Courseiva

CCNA Chfi Storage Filesystem Questions

35 questions · Chfi Storage Filesystem topic · All types, answers revealed

Practice these questionsExam hubAll questions
1
MCQmedium

An analyst notices that a file on an NTFS volume occupies 4096 bytes on disk but its actual data is only 100 bytes. The extra space contains remnants of a previously deleted file. What is this extra space called?

A.Volume slack
B.Free space
C.RAM slack
D.File slack
AnswerD

File slack is the unused area within the last allocated cluster of a file, spanning from the bytes beyond the logical end of the file to the physical end of that cluster, and it is composed of both RAM slack and the remaining sector space. On NTFS, these bytes are not zeroed when a file is written, so they may contain residual data from previously deleted files or older versions of the current file, making them a valuable forensic source. This exactly matches the analyst's observation of a file occupying 40 clusters where some space is unused, because that space remains attributed to the file's allocated cluster rather than to free or volume slack.

Why this answer

File slack is the unused space between the end of the actual file data and the end of the last allocated cluster for that file. On an NTFS volume with a 4096-byte cluster size, a 100-byte file leaves 3996 bytes of slack space, which may contain remnants of previously deleted files. This is why option D is correct.

Exam trap

The trap here is that candidates confuse file slack with volume slack or free space, not realizing that file slack is specifically the unused portion within a file's allocated cluster(s) that can still hold residual data from prior file writes.

How to eliminate wrong answers

Option A is wrong because volume slack refers to the unused space at the end of a volume (partition) after the last cluster, not within a file's allocated clusters. Option B is wrong because free space is unallocated disk space not assigned to any file, whereas the extra space described is allocated to the file but unused. Option C is wrong because RAM slack is the space between the end of the file data and the end of the sector (typically 512 bytes), not the full cluster slack; RAM slack is a subset of file slack that exists only in the last sector of a file.

Practice this question →
2
MCQhard

An analyst discovers a hidden partition on a hard drive that does not appear in the standard MBR partition table. The drive uses GPT partitioning. Which area of the disk should be examined to find evidence of a hidden partition?

A.The Master Boot Record (MBR) in sector 0
B.The GPT header and partition entry array located after the protective MBR
C.The Volume Boot Record (VBR) of the C: drive
D.The Host Protected Area (HPA) at the end of the disk
AnswerB

The GPT header and partition entry array located after the protective MBR are exactly where partition definitions live on a GUID Partition Table disk. The primary GPT header is at Logical Block Address 1 (right after the protective MBR in sector 0), and the partition entry array follows it; the header contains the partition table checksum and pointers to the entries, while the entries themselves (with unique GUIDs, start/end LBAs, and attributes) define each partition. A hidden partition may be deliberately omitted from the active partition table, but a forensic analyst scanning the entire disk for GPT-like structures—such as the header signature 'EFI PART' and backup headers at the end—can locate an alternate or stale partition entry array that reveals the hidden partition's existence and location.

Why this answer

In GPT partitioning, the protective MBR in sector 0 only contains a single partition entry of type 0xEE to prevent legacy tools from misinterpreting the disk. The actual partition information, including any hidden partitions, is stored in the GPT header (typically in sector 1) and the partition entry array that follows. Therefore, examining the GPT header and partition entry array is necessary to detect partitions not visible in the MBR.

Exam trap

EC-CHFI often tests the misconception that the MBR is the primary source of partition information on GPT disks, leading candidates to incorrectly choose Option A, when in fact the protective MBR is only a compatibility placeholder and the real partition data resides in the GPT structures.

How to eliminate wrong answers

Option A is wrong because the MBR in sector 0 on a GPT disk is a protective MBR that does not list actual partitions; it only contains a single entry of type 0xEE covering the entire disk, so hidden partitions cannot be found there. Option C is wrong because the Volume Boot Record (VBR) of the C: drive is a boot sector specific to a volume's file system (e.g., NTFS) and does not contain the disk's partition table; it is irrelevant for discovering hidden partitions. Option D is wrong because the Host Protected Area (HPA) is a reserved area at the end of the disk used by manufacturers for diagnostic tools, not a location where hidden GPT partitions are stored; GPT hidden partitions are defined within the GPT partition entry array.

Practice this question →
3
MCQmedium

During a forensic investigation of a hard disk, the investigator finds that the partition table is missing. The disk was previously partitioned using GPT. Which area of the disk should be examined to recover the GPT partition table?

A.Last sector of the disk
B.Volume boot record
C.Master Boot Record (LBA 0)
D.LBA 1 (sector 1)
AnswerD

The primary GPT header is stored at LBA 1 (sector 1), immediately following the protective MBR at LBA 0. This header contains the disk GUID, the location of the partition entry array (typically LBA 2–33), entry counts, CRC32 integrity checks, and pointers to the backup GPT at the last sector. Because the GPT layout specifically starts here, LBA 1 is the correct answer.

Why this answer

In GPT (GUID Partition Table) disks, the primary partition table is stored in LBA 1 (sector 1), immediately following the protective MBR at LBA 0. When the partition table is missing, examining LBA 1 allows recovery of the GPT header, which contains pointers to the partition entry array. This is the correct location because GPT uses LBA 1 for its header, not the last sector or the MBR.

Exam trap

The CHFI exam often tests the misconception that the GPT partition table is stored in the MBR (LBA 0) or the last sector, but the primary GPT header is specifically at LBA 1, while the backup is at the last sector.

How to eliminate wrong answers

Option A is wrong because the last sector of the disk stores the secondary (backup) GPT header, not the primary partition table; while it can be used for recovery, the question asks for the area to examine to recover the primary GPT partition table, which is not the last sector. Option B is wrong because the Volume Boot Record (VBR) is located within a partition (e.g., at the start of a volume) and contains boot code and BPB for that volume, not the GPT partition table. Option C is wrong because LBA 0 (Master Boot Record) in a GPT disk contains only a protective MBR (to prevent legacy tools from misidentifying the disk as unpartitioned) and does not store the GPT partition table itself.

Practice this question →
4
Multi-Selectmedium

Which TWO of the following are valid methods to hide data on an NTFS file system without using external tools?

