CHFI OS and File System Forensics — 20 Questions

Question 1

During a forensic investigation of a compromised Linux server, an investigator needs to recover deleted files from an ext4 filesystem. Which method should the investigator use to maximize recovery of file content, considering the filesystem may have been partially overwritten?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use 'foremost' to carve files based on file headers and footers.. Both foremost and scalpel are file carving tools that recover data by scanning raw disk blocks for known file signatures (headers and footers). The condition 'filesystem may have been partially overwritten' suggests metadata may be unusable, so carving is appropriate. The explanation only justifies foremost but fails to differentiate it from scalpel, which performs essentially the same function. Therefore, both A and C are correct.

Answer

Use 'grep -a' to search the raw disk for file signatures.

Answer

Use 'extundelete' to recover files from the ext4 filesystem.

Question 2

Which TWO of the following are valid locations in a Windows system where forensic evidence of USB device connection can be found?

Accepted Answer

SYSTEM\CurrentControlSet\Enum\USBSTOR registry key. The SYSTEM\CurrentControlSet\Enum\USBSTOR registry key is a primary location where Windows records every USB storage device that has been connected to the system. Each device is listed under this key with a unique instance ID, including the vendor ID, product ID, and serial number, providing persistent evidence of USB connections even after the device is removed.

Answer

Amcache.hve file

Answer

Event Logs with source 'Device Setup'

Answer

C:\Windows\Prefetch folder

Question 3

Drag and drop the steps to perform a forensic analysis of a Windows registry using RegRipper into the correct order.

Accepted Answer

Acquire registry hives, then run RegRipper with profiles, then analyze reports, then correlate findings. Registry analysis requires acquiring hives, running RegRipper with profiles, and correlating results.

Answer

Run RegRipper with profiles, then acquire registry hives, then analyze reports, then correlate findings

Answer

Acquire registry hives, then analyze reports, then run RegRipper with profiles, then correlate findings

Answer

Correlate findings, then acquire registry hives, then run RegRipper with profiles, then analyze reports

Question 4

Match each forensic acquisition method to its description.

Accepted Answer

Live Acquisition: Acquisition performed on a running system to capture volatile data.. Live acquisition captures volatile data from a running system, dead acquisition captures non-volatile data from a powered-off system, logical acquisition captures file structure only, and physical acquisition captures the entire device. Common confusions include swapping live and dead, or logical and physical.

Answer

Live Acquisition: Acquisition that captures only the files and folders.

Answer

Dead Acquisition: Acquisition performed on a running system.

Question 5

A forensic analyst is examining a Windows 10 system and needs to determine the last boot time of the system. Which registry hive and key should the analyst query to find this information?

Accepted Answer

SYSTEM hive, key 'CurrentControlSet\Control\Windows\', value 'ShutdownTime'. The SYSTEM hive stores system-wide configuration data, and the key 'CurrentControlSet\Control\Windows\' contains the 'ShutdownTime' value, which records the last system shutdown time. Since the last boot time is effectively the time after the last shutdown, querying this value provides the necessary information. This is a standard forensic artifact for determining system uptime and boot events on Windows 10.

Answer

NTUSER.DAT hive, key 'Control Panel\Desktop\'

Answer

SOFTWARE hive, key 'Microsoft\Windows NT\CurrentVersion\'

Answer

SAM hive, key 'SAM\Domains\Account\Users\'

Question 6

During a forensic investigation, an analyst needs to preserve the integrity of evidence on a hard drive. Which of the following is the best practice for acquiring an image of the drive?

Accepted Answer

Use a hardware write blocker and create a bit-stream image.. Using a hardware write blocker ensures that no write commands from the forensic workstation reach the suspect drive, preserving its integrity at the physical level. Creating a bit-stream image (sector-by-sector copy) captures all data, including slack space and unallocated clusters, which is essential for thorough forensic analysis. This combination is the gold standard in digital forensics, as mandated by best practices like those from NIST and the ACPO principles.

Answer

Use the 'dd' command to create a raw image without a write blocker.

Answer

Connect the drive to a forensic workstation and use the operating system's copy command.

Answer

Format the drive before imaging to ensure no hidden data is missed.

