CHFI Malware Forensics Practice Question
Exhibit
Refer to the exhibit. C:\> fls -f ntfs -o 2048 image.dd r/r 4-128-3: $AttrDef r/r 8-128-2: $BadClus r/r 6-128-2: $Bitmap r/r 7-128-1: $Boot r/r 11-128-3: $Extend r/r 2-128-1: $LogFile r/r 0-128-1: $MFT r/r 1-128-1: $MFTMirr r/r 9-128-8: $Secure r/r 10-128-1: $UpCase r/r 3-128-3: $Volume r/r 108-128-2: Users r/r 109-128-3: ProgramData r/r 110-128-2: Windows r/r 111-128-1: Program Files r/r 112-128-1: Program Files (x86) V/V 113-128-1: $OrphanFiles r/r 114-128-3: autoexec.bat r/r 115-128-1: config.sys
Refer to the exhibit. An investigator is examining a disk image using TSK. The output from 'fls' shows the directory structure. What is the significance of the entry 'V/V 113-128-1: $OrphanFiles'?
⚠ Common exam trap
The CHFI exam often tests the distinction between native NTFS metadata files (like $MFT, $Bitmap) and TSK virtual artifacts (like $OrphanFiles), so candidates mistakenly treat $OrphanFiles as a real NTFS system file rather than a forensic tool's reconstruction.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It is a virtual directory that contains files with no parent directory, often from deleted files
In The Sleuth Kit (TSK), the 'fls' command lists files and directories within a disk image. The entry 'V/V 113-128-1: $OrphanFiles' is a virtual directory that contains files that have no parent directory in the file system, typically because their directory entries were deleted or corrupted. This is a common artifact when recovering deleted files from NTFS volumes, as TSK collects such orphaned MFT entries into this virtual container.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It is a sign that a rootkit has hidden files in the image
Why it's wrong here
The presence of $OrphanFiles is a routine artifact produced by file-system analysis tools (such as The Sleuth Kit) when they encounter file records that are not referenced by any directory entry. It reflects the state of the disk after deletion or corruption of directory structures, not any active concealment by a rootkit. Rootkit file-hiding typically relies on kernel-mode API hooking or direct manipulation of MFT attributes, which would not generate a virtual directory with that canonical name in a forensic image.
- ✗
It indicates the location of the Master File Table (MFT) mirror
Why it's wrong here
$OrphanFiles is not a pointer to or an indicator of the Master File Table (MFT) mirror. On NTFS, the MFT mirror is anchored at the file named $MFTMirr (metadata file number 1), which is a redundant copy of the first few MFT records stored near the middle of the volume. In contrast, $OrphanFiles is a conceptual virtual directory that forensic tools construct to present orphaned MFT entries, and it has no corresponding on-disk metadata file or location.
- ✓
It is a virtual directory that contains files with no parent directory, often from deleted files
Why this is correct
In tools like The Sleuth Kit (tsk) and Autopsy, the virtual directory named $OrphanFiles (or displayed as 'V/V') is not a literal directory stored on the disk. It is dynamically generated to represent files whose MFT entries exist but whose parent directory references were lost, typically because the directory entry was deleted, overwritten, or corrupted while the file record itself remains in the MFT. This commonly occurs after a file is deleted, when the directory index entry is removed but the file's MFT record is not yet reused, or after a malformed directory entry prevents normal linkage in the tree.
- ✗
It is a standard NTFS metadata file that stores file permissions
Why it's wrong here
$OrphanFiles is not one of the standard NTFS metadata files such as $MFT, $LogFile, or $Secure. Standard NTFS metadata files reside in the MFT with fixed record numbers and specific system-defined purposes, such as tracking security descriptors or the volume's file list. $OrphanFiles is not present on the volume at all; it is a synthetic grouping created by forensic software to aid the examiner in reviewing unlinked file records, so it does not store file permissions or any other metadata.
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.