Select 2 answers
A.Embedding data in file slack space
B.Storing data in the NTFS file system journal ($LogFile)
C.Using the $Volume attribute in the MFT
D.Encrypting data with EFS
E.Using Alternate Data Streams (ADS)
AnswersA, E

File slack is unused space at the end of a cluster that can be filled with data.

Why this answer

A is correct because file slack space is the unused bytes between the end of a file's logical data and the end of its allocated cluster. On NTFS, when a file does not fill its last cluster, the remaining bytes (RAM slack and drive slack) can be written to without affecting the file's visible content. This is a native hiding method that requires no external tools, as the data is simply written to the slack region using standard file I/O operations.

Exam trap

EC-CHFI often tests the misconception that NTFS journals or MFT attributes can be used for data hiding without external tools, but only slack space and Alternate Data Streams (ADS) are native, supported mechanisms that do not require third-party utilities.

Practice this question →
5
MCQhard

An analyst discovers that a Windows system has hidden data in the Host Protected Area (HPA) of the hard drive. Which tool or method can be used to detect and access the HPA?

A.Using the Windows Disk Management utility
B.Using the hdparm command in Linux with the -N flag
C.Using the Volatility framework
D.Using the chkdsk command
AnswerB

hdparm -N /dev/sda shows the user-accessible capacity vs. native capacity, revealing HPA.

Why this answer

The Host Protected Area (HPA) is a reserved region on ATA/ATAPI hard drives that is not visible to the operating system's standard disk utilities. The `hdparm` command in Linux with the `-N` flag is specifically designed to detect and modify the HPA by querying the drive's native max address, revealing hidden sectors. Windows Disk Management and other OS-level tools cannot access the HPA because it is hidden at the firmware level via the ATA SET MAX ADDRESS command.

Exam trap

The trap here is that candidates assume standard Windows utilities like Disk Management can see all drive areas, but the HPA is hidden at the firmware level and requires ATA command-level tools like hdparm to access.

How to eliminate wrong answers

Option A is wrong because Windows Disk Management only shows partitions visible to the OS and cannot detect the HPA, which is hidden at the ATA command level. Option C is wrong because the Volatility framework is a memory forensics tool for analyzing RAM dumps, not for low-level hard drive regions like the HPA. Option D is wrong because chkdsk checks file system integrity on visible partitions and has no capability to interact with ATA commands that control the HPA.

Practice this question →
6
MCQmedium

A forensic investigator recovers a hard drive from a suspect's computer. The drive is detected as 120 GB in BIOS, but forensic tools report only 100 GB of addressable space. Which data hiding technique is MOST likely being used?

A.Device Configuration Overlay (DCO)
B.Volume slack
C.Host Protected Area (HPA)
D.Alternate Data Streams (ADS)
AnswerC

Host Protected Area (HPA) is an ATA feature that uses the SET MAX ADDRESS command to lower the drive's reported maximum address, causing all sectors beyond that boundary to become inaccessible to the operating system and BIOS. This effectively hides data in the protected area at the end of the physical disk, which is exactly the kind of capacity mismatch that forensic acquisition tools detect by comparing the native maximum address against the current maximum. HPA is the correct answer because it directly addresses the hardware-level capacity reduction described.

Why this answer

The Host Protected Area (HPA) is a region on a hard drive that is hidden from the operating system by using the ATA SET MAX ADDRESS command to reduce the reported addressable space. Since the BIOS detects the full 120 GB but forensic tools see only 100 GB, the HPA is the most likely technique, as it creates a hidden area beyond the reported maximum LBA that is not visible to standard forensic acquisition tools unless specifically addressed.

Exam trap

The trap here is that candidates confuse HPA with DCO, but the key differentiator is that DCO hides space from the BIOS as well, while HPA allows the BIOS to see the full drive but hides space from the OS and forensic tools.

How to eliminate wrong answers

Option A is wrong because Device Configuration Overlay (DCO) is a feature that allows the drive manufacturer to hide the entire drive or a portion of it from the BIOS and OS, but here the BIOS correctly detects 120 GB, ruling out DCO. Option B is wrong because volume slack refers to unused space at the end of a volume that is not part of any partition, but it does not reduce the total addressable space reported by forensic tools; it is a byproduct of partition alignment, not a deliberate hiding technique. Option D is wrong because Alternate Data Streams (ADS) are a feature of NTFS that allow data to be hidden within a file's metadata, but they do not affect the total addressable space of a hard drive; they operate at the file system level, not the disk geometry level.

Practice this question →
7
MCQhard

A forensic examiner is analyzing a RAID 5 array consisting of three disks. One disk has failed and is not available. The remaining two disks contain data and parity. Which technique can be used to reconstruct the missing disk's data and recover the original data?

A.Replace the failed disk and rebuild the array using the controller's rebuild function
B.Use dd to image the two disks, then perform a XOR operation on the data stripes to reconstruct the third disk's data
C.Use FTK Imager to create a logical image of each disk and merge them
D.Simply image the two disks and use file carving tools to extract files
AnswerB

XOR of data from two disks yields the missing data if parity is involved.

Why this answer

In a RAID 5 array with three disks, data and parity are striped across all disks. When one disk fails, the missing data can be reconstructed by performing an XOR operation on the corresponding stripes from the remaining two disks. This is because RAID 5 uses distributed parity where the parity block is the XOR of the data blocks in the same stripe, so XORing the surviving data and parity stripes recovers the lost data.

Exam trap

The CHFI exam often tests the misconception that RAID 5 can tolerate two disk failures or that simple imaging of surviving disks yields complete data without reconstruction, leading candidates to choose file carving or logical imaging options.

How to eliminate wrong answers

Option A is wrong because replacing the failed disk and using the controller's rebuild function is a hardware/administrative recovery method, not a forensic technique for reconstructing data from the remaining two disks when the failed disk is unavailable. Option C is wrong because FTK Imager's logical imaging merges file system metadata, not raw stripe-level data, and cannot reconstruct missing RAID 5 data without understanding the stripe layout and parity. Option D is wrong because simply imaging two disks and using file carving tools will only recover files that are contiguous and not split across stripes, and cannot reconstruct data that was solely on the failed disk.

Practice this question →
8
MCQeasy

A forensic investigator examines a hard drive and needs to recover deleted files. Which tool is specifically designed for file carving by scanning raw data for file headers and footers without relying on the file system?

