CHFI Storage Forensics and File System Analysis Practice Test 9 — 15 Questions

Question 1

An analyst is examining a RAID 5 array of three disks. One disk has failed and been replaced; the array is rebuilding. Which of the following is the most significant forensic challenge regarding data acquisition from this array?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The rebuild process may overwrite unallocated space or remnants of deleted files. During a RAID 5 rebuild, the array controller reads parity and data from the remaining healthy disks to reconstruct the missing data onto the replacement disk. This process writes to the entire replacement disk, including areas that previously held unallocated space or remnants of deleted files, potentially overwriting critical forensic evidence. The rebuild is a low-level write operation that does not respect file system boundaries, making it a significant challenge for data acquisition.

Answer

The failed disk cannot be imaged because it is physically damaged

Answer

RAID 5 arrays cannot be imaged using traditional tools like dd

Answer

The array must be imaged while degraded to preserve evidence

Question 2

In an investigation of a Windows system, the analyst uses Volatility's 'netscan' plugin and identifies a suspicious outbound connection to an IP address on port 4444. Which of the following is the most likely associated malicious activity?

Accepted Answer

Reverse shell connection from a backdoor. Port 4444 is the default port for the Metasploit Meterpreter reverse TCP payload. A Volatility netscan result showing an outbound connection to this port strongly indicates a reverse shell, where the compromised system initiates a connection back to an attacker's listener to bypass firewalls. This is a classic backdoor behavior, not a standard service.

Answer

DNS tunneling exfiltration

Answer

HTTP data exfiltration

Answer

Remote desktop session

Question 3

An investigator needs to recover deleted files from a USB drive formatted with FAT32. Which of the following techniques would be most effective, assuming the files have not been overwritten?

Accepted Answer

Examine the FAT for unallocated clusters and reconstruct files. FAT32 does not have a journal (eliminating A). The Master File Table ($MFT) is used by NTFS, not FAT32 (eliminating C). While file carving with tools like 'foremost' (D) can recover files based on signatures, it is less effective for deleted files on FAT32 because it may fail to recover fragmented files and does not leverage the file system's own structure. The most effective technique is to examine the File Allocation Table (FAT) for unallocated clusters and reconstruct the files from the directory entry's starting cluster and size (B), assuming the clusters have not been overwritten. This uses the file system metadata to directly locate the file's data.

Answer

Check the journal for recent changes

Answer

Analyze the $MFT for orphaned entries

Answer

Use the 'foremost' tool to carve based on file signatures

Question 4

During a forensic acquisition of a suspect's SSD, the analyst notices that the drive supports TRIM. Which of the following is the most important consideration when acquiring the drive to preserve deleted data?

Accepted Answer

Use a hardware write-blocker and acquire the drive immediately to minimize TRIM interference. SSDs with TRIM support automatically issue commands to erase deallocated blocks, making deleted data unrecoverable. Using a hardware write-blocker and acquiring the drive immediately minimizes the time the drive is powered on, reducing the chance that the operating system or the SSD's garbage collection will issue TRIM commands that permanently wipe deleted data.

Answer

Perform a full format of the SSD before acquisition to clear any TRIM-related issues

Answer

Enable TRIM in the forensic tool to ensure the drive is optimized before imaging

Answer

The SSD should be powered on for several hours to allow TRIM to complete before imaging

Question 5

Which of the following best describes the purpose of the Host Protected Area (HPA) on a hard disk drive?

Accepted Answer

To provide a hidden storage area that is inaccessible through standard OS commands. The Host Protected Area (HPA) is a reserved region on a hard disk drive defined by the ATA/ATAPI standards. It is hidden from the operating system and standard disk utilities, making it inaccessible through normal OS commands, which is why it is used for forensic purposes or vendor-specific recovery tools.

Answer

To accelerate read/write operations using flash cache

Answer

To store the file system journal

Answer

To store the Master Boot Record

Question 6

During an investigation, an analyst recovers a file from unallocated space that contains fragments of a deleted document. The file size is 512 bytes, but the cluster size of the volume is 4096 bytes. What is the term for the unused bytes between the end of the file and the end of the last cluster?

Accepted Answer

File slack. File slack refers to the unused bytes between the end of a file and the end of the last cluster allocated to that file. In this scenario, the file is 512 bytes but resides in a 4096-byte cluster, leaving 3584 bytes of slack space. This area can contain remnants of previously deleted data or metadata, making it a critical forensic artifact.

Answer

Volume slack

Answer

Drive slack

Answer

RAM slack

Question 7

An analyst is examining a USB drive that appears to have a smaller capacity than expected. The drive is detected as 8 GB but only 7 GB is accessible. Which of the following is the most likely cause?

Accepted Answer

The drive has a Host Protected Area (HPA) hiding 1 GB. The difference between detected capacity (8 GB) and accessible space (7 GB) is most likely due to a Host Protected Area (HPA). HPA uses the ATA SET MAX ADDRESS command to reduce the total capacity reported by the drive, effectively hiding 1 GB from the operating system. A hidden partition does not change the total reported capacity; it only makes a portion of the space inaccessible by not assigning a drive letter. Therefore, only HPA directly reduces the total capacity, making option C the most likely cause.

Answer

The file system uses a cluster size that wastes space

Answer

The drive is formatted with FAT32 which has a 4 GB file size limit

Answer

The drive contains a hidden partition

Question 8

Which two of the following are characteristics of the ext4 file system? (Choose TWO.)

