CHFI Storage Forensics and File System Analysis Practice Question
An investigator needs to recover a deleted partition from a disk that originally used an MBR partition table. Which tool can scan the disk for lost partitions and rebuild the partition table?
⚠ Common exam trap
Candidates often confuse PhotoRec (file recovery) with TestDisk (partition recovery), assuming both tools perform the same function, when in fact PhotoRec only recovers files and cannot rebuild partition tables.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
TestDisk
TestDisk is specifically designed for data recovery and can scan a disk for lost partitions by analyzing the underlying MBR (Master Boot Record) structure. It can rebuild the partition table by searching for partition boot sectors and file system signatures, allowing recovery of deleted or corrupted partitions. This makes it the correct tool for the scenario described.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
TestDisk
Why this is correct
TestDisk is a specialized partition recovery utility that scans raw disk media for the signatures of missing or deleted partition entries, then rebuilds the Master Boot Record (MBR) or GUID Partition Table (GPT) so the original logical volumes become accessible again. Unlike file carvers, it restores the partition-level addressing that the operating system needs before any filesystem or file-level analysis can proceed. This makes it the correct tool when the goal is recovering a deleted partition rather than individual files.
- ✗
FTK Imager
Why it's wrong here
FTK Imager is a forensic acquisition and preview tool that creates bit-for-bit disk images, mounts existing images, and exports files from filesystems, but it does not perform low-level partition table reconstruction. It can capture the entire disk or a partition as evidence, yet it relies on the partition metadata being present and valid to enumerate volumes. Consequently, after a partition is deleted, FTK Imager lacks the scanning algorithms to rediscover the lost partition boundaries and rewrite the partition structure.
- ✗
Autopsy
Why it's wrong here
Autopsy is an open-source digital forensics platform that ingests disk images and applies modules for file recovery, timeline analysis, keyword search, and hash matching, but all of these functions operate on filesystems already recognized by the underlying Sleuth Kit. It does not have a component to scan raw sectors for partition table signatures or rebuild MBR/GPT entries; instead, it assumes the partition layout is intact. Therefore, a deleted partition would be invisible to Autopsy unless the partition was recreated first with a dedicated recovery tool.
- ✗
PhotoRec
Why it's wrong here
PhotoRec is a file carving utility that scans raw blocks for characteristic file headers and footers to reassemble files such as JPEGs, PDFs, and archives independent of any filesystem structure, but it cannot reconstruct the partition table that organizes the disk into logical volumes. Carving operates on the raw byte stream and preserves individual files, yet it does not recover the partition entry that tells the OS where a volume begins and ends. So PhotoRec could extract data after a partition is lost, but it is not a partition recovery tool.
Go deeper
Related to this question
About these practice questions
One of 205 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.