A.Foremost
B.Volatility
C.Autopsy
D.FTK Imager
AnswerA

Foremost is a classic file-carving utility that scans raw byte streams (such as a dd or E01 image) for known file signatures—e.g., JPEG headers 0xFFD8FF, PNG, ZIP—and extracts the intervening data as a reconstructed file. Because it operates directly on unallocated space and does not depend on filesystem metadata (MFT, inodes, directory entries), it can recover deleted files no longer listed in any index. It is driven by a configuration file defining the signatures and can use internal structural hints, such as embedded length fields, to improve recovery accuracy.

Why this answer

Foremost is a file carving tool that scans raw disk data for known file headers and footers (e.g., JPEG, PDF, ZIP) to recover files independently of the file system metadata. This makes it ideal when the file system is damaged or deleted, as it relies solely on content signatures rather than directory structures.

Exam trap

The CHFI exam often tests the distinction between file carving tools (Foremost) and forensic suites (Autopsy, FTK Imager) or memory analysis tools (Volatility), trapping candidates who confuse a tool's primary function with its ancillary features.

How to eliminate wrong answers

Option B (Volatility) is wrong because it is a memory forensics framework for analyzing RAM dumps, not a file carving tool for hard drives. Option C (Autopsy) is wrong because it is a digital forensics platform that relies on file system analysis and does not perform raw file carving by default; it uses tools like Foremost as plugins. Option D (FTK Imager) is wrong because it is primarily a disk imaging and preview tool that preserves file system metadata, not a dedicated file carver that scans raw data for headers and footers.

Practice this question →
9
MCQeasy

An investigator needs to recover deleted files from a USB drive formatted with FAT32. Which of the following techniques would be most effective, assuming the files have not been overwritten?

A.Check the journal for recent changes
B.Examine the FAT for unallocated clusters and reconstruct files
C.Analyze the $MFT for orphaned entries
D.Use the 'foremost' tool to carve based on file signatures
AnswerB

Correct. FAT32's File Allocation Table stores cluster chains. Deleted files have their FAT entries zeroed but data clusters remain. Examining the FAT for unallocated clusters and reconstructing from the directory entry's starting cluster and size allows recovery if not overwritten.

Why this answer

FAT32 does not have a journal (eliminating A). The Master File Table ($MFT) is used by NTFS, not FAT32 (eliminating C). While file carving with tools like 'foremost' (D) can recover files based on signatures, it is less effective for deleted files on FAT32 because it may fail to recover fragmented files and does not leverage the file system's own structure.

The most effective technique is to examine the File Allocation Table (FAT) for unallocated clusters and reconstruct the files from the directory entry's starting cluster and size (B), assuming the clusters have not been overwritten. This uses the file system metadata to directly locate the file's data.

Exam trap

A common trap is to assume that file carving (D) is always the best method. However, when the file system is intact and the metadata is available, analyzing the FAT provides a more reliable and efficient recovery. Also, note that FAT32 lacks a journal (A) and does not use $MFT (C).

How to eliminate wrong answers

Option A is wrong because FAT32 does not have a journal; journaling is a feature of NTFS (via $LogFile) and ext3/4, not FAT32. Option C is wrong because the $MFT (Master File Table) is a component of NTFS, not FAT32; FAT32 uses directory entries and the FAT, not an MFT. Option D is wrong because while 'foremost' is a valid file carving tool that works on any file system by searching for file signatures (headers/footers), it is a generic data carving technique that does not leverage the file system's metadata (like the FAT) to reconstruct files; it is less reliable for fragmented files and does not use the FAT's cluster chain information, making it less effective than option B for FAT32 recovery.

Practice this question →
10
Multi-Selectmedium

Which THREE of the following are types of slack space that can contain hidden data on a hard disk?

Select 3 answers
A.Device Configuration Overlay
B.Host Protected Area
C.File slack
D.Volume slack
E.RAM slack
AnswersC, D, E

File slack is the unused space between the end of a file and the end of the last cluster.

Why this answer

File slack (C) is correct because it refers to the unused space between the end of a file's data and the end of the allocated cluster. This area can contain remnants of previous file data or intentionally hidden data, and is a standard forensic artifact in file system analysis (e.g., NTFS or FAT).

Exam trap

The EC-Council CHFI exam often tests the distinction between hidden disk areas (like HPA and DCO) and true slack space types (file, volume, RAM slack), causing candidates to mistakenly classify HPA or DCO as slack space.

Practice this question →
11
MCQhard

During a forensic examination of a solid-state drive (SSD), you notice that files deleted several months ago cannot be recovered using traditional file carving tools. Which SSD feature is MOST likely preventing recovery?

A.TRIM
B.Over-provisioning
C.Garbage Collection
D.Wear levelling
AnswerA

TRIM is an ATA command that explicitly informs the SSD controller of pages that are no longer in use, prompting the controller to erase those physical blocks either immediately or during idle time. Because the erasure is performed at the flash level, the actual data is removed or invalidated, preventing recovery via file carving. This makes TRIM the critical factor that distinguishes SSD forensic examinations from HDD ones, as deleted files become inaccessible to software-based recovery tools.

Why this answer

The TRIM command (ATA Data Set Management command) allows the operating system to inform the SSD which data blocks are no longer in use. When TRIM is enabled, the SSD's controller immediately erases those blocks internally, making the original file data unrecoverable by file carving tools because the physical NAND cells are zeroed or marked as invalid. For files deleted months ago, TRIM would have already been issued for those LBAs, so traditional carving that relies on residual data in unallocated space fails.

Exam trap

EC-Council often tests the distinction between TRIM (an OS-to-SSD command that explicitly tells the drive to erase unused blocks) and Garbage Collection (a firmware-level process that may or may not erase data without TRIM), leading candidates to incorrectly choose Garbage Collection because they confuse background maintenance with the specific command that prevents recovery.

