Courseiva
Storage Forensics and File System AnalysiseasyMultiple ChoiceObjective-mapped

CHFI Storage Forensics and File System Analysis Practice Question

A forensic investigator examines a hard drive and needs to recover deleted files. Which tool is specifically designed for file carving by scanning raw data for file headers and footers without relying on the file system?

⚠ Common exam trap

The CHFI exam often tests the distinction between file carving tools (Foremost) and forensic suites (Autopsy, FTK Imager) or memory analysis tools (Volatility), trapping candidates who confuse a tool's primary function with its ancillary features.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Foremost

Foremost is a file carving tool that scans raw disk data for known file headers and footers (e.g., JPEG, PDF, ZIP) to recover files independently of the file system metadata. This makes it ideal when the file system is damaged or deleted, as it relies solely on content signatures rather than directory structures.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Foremost

    Why this is correct

    Foremost is a classic file-carving utility that scans raw byte streams (such as a dd or E01 image) for known file signatures—e.g., JPEG headers 0xFFD8FF, PNG, ZIP—and extracts the intervening data as a reconstructed file. Because it operates directly on unallocated space and does not depend on filesystem metadata (MFT, inodes, directory entries), it can recover deleted files no longer listed in any index. It is driven by a configuration file defining the signatures and can use internal structural hints, such as embedded length fields, to improve recovery accuracy.

  • Volatility

    Why it's wrong here

    Volatility is a memory forensics framework that analyses RAM dumps for artefacts such as running processes and network connections, not a file-carving tool. It fails the scenario because it operates on volatile memory, not raw disk data, and cannot scan for file headers and footers to reconstruct deleted files from a hard drive. It is tempting because it is a powerful tool for extracting evidence from system memory, which would be the correct choice when investigating live system activity or malware execution rather than recovering deleted disk files.

  • Autopsy

    Why it's wrong here

    Autopsy is an open-source digital forensics platform with a graphical interface that organizes evidence from a disk image for analysis, timeline creation, artifact extraction, and keyword search. It does not perform low-level file carving itself; instead, it invokes third-party carving tools such as Foremost or PhotoRec through its modules/plugins. Because the scenario specifically calls for a signature-based raw carving utility, Autopsy is not the correct answer—it is an analysis suite that layers filesystem interpretation and GUI overhead on top of carving backends.

  • FTK Imager

    Why it's wrong here

    FTK Imager creates bit-for-bit forensic images (e.g., E01, dd) and mounts or previews acquired drives to explore directories, export files, and capture live memory. While it can extract deleted files by walking file-system structures and can preserve unallocated space, it does not scan raw disk data for file signatures or perform header/footer carving; its deleted-file recovery is metadata-driven and will miss files whose directory entries or MFT records are absent. Thus it fails the file-carving requirement even though it is a common tool for acquiring the raw image that a carver would later process.

About these practice questions

Courseiva writes every CHFI question from scratch — 205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.