CHFI Storage Forensics and File System Analysis Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  It encrypts all files on the C: drive

  Why it's wrong here

  The cipher /w command is exclusively a utility for overwriting unallocated disk space, not for encryption. While the cipher utility can encrypt or decrypt files and directories when used with /E or /D, the /w switch performs a different function entirely: it writes over freespace on the selected volume. Therefore, the claim that cipher /w encrypts all files on the C: drive is incorrect; it does not alter the encrypted state of any existing data.

• ✓

  It wipes free space, hindering recovery of deleted files

  Why this is correct

  When you delete a file, its data blocks are merely marked as available, leaving the underlying bytes on the physical disk. The cipher /w command systematically overwrites these free-space regions with a sequence of patterns (e.g., 0x00, 0xFF, and random data) to ensure that remnants of deleted files are no longer recoverable through forensic tools. This process directly impedes recovery by destroying the residual data that would otherwise remain on the drive, which is why this is the correct description of the command's purpose.

• ✗

  It enables file system journaling

  Why it's wrong here

  File system journaling is a native feature of filesystems such as NTFS, which uses a change journal or log to track metadata and file changes for crash recovery. The cipher /w command has no interaction with journaling mechanisms; it operates at the raw disk level, writing data to free space without altering filesystem metadata or enabling any logging functionality. Since journaling is an inherent filesystem property rather than something a command can activate, this option is factually incorrect.

• ✗

  It removes alternate data streams from files

  Why it's wrong here

  Alternate Data Streams (ADS) are NTFS metadata structures that allow additional named data streams to be attached to a file, and they are not specifically addressed by the cipher /w command. The /w switch targets free disk space only, not the contents of active files or their associated streams. While overwriting may incidentally affect data blocks that contain streams if those blocks are in unallocated space, cipher /w does not proactively scan for or remove alternate data streams from existing files, making this explanation inaccurate.

Go deeper

Related to this question