How to eliminate wrong answers

Option B (Over-provisioning) is wrong because over-provisioning reserves extra NAND capacity for performance and wear levelling, but it does not actively erase user-deleted data; it only provides spare blocks for the controller. Option C (Garbage Collection) is wrong because garbage collection consolidates valid data and erases stale blocks in the background, but it is triggered by the SSD's firmware and typically occurs after TRIM has marked blocks as invalid; without TRIM, garbage collection may not immediately erase deleted files. Option D (Wear levelling) is wrong because wear levelling distributes write/erase cycles across all NAND blocks to prolong drive life, but it does not intentionally erase user data; it moves data around and may incidentally overwrite old blocks, but it is not the primary mechanism preventing recovery of long-deleted files.

Practice this question →
12
MCQhard

An analyst retrieves a forensic image of a hard drive and discovers that the size reported by the operating system is smaller than the actual physical capacity. The extra space is not accessible through standard partition tools. This hidden area is MOST likely:

A.Device Configuration Overlay
B.Host Protected Area
C.Volume slack
D.RAM slack
AnswerB

Host Protected Area (HPA) is the correct answer because it is a hidden region created using the ATA Set Max Address command, which makes the operating system see a smaller disk than the physical platter actually contains. This area cannot be accessed through normal OS commands and is frequently used to conceal data for forensic analysis or other purposes. When an analyst observes that the OS-reported capacity is less than the physical drive size, the HPA is exactly the hidden area responsible for that discrepancy.

Why this answer

The Host Protected Area (HPA) is a region on a hard drive that is hidden from the operating system by using the ATA SET MAX ADDRESS command to reduce the reported capacity. This area is not accessible through standard partition tools because the OS sees only the reduced address space, making it ideal for storing forensic or diagnostic data. The analyst's observation of a smaller reported size than physical capacity directly matches HPA behavior.

Exam trap

EC-Council often tests the distinction between HPA and DCO, where candidates confuse the ATA commands (SET MAX ADDRESS vs. DEVICE CONFIGURATION) and incorrectly assume DCO is the primary hidden area when the symptom is a reduced OS-reported size.

How to eliminate wrong answers

Option A is wrong because a Device Configuration Overlay (DCO) is a separate hidden area created by the ATA DEVICE CONFIGURATION command that can be removed to reveal additional space, but it does not reduce the OS-reported size below physical capacity via a simple address limit like HPA. Option C is wrong because volume slack refers to unused space at the end of a partition that is still within the partition's logical boundaries and accessible via partition tools, not a hidden area beyond the OS-reported capacity. Option D is wrong because RAM slack is the unused space in the last sector of a file's allocated clusters that is filled with RAM contents, which is a file system concept unrelated to hard drive hidden areas.

Practice this question →
13
MCQmedium

During an investigation, an analyst recovers a file from unallocated space that contains fragments of a deleted document. The file size is 512 bytes, but the cluster size of the volume is 4096 bytes. What is the term for the unused bytes between the end of the file and the end of the last cluster?

A.Volume slack
B.Drive slack
C.File slack
D.RAM slack
AnswerC

File slack is the unused bytes from the logical end of a file to the end of the last cluster allocated to that file, and it is the correct location for recovered remnant data. It consists of RAM slack (up to the sector boundary) plus the remaining bytes in the trailing cluster, which are typically not zeroed by the filesystem. Because old data can persist there after a file is overwritten or deleted, forensic examiners regularly recover intact fragments from file slack.

Why this answer

File slack refers to the unused bytes between the end of a file and the end of the last cluster allocated to that file. In this scenario, the file is 512 bytes but resides in a 4096-byte cluster, leaving 3584 bytes of slack space. This area can contain remnants of previously deleted data or metadata, making it a critical forensic artifact.

Exam trap

EC-Council often tests the distinction between RAM slack and file slack, and the trap here is that candidates confuse 'file slack' with 'RAM slack' because both involve unused bytes, but file slack encompasses the entire cluster remainder, while RAM slack is only the sector-level portion.

How to eliminate wrong answers

Option A is wrong because volume slack is the unused space at the end of a volume or partition, not between the end of a file and its cluster boundary. Option B is wrong because drive slack is not a standard forensic term; it is often confused with volume slack or unallocated space on the entire drive. Option D is wrong because RAM slack specifically refers to the unused bytes between the end of a file and the end of the sector (typically 512 bytes) that are filled with RAM contents during a write operation, not the cluster-level slack described here.

Practice this question →
14
MCQeasy

During a forensic analysis of an NTFS volume, an investigator finds a file that appears to be hidden. Which NTFS feature allows data to be stored in a file without affecting the file's visible size in the directory listing?

A.Alternate Data Streams (ADS)
B.Volume Shadow Copy
C.USN Journal
D.Master File Table ($MFT)
AnswerA

Alternate Data Streams (ADS) are a legitimate NTFS feature that allow additional named data streams to be attached to a file, accessible via the syntax file.txt:stream. Because standard directory listings and file properties typically report only the primary unnamed stream, an investigator using conventional utilities may completely miss malicious payloads hidden in ADS. Forensic examiners must explicitly enumerate streams using specialized tools (e.g., streams.exe, lads, or forensic suites) and inspect the $MFT attribute list to identify these hidden data regions, as they are a classic anti-forensic hiding technique.

Why this answer

Alternate Data Streams (ADS) allow additional data to be attached to a file on an NTFS volume without altering the file's main data stream or its visible size in directory listings. This is possible because NTFS organizes file data into multiple streams; the default $DATA stream holds the visible content, while additional named streams can store hidden data. Tools like `dir` or Windows Explorer only report the size of the unnamed $DATA stream, making ADS an effective method for concealing data.

Exam trap

The CHFI exam often tests the misconception that the Master File Table ($MFT) is the primary location for hiding data, but the trap here is that ADS directly allows data to be stored in a file without changing its visible size, while $MFT manipulation (e.g., slack space) is a different, more complex technique.

How to eliminate wrong answers

Option B (Volume Shadow Copy) is wrong because it is a backup and recovery feature that creates point-in-time snapshots of volumes, not a mechanism for hiding data within a file without affecting its visible size. Option C (USN Journal) is wrong because it is a change journal that records modifications to files on an NTFS volume, used for tracking changes, not for storing hidden data. Option D (Master File Table ($MFT)) is wrong because it is the central directory structure that stores metadata about every file and folder, but it does not allow data to be hidden within a file without affecting its visible size; the $MFT itself can be a target for hiding data via techniques like slack space, but that is not the feature described.

