CHFI Storage Forensics and File System Analysis Practice Test 9 — 15 Questions

Question 1

An analyst is investigating a Linux system that used ext4. The suspect deleted several files and then ran 'fstrim' on the partition. Which of the following best describes the challenge in recovering the deleted data?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The TRIM command instructs the SSD to permanently erase the blocks, and wear leveling may also have moved data. D is correct because the `fstrim` command sends the ATA TRIM (or SCSI UNMAP) command to the SSD, which instructs the drive to physically erase the blocks that are marked as free in the file system. This makes the original data unrecoverable at the block level, as the SSD's firmware permanently discards the data. Additionally, wear leveling may have already moved the data to different physical blocks before the TRIM command, further complicating recovery.

Answer

The ext4 journal will automatically purge the metadata of deleted files

Answer

Data recovery is still possible using file carving because fstrim only affects free space

Answer

The inodes are overwritten immediately, making recovery impossible

Question 2

A security analyst receives an image of a hard drive with a GPT partition table. Which of the following is a key difference between GPT and MBR that the analyst should consider?

Accepted Answer

GPT uses a protective MBR to prevent legacy tools from misinterpreting the disk. GPT uses a protective MBR (Master Boot Record) at sector 0 of the disk to maintain backward compatibility with legacy BIOS-based tools that expect an MBR. This protective MBR contains a single partition entry of type 0xEE that covers the entire disk (or up to 2 TiB), preventing older utilities from misinterpreting the GPT disk as unformatted or overwriting GPT structures. This is a key architectural difference from MBR, which has no such protective mechanism.

Answer

GPT stores partition information only in the first sector of the disk

Answer

GPT supports up to 4 primary partitions; MBR supports up to 128

Answer

MBR uses a GUID partition table; GPT uses a simple table at sector 0

Question 3

Which file system uses a Master File Table ($MFT) as its central catalog for file metadata?

Accepted Answer

NTFS. NTFS (New Technology File System) uses the Master File Table ($MFT) as its central catalog to store metadata about every file and directory on the volume. Each file or directory has at least one record in the $MFT, which contains attributes such as timestamps, security descriptors, data runs, and the file's name. This design is fundamental to NTFS's ability to support advanced features like journaling, hard links, and alternate data streams.

Answer

FAT32

Answer

APFS

Answer

ext4

Question 4

During a forensic investigation, an analyst discovers data hidden in the Host Protected Area (HPA) of a hard drive. Which tool is commonly used to view and access the HPA?

Accepted Answer

hdparm. D (hdparm) is correct because the Host Protected Area (HPA) is a reserved area on an ATA/IDE hard drive that can be accessed and manipulated using ATA commands. The hdparm utility in Linux provides the -N flag to view and change the HPA size, allowing an analyst to detect and access hidden data stored in this region.

Answer

PhotoRec

Answer

fdisk

Answer

dd

Question 5

An analyst is examining an NTFS volume and finds that a file's $MFT record indicates it is resident. What does this imply about the file's data?

Accepted Answer

The file's data is stored within the $MFT record itself, suitable for small files. When a file's $MFT record indicates it is resident, the file's data is stored entirely within the $MFT record itself. This occurs for small files (typically under 512–1024 bytes) to optimize storage and access speed, as the data does not need to be placed in separate clusters on the NTFS volume.

Answer

The file is compressed and stored across multiple clusters

Answer

The file uses alternate data streams to hide data

Answer

The file is a directory junction point

Question 6

Which forensic tool is specifically designed to recover lost partitions or file system structures and can also be used for data carving?

Accepted Answer

TestDisk. TestDisk is specifically designed to recover lost partitions and repair file system structures, making it the correct choice for this scenario. It also includes data carving capabilities through its companion tool PhotoRec, allowing it to recover files from unallocated space or damaged volumes.

Answer

Sleuth Kit

Answer

EnCase

Answer

Volatility

Question 7

Which TWO of the following are challenges specific to SSD forensics compared to traditional HDD forensics?

Accepted Answer

Wear leveling. Wear leveling is a challenge specific to SSDs because it distributes write operations across all memory cells to prevent premature wear, making it difficult to recover deleted data as the logical-to-physical mapping changes constantly. Unlike HDDs, where data remains in a fixed physical location until overwritten, SSDs remap blocks, so traditional forensic tools that rely on physical sector addressing may not retrieve the actual data.

Answer

Bad sectors

Answer

File fragmentation

Answer

Slack space

Question 8

An analyst is conducting memory forensics on a Windows system using Volatility. Which THREE commands can provide information about network connections?

