CHFI Storage Forensics and File System Analysis Practice Test 9 — 15 Questions

Question 1

During a forensic investigation, an analyst examines a hard disk and notices that the partition table uses a 64-bit scheme with a maximum of 128 partitions. Which partition table type is in use?

Accepted Answer

GPT. GPT (GUID Partition Table) uses a 64-bit scheme and supports up to 128 partitions by default. MBR uses 32-bit and supports only 4 primary partitions.

Answer

MBR

Answer

LDM

Answer

APM

Question 2

A forensic analyst is examining a FAT32 file system and finds that the file allocation table indicates a cluster chain ending with 0x0FFFFFFF. What does this value signify?

Accepted Answer

End-of-file marker. In FAT32 file systems, the File Allocation Table (FAT) uses 32-bit entries to track cluster allocation. The value 0x0FFFFFFF is the defined end-of-file (EOF) marker, indicating that the current cluster is the last in a file's cluster chain. This is a standard FAT32 convention, distinct from other special values like free or bad clusters.

Answer

Free cluster

Answer

Reserved cluster

Answer

Bad cluster

Question 3

When analyzing an NTFS volume, an investigator wants to identify files that were recently accessed or modified. Which NTFS artifact stores metadata about file system changes and can be parsed using tools like MFTEcmd or NTFSLogTracker?

Accepted Answer

$USN_Jrnl. The USN (Update Sequence Number) journal records changes to files and directories, including timestamps and reason codes. It is commonly used to track recent activity.

Answer

$LogFile

Answer

$Recycle.Bin

Answer

$MFT

Question 4

A security analyst detects suspicious activity on a Windows workstation. They acquire RAM using WinPmem and analyze it with Volatility. Which Volatility command would list all active processes along with their parent process IDs?

Accepted Answer

volatility -f mem.dmp pstree. The pstree plugin displays processes in a tree format showing parent-child relationships. pslist lists processes but not parent PIDs.

Answer

volatility -f mem.dmp pslist

Answer

volatility -f mem.dmp connscan

Answer

volatility -f mem.dmp netscan

Question 5

During an investigation of a Linux system, an analyst runs `ls -li` and sees that a file's inode number is 0. What does this indicate about the file?

Accepted Answer

The file has been deleted but is still open. In Linux, an inode number of 0 typically indicates a file that has been deleted but is still open by a process. The directory entry may be removed but the inode remains until the file is closed.

Answer

The file is a symbolic link

Answer

The file is a device file

Answer

The file is a hard link

Question 6

An investigator recovers a file from unallocated space on an NTFS drive using file carving. The file appears to contain alternate data streams (ADS). Which tool can be used to list all ADS associated with a file on a live Windows system?

Accepted Answer

dir /r. The `dir /r` command in Windows displays alternate data streams. `streams.exe` from Sysinternals is also commonly used, but among the options, `dir /r` is the native method.

Answer

ls -la

Answer

attrib

Answer

fsutil

Question 7

A forensic examiner wants to recover deleted files from a USB drive formatted with FAT32. Which file carving tool is specifically designed to recover files based on file headers and footers?

Accepted Answer

Foremost. Foremost is a file carving tool that uses headers and footers to recover files. It is widely used for data recovery from FAT, NTFS, and other file systems.

Answer

Nmap

Answer

Wireshark

Answer

Sleuth Kit

Question 8

During a forensic examination of an SSD, the analyst notes that TRIM is enabled. What challenge does TRIM pose for data recovery?

Accepted Answer

TRIM permanently erases deleted data at the block level, hindering recovery. TRIM allows the SSD to erase data blocks that are no longer in use, making it difficult to recover deleted files because the physical data may be zeroed out.

Answer

TRIM reduces the lifespan of the SSD by excessive writes

Answer

TRIM compresses data, altering forensic signatures

Answer

TRIM encrypts data, preventing forensic access

Question 9

An analyst retrieves a forensic image of a hard drive and discovers that the size reported by the operating system is smaller than the actual physical capacity. The extra space is not accessible through standard partition tools. This hidden area is MOST likely:

Accepted Answer

Host Protected Area. The Host Protected Area (HPA) is an area on the hard drive that is not accessible through standard ATA commands. It can be used to hide data.

Answer

Device Configuration Overlay

Answer

Volume slack

Answer

RAM slack

Question 10

In an ext4 file system, a forensic analyst needs to examine the journal to recover recently deleted files. Where is the journal typically stored?

Accepted Answer

In a special inode (inode 8). In ext4, the journal is stored in a special inode (inode 8) or as a file named .journal. It can also be stored in a separate block group.

Answer

In a reserved area after the superblock

Answer

In the superblock

Answer

In the group descriptor table

Question 11

Which of the following is a Windows-based forensic suite that provides timeline analysis, keyword search, and file system browsing for forensic investigations?

Accepted Answer

Autopsy. Autopsy is an open-source digital forensics platform that runs on Windows, Linux, and macOS. It provides timeline analysis, keyword search, and file system browsing.

Answer

Wireshark

Answer

FTK

Answer

EnCase

Question 12

A forensic investigator analyzing a RAID 5 array of three disks notices that one disk has failed. Can the investigator still reconstruct the data?

Accepted Answer

Yes, using the parity information from the remaining disks. RAID 5 uses distributed parity. With one disk failure, data can be reconstructed using the parity information on the remaining two disks.

Answer

No, RAID 5 requires all disks to be present

Answer

Yes, but only if the failed disk is the parity disk

Answer

No, because RAID 5 does not support hot swapping

Question 13

An analyst is examining a memory dump using Volatility and wants to identify network connections. Which TWO Volatility plugins can be used to list network connections?

Accepted Answer

netscan. netscan and connscan are Volatility plugins that list network connections. pslist lists processes, not connections. pstree lists process trees. dlllist lists loaded DLLs.

Answer

dlllist

Answer

pstree

Answer

pslist

Question 14

Which THREE of the following are types of slack space that can contain hidden data on a hard disk?

Accepted Answer

File slack. File slack, volume slack, and RAM slack are types of slack space. HPA and DCO are hidden areas, not slack space.

Answer

Device Configuration Overlay

Answer

Host Protected Area

Question 15

A forensic analyst is recovering deleted files from an ext3 file system. Which TWO methods can be used to recover deleted inodes?

Accepted Answer

Analyzing the ext3 journal for deleted inode entries. In ext3, deleted inodes can be recovered by analyzing the journal (which records metadata changes) or by scanning the inode table for orphan inodes. File carving recovers file data without metadata. Using debugfs to view the superblock does not recover inodes.

Answer

Using file carving tools like Foremost

Answer

Using dd to create a raw image

Answer

Using debugfs to display the superblock