Practice this question →
15
Multi-Selecthard

During a forensic analysis of an SSD, the analyst encounters challenges due to TRIM and wear-leveling. Which TWO statements accurately describe the impact of these features on data recovery?

Select 2 answers
A.TRIM immediately and permanently erases deleted file data at the block level
B.Wear-leveling can scatter fragments of a file across different NAND chips, complicating physical imaging
C.Both TRIM and wear-leveling are transparent to the operating system and have no impact on forensic analysis
D.Wear-leveling ensures that deleted files are overwritten with zeros to prevent forensic recovery
E.TRIM is only effective on HDDs, not SSDs
AnswersA, B

TRIM commands cause the SSD to erase blocks, preventing recovery.

Why this answer

A is correct because TRIM commands (ATA Data Set Management command) instruct the SSD controller to immediately erase invalidated logical block addresses (LBAs) at the block level, making the original data unrecoverable via standard forensic tools. This is not a simple deletion of file system metadata but a physical erasure of the underlying NAND flash cells, which prevents recovery of the file content even with advanced carving techniques.

Exam trap

EC-Council's CHFI exam often tests the misconception that TRIM is a file system operation or that wear-leveling actively sanitizes deleted data, when in reality TRIM is a hardware-level command and wear-leveling is a longevity mechanism that incidentally complicates forensic reconstruction.

Practice this question →
16
MCQmedium

During a forensic investigation, you need to acquire the RAM of a running Linux system. Which tool is specifically designed for memory acquisition on Linux?

A.Memdump
B.Volatility
C.WinPmem
D.LiME
AnswerD

LiME is the recommended tool for Linux memory acquisition.

Why this answer

LiME (Linux Memory Extractor) is the correct tool because it is specifically designed to capture volatile memory (RAM) from Linux systems, loading as a loadable kernel module (LKM) to dump memory contents to a file or over the network. Unlike generic tools, LiME handles kernel address space layout randomization (KASLR) and can acquire memory without altering the system state, making it the standard for Linux forensic memory acquisition.

Exam trap

The CHFI exam often tests the distinction between acquisition and analysis tools, so the trap here is that candidates confuse Volatility (an analysis tool) with a memory acquisition tool, or assume WinPmem works on Linux because of the 'pmem' name, when it is Windows-only.

How to eliminate wrong answers

Option A is wrong because Memdump is a generic term for memory dumping utilities and not a specific tool for Linux memory acquisition; it often refers to Windows-based tools or simple dd commands, lacking the kernel module approach needed for reliable Linux RAM capture. Option B is wrong because Volatility is a memory analysis framework used to examine memory dumps, not a tool for acquiring memory; it processes existing dumps but does not perform the acquisition itself. Option C is wrong because WinPmem is a memory acquisition tool designed exclusively for Windows systems, using the winpmem driver to access physical memory, and is not compatible with Linux.

Practice this question →
17
MCQhard

During a forensic examination of a solid-state drive (SSD), the analyst notices that the TRIM command was enabled. What challenge does this pose for data recovery?

A.It erases data blocks immediately after deletion, preventing recovery
B.It causes fragmentation, making file recovery more complex
C.It causes the drive to encrypt data automatically
D.It physically destroys the NAND cells, making the drive unusable
AnswerA

When the OS deletes a file on an SSD with TRIM enabled, it sends an ATA DATA SET MANAGEMENT command that instructs the controller to physically erase the involved NAND blocks right away, rather than simply marking the space as reusable in the file system. This immediate erasure means that the actual data cells are zeroed or invalidated, eliminating the possibility of recovery with conventional file carving or deep recovery tools, which rely on residual data. From a forensic perspective, TRIM effectively defeats many standard deleted-file recovery workflows on modern SSDs.

Why this answer

The TRIM command (ATA Data Set Management command) instructs the SSD controller to immediately erase the physical NAND blocks corresponding to deleted logical block addresses (LBAs). This proactive garbage collection operation resets the cells to an erased state, making it impossible for forensic tools to recover the original data from those blocks, as the data is physically overwritten with null values or marked as invalid.

Exam trap

The trap here is that candidates may confuse TRIM with wear leveling or assume it only affects performance, missing the critical forensic implication that TRIM permanently destroys deleted data at the physical NAND level, making recovery impossible even with advanced techniques like chip-off or JTAG.

How to eliminate wrong answers

Option B is wrong because TRIM does not cause fragmentation; in fact, TRIM helps maintain performance by allowing the SSD controller to optimize block allocation, reducing write amplification and fragmentation. Option C is wrong because TRIM is a command for block erasure, not encryption; SSDs may support hardware encryption (e.g., OPAL or eDrive), but TRIM itself does not encrypt data. Option D is wrong because TRIM does not physically destroy NAND cells; it simply marks blocks as invalid for garbage collection, and normal wear from program/erase cycles is what eventually degrades cells, not the TRIM command itself.

Practice this question →
18
MCQmedium

An investigator is examining a FAT32 filesystem and needs to recover a deleted file. In FAT32, the directory entry for a deleted file has the first byte of the filename set to 0xE5. What does this indicate?

A.The file is a system file
B.The file is hidden
C.The file is encrypted
D.The file has been deleted
AnswerD

In FAT32, when a file or directory is deleted, the first byte of its 8.3 directory entry is replaced with 0xE5, which serves as a deletion/free marker. This is why 0xE5 in the first byte of a directory entry is a reliable indicator that the file has been deleted (or the directory entry is free). The remainder of the entry—including the starting cluster number, file size, and timestamps—often remains unchanged until the entry is reused, which is what makes data recovery possible.

Why this answer

In FAT32, when a file is deleted, the directory entry's first byte (the filename's first character) is overwritten with the value 0xE5. This is a deliberate marker used by the file system to indicate that the entry is available for reuse, meaning the file has been logically deleted. The data clusters remain intact until overwritten, which is why recovery tools look for entries with this byte to restore deleted files.

Exam trap

The trap here is that candidates confuse the 0xE5 deletion marker with other attribute flags (like hidden or system) or assume it indicates encryption, because they memorize attribute bits but overlook the specific byte value used for deletion in FAT directory entries.

