CHFI Storage Forensics and File System Analysis Practice Question
A forensic investigator examines a hard drive and needs to recover deleted files. Which tool is specifically designed for file carving by scanning raw data for file headers and footers without relying on the file system?
⚠ Common exam trap
The CHFI exam often tests the distinction between file carving tools (Foremost) and forensic suites (Autopsy, FTK Imager) or memory analysis tools (Volatility), trapping candidates who confuse a tool's primary function with its ancillary features.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Foremost
Foremost is a file carving tool that scans raw disk data for known file headers and footers (e.g., JPEG, PDF, ZIP) to recover files independently of the file system metadata. This makes it ideal when the file system is damaged or deleted, as it relies solely on content signatures rather than directory structures.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Foremost
Why this is correct
Foremost is a classic file-carving utility that scans raw byte streams (such as a dd or E01 image) for known file signatures—e.g., JPEG headers 0xFFD8FF, PNG, ZIP—and extracts the intervening data as a reconstructed file. Because it operates directly on unallocated space and does not depend on filesystem metadata (MFT, inodes, directory entries), it can recover deleted files no longer listed in any index. It is driven by a configuration file defining the signatures and can use internal structural hints, such as embedded length fields, to improve recovery accuracy.
- ✗
Volatility
Why it's wrong here
Volatility is a memory forensics framework that analyses RAM dumps for artefacts such as running processes and network connections, not a file-carving tool. It fails the scenario because it operates on volatile memory, not raw disk data, and cannot scan for file headers and footers to reconstruct deleted files from a hard drive. It is tempting because it is a powerful tool for extracting evidence from system memory, which would be the correct choice when investigating live system activity or malware execution rather than recovering deleted disk files.
- ✗
Autopsy
Why it's wrong here
Autopsy is an open-source digital forensics platform with a graphical interface that organizes evidence from a disk image for analysis, timeline creation, artifact extraction, and keyword search. It does not perform low-level file carving itself; instead, it invokes third-party carving tools such as Foremost or PhotoRec through its modules/plugins. Because the scenario specifically calls for a signature-based raw carving utility, Autopsy is not the correct answer—it is an analysis suite that layers filesystem interpretation and GUI overhead on top of carving backends.
- ✗
FTK Imager
Why it's wrong here
FTK Imager creates bit-for-bit forensic images (e.g., E01, dd) and mounts or previews acquired drives to explore directories, export files, and capture live memory. While it can extract deleted files by walking file-system structures and can preserve unallocated space, it does not scan raw disk data for file signatures or perform header/footer carving; its deleted-file recovery is metadata-driven and will miss files whose directory entries or MFT records are absent. Thus it fails the file-carving requirement even though it is a common tool for acquiring the raw image that a carver would later process.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CHFI question from scratch — 205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.