Accepted Answer

Uses a journal to maintain file system consistency. Option C is correct because ext4 is a journaling file system: it writes metadata (and optionally data) changes to a journal before committing them to the main file system, so an interrupted operation can be replayed or rolled back to keep the file system consistent. Option E is correct because ext4 introduced extents, which describe a contiguous range of blocks with a single descriptor instead of one pointer per block, reducing fragmentation overhead and improving performance for large files. Option A is wrong because the Master File Table ($MFT) is an NTFS structure, not an ext4 one. Option B is wrong because a file allocation table (FAT) belongs to FAT12/FAT16/FAT32, whereas ext4 uses inodes and block bitmaps. Option D is wrong because ext4 uses H-tree (hashed B-tree) indexing for directory entries, not a plain B-tree structure.

Answer

Uses a Master File Table ($MFT) to store file metadata

Answer

Uses a file allocation table (FAT) to track clusters

Answer

Stores directory entries in a B-tree structure

Question 9

Which three of the following are common techniques used to hide data on a storage device? (Choose THREE.)

Accepted Answer

Host Protected Area (HPA). Host Protected Area (HPA) (B) is a hidden region of a hard disk defined by the ATA standard outside the addressable range reported to the OS, commonly used to conceal data from normal file access. Alternate Data Streams (ADS) in NTFS (C) allow additional data to be attached to a file without appearing in directory listings or standard file size, making them a classic hiding technique. Slack space (E), including file slack and volume slack, is leftover storage between the logical end of a file and the end of its allocated cluster or partition, and can be used to stash data invisible to normal file reads. File system journaling (A) is a reliability feature that logs metadata changes for crash recovery, not a concealment method, and the TRIM command (D) is an SSD maintenance operation that informs the drive which blocks are no longer in use, so neither hides data.

Answer

File system journaling

Answer

TRIM command

Question 10

Which two of the following are tools used for memory forensics acquisition? (Choose TWO.)

Accepted Answer

WinPmem. WinPmem (C) is a memory acquisition tool that captures physical memory from live Windows systems into a raw image file, making it a correct choice for memory forensics acquisition. LiME (E) is a Loadable Kernel Module for Linux that acquires volatile memory to a file or over the network, and it is specifically designed for memory acquisition, so it is also correct. Autopsy (A) is a graphical digital forensics platform used primarily for disk image analysis and file system examination, not memory acquisition. FTK Imager (B) is used for creating forensic disk images and mounting images, not for capturing RAM. Volatility (D) is a memory analysis framework that parses memory images after acquisition, so it is not an acquisition tool.

Answer

Autopsy

Answer

FTK Imager

Answer

Volatility

Question 11

During a forensic investigation, an analyst examines a hard disk and notices that the partition table uses a 64-bit scheme with a maximum of 128 partitions. Which partition table type is in use?

Accepted Answer

GPT. GPT (GUID Partition Table) uses a 64-bit scheme for logical block addressing and supports up to 128 partitions by default in its standard header layout. This matches the description of a 64-bit partition table with a maximum of 128 partitions, making D the correct answer.

Answer

MBR

Answer

LDM

Answer

APM

Question 12

A forensic analyst is examining a FAT32 file system and finds that the file allocation table indicates a cluster chain ending with 0x0FFFFFFF. What does this value signify?

Accepted Answer

End-of-file marker. In FAT32 file systems, the File Allocation Table (FAT) uses 32-bit entries to track cluster allocation. The value 0x0FFFFFFF is the defined end-of-file (EOF) marker, indicating that the current cluster is the last in a file's cluster chain. This is a standard FAT32 convention, distinct from other special values like free or bad clusters.

Answer

Free cluster

Answer

Reserved cluster

Answer

Bad cluster

Question 13

An investigator recovers a file from unallocated space on an NTFS drive using file carving. The file appears to contain alternate data streams (ADS). Which tool can be used to list all ADS associated with a file on a live Windows system?

Accepted Answer

dir /r. The `dir /r` command is the correct tool because it is a native Windows command that lists all alternate data streams (ADS) associated with files on an NTFS volume. When used with the `/r` switch, `dir` displays the main file stream along with any named ADS, such as `:Zone.Identifier:$DATA`, which are hidden from standard directory listings. This makes it the most direct and built-in method for an investigator to enumerate ADS on a live Windows system.

Answer

ls -la

Answer

attrib

Answer

fsutil

Question 14

During a forensic examination of an SSD, the analyst notes that TRIM is enabled. What challenge does TRIM pose for data recovery?

Accepted Answer

TRIM permanently erases deleted data at the block level, hindering recovery. TRIM is an ATA command that allows the operating system to inform the SSD which data blocks are no longer in use. When TRIM is enabled, the SSD's garbage collection process immediately erases these blocks at the physical level, making the data permanently unrecoverable through conventional forensic tools. This directly hinders data recovery because the deleted data is physically zeroed or marked as invalid before any forensic acquisition can occur.

Answer

TRIM reduces the lifespan of the SSD by excessive writes

Answer

TRIM compresses data, altering forensic signatures

Answer

TRIM encrypts data, preventing forensic access

Question 15

An analyst retrieves a forensic image of a hard drive and discovers that the size reported by the operating system is smaller than the actual physical capacity. The extra space is not accessible through standard partition tools. This hidden area is MOST likely:

Accepted Answer

Host Protected Area. The Host Protected Area (HPA) is a region on a hard drive that is hidden from the operating system by using the ATA SET MAX ADDRESS command to reduce the reported capacity. This area is not accessible through standard partition tools because the OS sees only the reduced address space, making it ideal for storing forensic or diagnostic data. The analyst's observation of a smaller reported size than physical capacity directly matches HPA behavior.

Answer

Device Configuration Overlay

Answer

Volume slack

Answer

RAM slack