Accepted Answer

netscan. The 'netscan' command in Volatility scans for TCP and UDP endpoints on Windows systems, including established connections, listening ports, and sockets, making it a primary tool for network connection analysis. 'connscan' specifically scans for TCP connections from the pool tag 'TcpE' and 'TcbE', providing a list of active TCP connections. 'sockets' lists open sockets by parsing the kernel's socket objects, showing both TCP and UDP listening endpoints. Together, these three commands cover the full spectrum of network connection artifacts in memory.

Answer

pstree

Answer

pslist

Question 9

Which TWO of the following are methods used to hide data within the NTFS file system?

Accepted Answer

File slack space. File slack space (B) is correct because it refers to the unused space between the end of a file's data and the end of the allocated cluster, allowing data hiding without affecting file size. Alternate Data Streams (ADS) (D) is correct because it allows multiple data streams to be attached to a file, enabling hidden data to be stored in additional streams. Both techniques are commonly used for data hiding in NTFS.

Answer

USN Journal

Answer

Volume Shadow Copy

Answer

Encrypting File System (EFS)

Question 10

In ext3/ext4 file systems, which THREE of the following are key structures used for file metadata and recovery?

Accepted Answer

Journal. The journal (A) is correct because ext3/ext4 use a journaling mechanism that records metadata and data changes before they are committed to the main filesystem. This allows for rapid recovery after a crash by replaying or discarding incomplete transactions, preventing filesystem corruption.

Answer

Master File Table ($MFT)

Answer

File Allocation Table (FAT)

Question 11

Which TWO tools are commonly used for file carving during a forensic investigation?

Accepted Answer

Scalpel. Scalpel is a file carving tool that uses a database of header and footer signatures to extract files from raw disk images without relying on filesystem metadata. It is commonly used in forensic investigations to recover deleted or fragmented files by scanning for known file signatures.

Answer

fdisk

Answer

Autopsy

Answer

LiME

Question 12

Which TWO of the following are types of slack space that can contain forensic evidence?

Accepted Answer

Volume slack. Volume slack is the unused space between the end of the file system and the end of the partition. When a partition is smaller than the volume it resides on, the remaining space (volume slack) can contain remnants of previously stored data, making it a valuable source of forensic evidence.

Answer

Index slack

Answer

Swap space

Answer

Buffered slack

Question 13

During a forensic investigation, an analyst recovers a hard drive that uses GPT partitioning. The analyst needs to locate the backup GPT header to verify partition table integrity. Where is the backup GPT header typically stored on the disk?

Accepted Answer

The last sector of the disk. The backup GPT header is stored in the last sector of the disk (LBA -1) to provide redundancy. If the primary GPT header in LBA 1 is corrupted, the backup can be used to reconstruct the partition table. This design ensures the GPT structure can be recovered even if the beginning of the disk is damaged.

Answer

The first sector of the last partition

Answer

Sector 0 (the MBR sector)

Answer

Sector 1 (immediately after the protective MBR)

Question 14

During an investigation, an analyst uses the `volatility -f mem.dmp windows.pslist` command and observes a process named 'svchost.exe' with PID 1234. Further analysis shows that this process has no parent process (PPID = 0). What is the MOST likely explanation for this anomaly?

Accepted Answer

The process has been hidden using a rootkit that manipulated kernel objects (DKOM). A process with PID 1234 and PPID 0 indicates that the process has no parent in the process list. This is a classic sign of Direct Kernel Object Manipulation (DKOM), where a rootkit removes the process from the doubly linked list of EPROCESS structures, effectively hiding it from tools like `pslist` that traverse that list. The PPID is set to 0 because the rootkit may have corrupted the parent pointer or the process was spawned outside the normal CreateProcess flow, bypassing the standard parent-child relationship.

Answer

The process is a child of the System process (PID 4) but Volatility misreported it

Answer

The process belongs to a different session and Volatility failed to resolve the parent

Answer

The process is a legitimate system process that was started during boot

Question 15

A forensic analyst is investigating a compromised Linux server running an ext4 file system. The analyst suspects the attacker deleted critical log files (e.g., /var/log/auth.log) and wants to recover them. Which TWO techniques would be MOST effective for recovering the deleted files?

Accepted Answer

Running `extundelete` on the partition. `extundelete` is specifically designed to recover deleted files from ext3/ext4 file systems by scanning the journal and inode tables for metadata that still references the file's data blocks. Since the attacker deleted critical log files like `/var/log/auth.log`, this tool can often restore them if the blocks have not been overwritten.

Answer

Checking the `.Trash-1000` folder

Answer

Restoring from the `lost+found` directory

Answer

Executing `dd if=/dev/sda1 of=image.dd` and analyzing with `strings`