How to eliminate wrong answers

Option A is wrong because system files in FAT32 are marked by the 'System' attribute bit in the directory entry's attribute byte, not by the first byte of the filename being 0xE5. Option B is wrong because hidden files are indicated by the 'Hidden' attribute bit (0x02) in the attribute field, not by the filename's first byte. Option C is wrong because FAT32 does not support native file encryption; encryption is handled at the application or OS level (e.g., EFS on NTFS), and there is no filename byte marker for encryption in FAT32.

Practice this question →
19
MCQmedium

An investigator needs to recover a deleted partition from a disk that originally used an MBR partition table. Which tool can scan the disk for lost partitions and rebuild the partition table?

A.TestDisk
B.FTK Imager
C.Autopsy
D.PhotoRec
AnswerA

TestDisk is a specialized partition recovery utility that scans raw disk media for the signatures of missing or deleted partition entries, then rebuilds the Master Boot Record (MBR) or GUID Partition Table (GPT) so the original logical volumes become accessible again. Unlike file carvers, it restores the partition-level addressing that the operating system needs before any filesystem or file-level analysis can proceed. This makes it the correct tool when the goal is recovering a deleted partition rather than individual files.

Why this answer

TestDisk is specifically designed for data recovery and can scan a disk for lost partitions by analyzing the underlying MBR (Master Boot Record) structure. It can rebuild the partition table by searching for partition boot sectors and file system signatures, allowing recovery of deleted or corrupted partitions. This makes it the correct tool for the scenario described.

Exam trap

The trap here is that candidates often confuse PhotoRec (file recovery) with TestDisk (partition recovery), assuming both tools perform the same function, when in fact PhotoRec only recovers files and cannot rebuild partition tables.

How to eliminate wrong answers

Option B (FTK Imager) is wrong because it is a forensic imaging tool used to create bit-for-bit copies of drives and view file system contents, not to scan for lost partitions or rebuild partition tables. Option C (Autopsy) is wrong because it is a digital forensics platform that analyzes disk images and file systems, but it does not have native functionality to recover deleted partitions or rebuild MBR partition tables. Option D (PhotoRec) is wrong because it is a file carving tool that recovers individual files based on file signatures, not partitions; it operates at the file level, not the partition table level.

Practice this question →
20
MCQeasy

An analyst is examining a Windows 10 system and discovers a file in the $Recycle.bin folder with a name like '$RABCDEF.txt'. The analyst wants to recover the original file path and deletion date. Which forensic artifact should the analyst examine?

A.The corresponding $I file (e.g., $IABCDEF.txt) in $Recycle.bin
B.The Windows Event Logs
C.The USN journal
D.The $MFT entry for the $R file
AnswerA

The $I file in the $Recycle.bin folder is an index entry created when a file is deleted via Explorer; it stores the original file name, full path before deletion, and the deletion timestamp. Because the $R file is renamed to a random name, the $I file is the authoritative source for reconstructing the original location and time. Forensic tools parse $I files to recover this metadata directly.

Why this answer

The $I file (e.g., $IABCDEF.txt) in the $Recycle.bin folder is the index file that stores metadata about the deleted file, including the original file path, original size, and the date and time when the file was deleted. The $R file contains only the actual data content of the deleted file, not its metadata. Therefore, examining the corresponding $I file is the correct method to recover the original file path and deletion date.

Exam trap

EC-Council CHFI often tests the misconception that the $R file itself contains metadata like the original path or deletion date, when in fact the $R file is only the data content, and all metadata is stored exclusively in the corresponding $I file.

How to eliminate wrong answers

Option B is wrong because Windows Event Logs may record some deletion events (e.g., via Sysmon or auditing), but they do not reliably store the original file path and deletion date for every file moved to the Recycle Bin, and they are not the primary forensic artifact for this purpose. Option C is wrong because the USN journal records changes to files (e.g., rename, delete) but does not store the original file path or the exact deletion timestamp in a structured way that directly maps to the $R file; it is a change journal, not a metadata store for recycled files. Option D is wrong because the $MFT entry for the $R file only contains metadata about the $R file itself (e.g., its name, timestamps, data runs) but does not contain the original file path or the deletion date; the original path is stored only in the $I file's header.

Practice this question →
21
MCQhard

A forensic examiner finds a file on an NTFS volume that appears to have data hidden in its alternate data stream. The file's size is reported as 10 KB, but the volume's cluster size is 4 KB. How many clusters of file slack could potentially contain hidden data in the primary stream?

A.12 KB
B.4 KB
C.2 KB
D.0 KB
AnswerC

The file size is 10 KB, and NTFS uses 4 KB clusters on this volume. The file consumes two full clusters (8 KB) and then 2 KB of a third cluster, leaving 2 KB of slack in that final cluster. This remaining space is not part of the file size but is still allocated to the file, and it may contain remnants of previously stored data that a forensic examiner should analyze.

Why this answer

The file's primary stream occupies 10 KB, which requires 3 clusters (3 × 4 KB = 12 KB). The slack space is the unused portion of the last cluster: 12 KB - 10 KB = 2 KB. This 2 KB of file slack in the primary stream could potentially contain hidden data, making option C correct.

Exam trap

EC-Council CHFI often tests the distinction between allocated space and slack space, and the trap here is that candidates mistakenly calculate the total allocated clusters (12 KB) as slack instead of subtracting the actual file size from the allocated space.

How to eliminate wrong answers

Option A is wrong because 12 KB is the total allocated space (3 clusters × 4 KB), not the slack. Option B is wrong because 4 KB would be the slack if the file size were exactly 8 KB (2 clusters), but here the file is 10 KB, leaving only 2 KB of slack. Option D is wrong because file slack always exists when the file size is not a multiple of the cluster size; 10 KB is not a multiple of 4 KB, so slack is present.

Practice this question →
22
Multi-Selectmedium

Which TWO of the following are valid techniques for acquiring RAM in a Windows system?

Select 2 answers
A.WinPmem
B.Sleuth Kit
C.LiME
D.dd
E.FTK Imager
AnswersA, E

WinPmem is a memory acquisition tool for Windows.

Why this answer

WinPmem is a dedicated memory acquisition tool for Windows that uses the WinPmem driver to access physical memory directly, bypassing OS protections. It is widely used in forensic acquisitions because it can capture RAM with minimal interference and supports both 32-bit and 64-bit Windows systems.

