Master File Table ($MFT) to analyze file metadata. Which file system structure contains the $MFT?

Accepted Answer

NTFS volume's Master File Table. The $MFT is a core component of the NTFS file system, storing metadata for every file and directory on the volume. It is located in the NTFS volume's designated Master File Table area, not in any other file system structure. Option D correctly identifies this NTFS-specific structure.

Answer

ext4 superblock

Answer

FAT32's File Allocation Table

Answer

HFS+ catalog file

Question 15

An analyst suspects that sensitive data was hidden in the NTFS Alternate Data Streams (ADS) of a file on a suspect's drive. Which tool is specifically designed to enumerate and extract data from ADS on a live Windows system?

Accepted Answer

Streams.exe (Sysinternals). Streams.exe from Sysinternals is specifically designed to enumerate and extract data from NTFS Alternate Data Streams (ADS) on a live Windows system. It scans files and directories for hidden streams, displaying their names and sizes, and can optionally delete or extract them. This makes it the correct tool for the analyst's task.

Answer

Foremost

Answer

PhotoRec

Answer

dd