Question 7

You are a forensic investigator responding to a security incident at a medium-sized company. The incident involved an attacker gaining unauthorized access to a Windows Server 2019 system. The server was taken offline by the IT team immediately after detection. Your task is to acquire forensic evidence from the server's hard drive. The server has a single 500 GB NTFS partition. You have a forensic workstation with a write blocker, a SATA-to-USB adapter, and a forensic imaging tool that supports both dd and EWF (E01) formats. The server is still physically in the server room, and the IT team has powered it off. You need to create a forensic image that preserves the integrity of the evidence and allows for efficient analysis. Which of the following is the most appropriate course of action?

Accepted Answer

Remove the hard drive, connect it via a write blocker to the forensic workstation, and create an EWF (E01) image stored locally on the forensic workstation's internal drive.. It follows best practices for forensic acquisition: removing the hard drive and connecting it via a write blocker ensures that no data is altered during imaging. Using EWF (E01) format provides compression, metadata, and integrity checks (e.g., CRC32, MD5, SHA-1), which are essential for efficient analysis and evidence preservation. Storing the image locally on the forensic workstation avoids network latency and potential data corruption.

Answer

Boot the server using a forensic live CD, connect an external USB drive to the server, and use 'dd' to create a raw image on the external drive.

Answer

Use the server's built-in backup utility to create a system state backup and copy it to a network share.

Answer

Remove the hard drive, connect it via a write blocker to the forensic workstation, and then use 'dd' over a network connection to send the image to a remote server.

Question 8

During a forensic investigation of a Windows 10 system, you need to analyze the file system to recover deleted files. Which TWO file system artifacts would be most useful for this purpose?

Accepted Answer

$LogFile. $LogFile (A) records metadata changes to the NTFS volume, including transactions that can be replayed to recover file names and directory entries for recently deleted files. $MFT (C) contains the master file table entries for every file and directory; even after deletion, the MFT entry often remains until overwritten, allowing recovery of file attributes and data runs.

Answer

$Boot file

Answer

$Volume

Answer

$Bitmap

Question 9

A forensic analyst is reviewing the syslog from a compromised Linux server. Based on the exhibit, what does the 'orphan inode deleted' message indicate?

Accepted Answer

A file was deleted while still open, and the filesystem has cleaned up the orphan inode.. The 'orphan inode deleted' message in syslog indicates that a file was deleted while it was still open by a process. The kernel's inode cleanup mechanism (part of the VFS layer) detected the orphaned inode—an inode with no directory entry but still referenced by an open file descriptor—and removed it after the last file descriptor was closed. This is standard behavior in Linux filesystems (e.g., ext4) and is not indicative of hidden files, rootkits, or critical system file alerts.

Answer

A hidden file was permanently removed from the filesystem.

Answer

A rootkit has attempted to hide files by marking them as orphan inodes.

Answer

A critical system file has been deleted, and the filesystem is warning the administrator.

Question 10

You are a forensic investigator responding to an incident on a Windows 10 workstation used by a finance manager. The user reports that a critical spreadsheet containing quarterly budget data was accidentally deleted from the Desktop yesterday at approximately 3:00 PM. The system has been used normally since then, and the user has not emptied the Recycle Bin. You have created a forensic image of the drive using FTK Imager. The Recycle Bin contains a file named 'Quarterly_Budget.xlsx', but it appears to be a shortcut (size 1 KB). The user insists the original file was several megabytes. You need to recover the original file. Which action should you take next?

Accepted Answer

Search the $Recycle.Bin folder on the forensic image to locate the original file data, which may be stored under a different name.. When a file is moved to the Recycle Bin on Windows 10, the original file data is not stored in the Recycle Bin itself; instead, a hidden file (with a random name) is created in the `$Recycle.Bin` folder on the volume, and a shortcut (the visible entry) is placed in the Recycle Bin. The shortcut points to the hidden file, which retains the original data. Since the visible entry is only 1 KB, the actual file content must be located in the `$Recycle.Bin` folder under a different name, making option A the correct next step.

Answer

Restore a previous version of the Desktop folder from Volume Shadow Copy.

Answer

Use file carving techniques to recover the file from unallocated space on the Desktop.

Answer

Check the Recycle Bin on the live system; the file should be there and can be restored.