Exam trap

EC-Council often tests the distinction between disk forensics tools and memory acquisition tools, leading candidates to mistakenly select Sleuth Kit or dd as valid RAM acquisition methods for Windows.

Practice this question →
23
MCQmedium

An examiner is analyzing an NTFS volume and suspects that a suspect hid data using Alternate Data Streams (ADS). Which tool or method is MOST appropriate to list all ADS on the volume?

A.Execute 'dir /r' in a Windows command prompt on the mounted image
B.Run 'ls -la' from a Linux forensic environment
C.Use 'icacls' to view security descriptors and detect ADS
D.Mount the image in Autopsy and run the 'Find File' module
AnswerA

The 'dir /r' command is a built-in Windows utility that enumerates alternate data streams (ADS) on NTFS volumes. When run against a mounted forensic image or drive, it displays each file accompanied by any named streams in the format 'file.txt:streamname:$DATA'. This directly queries the NTFS $ATTRIBUTE_LIST and $DATA attributes through the Windows filesystem driver, making it the simplest standard technique to confirm the presence and names of hidden ADS.

Why this answer

The 'dir /r' command in Windows Command Prompt is specifically designed to display alternate data streams (ADS) on NTFS volumes. It lists all files and directories, including any hidden streams attached to them, making it the most direct and appropriate method for an examiner to enumerate all ADS on a mounted NTFS volume.

Exam trap

The CHFI exam often tests the misconception that Linux tools like 'ls -la' can universally detect NTFS-specific features, but candidates must remember that ADS are a Windows/NTFS construct requiring native Windows commands or specialized forensic tools.

How to eliminate wrong answers

Option B is wrong because 'ls -la' in a Linux forensic environment does not natively display NTFS alternate data streams; it requires additional tools like 'ntfs-3g' or 'streams' to detect ADS, and even then it's not the most straightforward method. Option C is wrong because 'icacls' is used to view and modify security descriptors (permissions) on files and folders, not to list alternate data streams; it has no capability to enumerate ADS. Option D is wrong because while Autopsy can detect ADS, the 'Find File' module is a general search tool that does not specifically list all ADS on a volume; the 'File Analysis' or 'ADS' module would be more appropriate, but the question asks for the most appropriate method, and 'dir /r' is simpler and more direct.

Practice this question →
24
MCQmedium

During a forensic examination of a Linux ext4 file system, an investigator runs the `ls -i` command and sees inode numbers. They need to examine the inode structure. Which command should they use to display detailed inode information?

A.dd if=/dev/sda1 of=output.img
B.debugfs -R 'stat <inode>' /dev/sda1
C.mount -o loop image.img /mnt
D.fsck /dev/sda1
AnswerB

debugfs is the standard ext2/ext3/ext4 filesystem debugger, and the -R option lets you execute a single request in non-interactive mode. The 'stat <inode>' command within debugfs prints the complete inode record, including file mode, UID/GID, size, access/change/modification times, link count, and block allocation data. This makes it the correct choice for directly querying inode information on a live device or an acquired image without mounting or modifying the filesystem.

Why this answer

The `debugfs` command is a native ext2/ext3/ext4 file system debugger that allows direct inode inspection. The `-R 'stat <inode>'` flag runs the `stat` command in debugfs to display the full inode structure, including permissions, timestamps, block pointers, and extended attributes, which is exactly what the investigator needs after seeing inode numbers from `ls -i`.

Exam trap

EC-CHFI often tests the distinction between file system analysis tools (debugfs) and general-purpose disk utilities (dd, mount, fsck), trapping candidates who confuse imaging or mounting with inode-level inspection.

How to eliminate wrong answers

Option A is wrong because `dd` is a low-level block copy tool used for imaging or cloning a partition; it does not parse or display inode metadata. Option C is wrong because `mount -o loop` attaches a disk image to the file system tree for access as a mounted volume, but it does not provide a command to dump raw inode details—it only makes files accessible via standard file operations. Option D is wrong because `fsck` is a file system consistency check and repair tool; it does not display inode structures and is not designed for forensic inode examination.

Practice this question →
25
MCQmedium

During a forensic examination of a Windows system, an analyst finds a file that appears to be zero bytes in size when viewed in Windows Explorer, but the file's properties show a size on disk of 4 KB. What is the most likely explanation?

A.The file contains only slack space
B.The file is compressed using NTFS compression
C.The file is stored in an alternate data stream (ADS)
D.The file is a sparse file
AnswerC

NTFS supports alternate data streams (ADS), which are named data streams attached to a file in addition to the default unnamed stream. The file's logical size, as displayed in Explorer or via standard APIs, reflects only the unnamed main stream, so a file with an empty main stream but data written into a named ADS will show 0 bytes while still consuming allocated clusters on disk for the ADS content. Forensic examiners must enumerate all data streams (e.g., using `dir /R` or specialized tools) to detect hidden data.

Why this answer

An alternate data stream (ADS) allows additional data to be stored with a file in NTFS. Windows Explorer typically displays only the size of the main file stream, not the ADS. Therefore, a file with a zero-byte main stream but an ADS containing data will show a logical size of 0 bytes, while the 'size on disk' reflects the allocated clusters for the ADS data (e.g., 4 KB).

This is a common technique used to hide data.

Exam trap

Candidates often confuse the discrepancy between logical size and size on disk. They may attribute it to sparse files or compression, but the key clue is a zero-byte logical size with non-zero disk allocation, which is a classic indicator of an alternate data stream.

How to eliminate wrong answers

Option A is wrong because slack space is unused space in a cluster after the end of a file's data, not a file itself; a file cannot 'contain only slack space' as a file type. Option B is wrong because NTFS compression reduces the physical size on disk below the logical size, but the logical size in Explorer would still show the uncompressed size, not zero bytes. Option C is wrong because an alternate data stream (ADS) is a hidden data stream attached to a file; the main file's size would still be visible in Explorer, and ADS does not cause the main file to appear as zero bytes with a 4 KB size on disk.

Practice this question →
26
MCQhard

During a forensic investigation, you encounter a RAID 5 array consisting of three 1 TB disks. The array is failed, and you need to reconstruct the original data. Which of the following approaches is MOST appropriate for data recovery?

