CHFI Storage Forensics and File System Analysis Practice Question
A forensic analyst is examining a USB drive formatted with FAT32. A suspect claims they deleted a file several weeks ago. The analyst uses a carving tool but cannot recover the file. What is the MOST likely reason for the failed recovery?
⚠ Common exam trap
EC-Council often tests the misconception that file carving depends on file system metadata (like MFT or directory entries), when in fact carving works at the raw data level and fails primarily due to data overwriting.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The file clusters were overwritten by new data
File carving relies on finding the file's content clusters on disk, typically by scanning for file headers and footers. If the suspect deleted the file weeks ago, the clusters that held the file's data were likely marked as free in the FAT32 file allocation table and subsequently overwritten by new data written to the drive. This is the most common reason for carving failure on a FAT32 volume that has been in active use after deletion.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The file was encrypted and cannot be carved
Why it's wrong here
Encryption does not inherently destroy or remove a file's underlying byte sequence; it transforms it into ciphertext. Forensic carving tools operate on raw disk sectors and look for file signatures or entropy patterns, so they can still extract the encrypted data blocks. The recovered artifact would be unreadable without the key, but carving itself is not prevented by encryption. Therefore this cannot explain why the file could not be carved.
- ✗
FAT32 does not support file carving
Why it's wrong here
FAT32 is a filesystem layer; file carving reads the raw device and identifies files by their magic bytes, headers, and footers, bypassing the filesystem entirely. Tools such as PhotoRec and foremost were explicitly designed to recover files from FAT, FAT32, exFAT, and other filesystems. FAT32's cluster-based allocation may cause fragmentation, which complicates contiguous carving, but it absolutely supports carving. The claim that FAT32 does not support file carving is false.
- ✗
The file was stored in the MFT, which is only present in NTFS
Why it's wrong here
The MFT (Master File Table) is a feature of NTFS, not FAT32; FAT32 stores file metadata in directory entries and uses the File Allocation Table for cluster chains. Since the drive is formatted with FAT32, there is no MFT in which the file could have resided. Even on NTFS, MFT-resident data occurs only for very small files, and it has nothing to do with a file being unrecoverable by carving.
- ✓
The file clusters were overwritten by new data
Why this is correct
File carving succeeds only when the original data content still physically exists on the media, typically in unallocated space. If the drive continued to be used after the file was deleted, the clusters that once held the file may have been reallocated and overwritten with new data. Overwriting destroys the original byte pattern, so there is nothing left for carving algorithms to recover. This is the correct reason a file may be un-carveable even though carving itself remains possible.
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 745-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.