CHFI Storage Forensics and File System Analysis Practice Question
A forensic investigator analyzing a RAID 5 array of three disks notices that one disk has failed. Can the investigator still reconstruct the data?
⚠ Common exam trap
Test-takers frequently confuse RAID 5 with RAID 4 (which uses a dedicated parity disk) or incorrectly assume that all disks must be present for data access, when in fact RAID 5 is fault-tolerant to a single disk failure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Yes, using the parity information from the remaining disks
RAID 5 uses distributed parity across all disks in the array. When one disk fails, the data can be reconstructed by XORing the data and parity from the remaining disks. Since the parity is spread across all disks (not a dedicated parity disk), the investigator can rebuild the missing data as long as the remaining disks are functional.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Yes, using the parity information from the remaining disks
Why this is correct
RAID 5 uses a distributed parity scheme in which data and parity are interleaved across every disk in the array. If any single disk fails, the missing data can be reconstructed on-the-fly by reading the corresponding data and parity stripes from the two surviving disks and performing an XOR calculation. In a three-disk RAID 5, two remaining disks always provide enough information to rebuild the lost stripe, allowing the array to continue operating in a degraded state until the failed disk is replaced.
- ✗
No, RAID 5 requires all disks to be present
Why it's wrong here
The assertion that RAID 5 requires all disks to be present is incorrect because RAID 5 is specifically designed to tolerate a single disk failure without losing access to data. The storage controller or software RAID driver can service reads and writes by logically recreating the missing block from the surviving disks' data and parity on demand. After the failed disk is installed, the controller performs a background rebuild, but until then the array continues to function correctly in degraded mode with one disk absent.
- ✗
Yes, but only if the failed disk is the parity disk
Why it's wrong here
This answer reflects a misconception that RAID 5 includes a dedicated parity disk, but RAID 5 actually distributes parity blocks evenly across all member disks. Therefore, no single disk is exclusively the 'parity disk'; each disk contains a mix of data and parity for different stripe ranges. Since parity exists on every disk, the loss of any one disk—no matter which one—can be recovered using the combination of data and parity on the other two disks, so recovery is not conditional on which disk failed.
- ✗
No, because RAID 5 does not support hot swapping
Why it's wrong here
Hot swapping is a capability of the drive enclosure and controller to safely remove and replace a disk while the server is running; it is not a requirement for RAID 5's data reconstruction logic. Even if the system must be powered down to swap the drive, the RAID controller still uses the parity data on the surviving disks to reconstruct the missing drive's contents during the subsequent rebuild. Thus, the absence of hot-swap support has no bearing on the fundamental ability to recover data from the remaining disks after a single disk failure.
Quick reference
RAID Level Comparison
| RAID Level | Min Disks | Fault Tolerance | Read | Write | Usable Capacity |
|---|---|---|---|---|---|
| RAID 0 | 2 | None | Excellent | Excellent | 100% |
| RAID 1 | 2 | 1 disk | Good | Moderate | 50% |
| RAID 5 | 3 | 1 disk | Good | Moderate | 67–94% |
| RAID 6 | 4 | 2 disks | Good | Lower | 50–88% |
| RAID 10 | 4 | 1 disk per mirror | Excellent | Good | 50% |
RAID is not a backup strategy — it protects against disk failure but not against accidental deletion, ransomware, or site-level events.
Go deeper
Related to this question
About these practice questions
One of 745 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.