CHFI Storage Forensics and File System Analysis Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Two disks failed simultaneously

  Why it's wrong here

  A simultaneous two-disk failure in RAID 5 is catastrophic, not a subtle corruption issue. RAID 5 provides fault tolerance for exactly one disk failure; if a second disk fails before the first is rebuilt, the array loses all data and typically goes offline or is reported as 'failed' by the controller. This would appear as a missing logical drive, not as corrupted data or a rebuild error, so it cannot explain the investigator's symptom.

• ✓

  The replacement disk is smaller than the original

  Why this is correct

  RAID 5 requires all member disks to have identical usable capacity, and the controller maps data across disks based on that fixed geometry. If the replacement disk is physically or logically smaller than the original, the controller cannot reconstruct the missing disk's full block range, causing rebuild I/O errors that may corrupt the logical drive or abort the rebuild entirely. This is a classic cause of apparent data corruption after a disk replacement, because the array's own metadata and data layout become inconsistent with the replacement disk's reduced sector count.

• ✗

  The file system is not supported by the RAID controller

  Why it's wrong here

  RAID controllers operate at the block abstraction layer and are completely file-system agnostic — they see arrays of logical blocks, not files or directories. The file system type (NTFS, ext4, HFS+, etc.) is handled entirely by the operating system after the block device is presented, so an 'unsupported' file system would only prevent the OS from mounting the volume, never interfere with the RAID rebuild or cause underlying disk corruption. Consequently, this option is irrelevant to the reported array corruption.

• ✗

  The array was configured with an incorrect stripe size

  Why it's wrong here

  The stripe size (or stripe width) is a static parameter defined when the RAID array is created and stored in the controller's metadata; it determines how many bytes of consecutive data are written to each disk before switching to the next. An 'incorrect' stripe size does not arise during a routine rebuild — the controller uses the original stripe size recorded in its configuration, so there is no mechanism for it to corrupt data. Even if the stripe size were changed manually, the array would need to be recreated, a process that destroys data rather than merely corrupting it, so this cannot be the cause of a rebuild error.

Go deeper

Related to this question