CHFI Storage Forensics and File System Analysis Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  TRIM increases the chance of recovering deleted files

  Why it's wrong here

  The TRIM command does the opposite of increasing recoverability: it instructs the SSD controller to invalidate the logical blocks associated with a deleted file. Once invalidated, those blocks are no longer returned via the host interface and are typically overwritten or erased during garbage collection. Forensic recovery tools that rely on carving slack space or unallocated clusters will find zeros or unmapped LBAs, so deleted data is less likely to be recovered.

• ✗

  TRIM causes wear leveling that spreads data across blocks, aiding recovery

  Why it's wrong here

  Wear leveling is a maintenance technique that spreads writes evenly across NAND flash cells to prevent premature wear; it does not preserve deleted data. TRIM works together with garbage collection by immediately invalidating deleted blocks so the controller can erase them, not move their contents to other blocks. Because TRIM erases or retires the underlying cells, spreading data via wear leveling actually destroys the residual data, making recovery less likely rather than aiding it.

• ✓

  TRIM invalidates deleted data blocks, making them unreadable and unrecoverable

  Why this is correct

  TRIM is an ATA command by which the operating system informs the SSD controller that specific logical block addresses are no longer in use. The controller marks those mappings as invalid, after which reads to those LBAs return zeros and the physical NAND pages are scheduled for erasure during garbage collection. This active invalidation means the original file data is not accessible through normal forensic acquisition tools, and often the cells are fully erased, leaving no recoverable remnants on the device.

• ✗

  TRIM has no effect on forensic analysis

  Why it's wrong here

  The claim that TRIM has no effect is incorrect because on modern systems TRIM is enabled by default for SSDs and is automatically issued upon file deletion. After a TRIM command, the affected logical block addresses become unmapped and read as zero, so unallocated space no longer contains the deleted file's content. Forensic analysis of such a device will show significantly less recoverable data than an equivalent HDD, demonstrating that TRIM has a major impact on evidence recovery.

Go deeper

Related to this question