A.Mount each disk individually and copy files
B.Run `mdadm --assemble --scan` on the images
C.Use `dd` to image each disk and then XOR the three images together
D.Use EnCase to perform a RAID rebuild with known parameters
AnswerD

EnCase (and similar forensic tools like X-Ways or FTK Imager) can reconstruct a logical RAID 5 volume from disk images by letting you specify the disk order, stripe size, and parity rotation scheme. Once the parameters are set, the tool virtually reassembles the array in memory or as a new image, making the filesystem visible for standard forensic analysis. This is the correct approach when the original RAID metadata is unavailable or partially damaged, as the tool can also parse controller metadata or accept manual input to recover the array.

Why this answer

EnCase Forensic has a built-in RAID reconstruction feature that can automatically rebuild a RAID 5 array from disk images when the RAID parameters (stripe size, parity rotation, disk order) are known or can be detected. This is the most appropriate approach for a failed RAID 5 array, as it handles the parity-based striping and reassembles the logical volume without requiring manual XOR operations or risking data corruption.

Exam trap

The CHFI exam often tests the misconception that a simple XOR of all disk images (Option C) is sufficient for RAID 5 recovery, but this fails because the parity is distributed and not a simple XOR of the entire disk; the correct approach requires knowing the RAID geometry and using a tool that handles stripe-level reconstruction.

How to eliminate wrong answers

Option A is wrong because mounting each disk individually in a RAID 5 array will only show partial, fragmented data (stripes and parity), not the complete logical volume; files are striped across all disks, so individual mounts yield unusable data. Option B is wrong because `mdadm --assemble --scan` is a Linux software RAID command that works only if the array metadata is intact and the disks are still part of a functional RAID set; in a failed array with corrupted metadata, this command cannot reconstruct the data. Option C is wrong because XORing three raw disk images together without knowing the exact stripe size, parity layout, and disk order will produce garbage; RAID 5 uses distributed parity, so a simple XOR of all three images does not account for stripe boundaries or parity rotation.

Practice this question →
27
MCQhard

An analyst is examining a USB drive that appears to have a smaller capacity than expected. The drive is detected as 8 GB but only 7 GB is accessible. Which of the following is the most likely cause?

A.The file system uses a cluster size that wastes space
B.The drive is formatted with FAT32 which has a 4 GB file size limit
C.The drive has a Host Protected Area (HPA) hiding 1 GB
D.The drive contains a hidden partition
AnswerC

A Host Protected Area (HPA) is a region at the end of a hard drive defined via the ATA SET MAX ADDRESS command that reduces the reported LBA count, making the disk appear smaller to the operating system. If an 8 GB drive reports only 7 GB, an HPA can hide exactly 1 GB of sectors, which remain inaccessible to the OS and typical file system tools. This precisely matches the observed discrepancy, and forensic examiners can detect it using ATA commands (e.g., hdparm -N) or specialized tools that compare the reported and actual maximum addresses.

Why this answer

The difference between detected capacity (8 GB) and accessible space (7 GB) is most likely due to a Host Protected Area (HPA). HPA uses the ATA SET MAX ADDRESS command to reduce the total capacity reported by the drive, effectively hiding 1 GB from the operating system. A hidden partition does not change the total reported capacity; it only makes a portion of the space inaccessible by not assigning a drive letter.

Therefore, only HPA directly reduces the total capacity, making option C the most likely cause.

Exam trap

The CHFI exam often tests the distinction between HPA (reduces total reported capacity) and hidden partitions (allocate space but do not change total reported capacity). Candidates may mistakenly think both apply, but the key is that only HPA causes a discrepancy in total detected capacity.

How to eliminate wrong answers

Option A is wrong because cluster size waste (slack space) reduces usable space for file storage but does not change the total accessible capacity reported by the operating system; the drive would still show as 8 GB total. Option B is wrong because FAT32's 4 GB file size limit affects individual file storage, not the total volume capacity; an 8 GB drive formatted with FAT32 can still show its full 8 GB capacity. Option D is wrong because a hidden partition would still be counted in the total capacity reported by the OS (e.g., Disk Management would show the partition as hidden but the drive's total size would remain 8 GB); the question states the drive is detected as 8 GB but only 7 GB is accessible, meaning the OS sees 8 GB total but cannot access 1 GB, which matches HPA behavior.

Practice this question →
28
MCQhard

An analyst recovers a disk image from a Linux server that used ext4. The image shows a superblock backup at multiple offsets. Which dd command would correctly extract the backup superblock located at offset 32768 bytes?

A.dd if=image.dd of=superblock.bin bs=4096 skip=8 count=1
B.dd if=image.dd of=superblock.bin bs=512 skip=64 count=2
C.dd if=image.dd of=superblock.bin bs=1024 skip=32 count=1
D.dd if=image.dd of=superblock.bin bs=32768 skip=1 count=1
AnswerB, C

Using bs=512 with skip=64 also lands at 64 * 512 = 32,768 bytes, the same superblock offset, but count=2 reads two 512-byte sectors for a total of 1,024 bytes. This approach is explicitly correct because it compensates for the smaller block size by incrementing the count, thereby extracting exactly the superblock without including adjacent sectors. It demonstrates that dd can achieve the same forensic extraction using any divisor of the superblock size, as long as the offset and byte count equal 32,768 and 1,024 respectively.

Why this answer

Both options B and C correctly extract the backup superblock from the disk image. The ext4 superblock is 1024 bytes and starts at offset 32768 bytes. With bs=512, skip=64 gives offset 32768 (64*512=32768), and count=2 reads 1024 bytes (2*512=1024).

With bs=1024, skip=32 gives offset 32768 (32*1024=32768), and count=1 reads 1024 bytes. Both commands extract exactly the superblock. Option A uses bs=4096 and count=1, reading 4096 bytes, which is too much and may include adjacent data.

Option D uses bs=32768 and count=1, reading 32768 bytes, far exceeding the superblock size.

Exam trap

Candidates may incorrectly assume that only one command is correct, or they may miscalculate skip values for different block sizes. Both B and C produce the same result; the key is to correctly compute skip and count to read exactly the superblock size (1024 bytes) at the given offset.

How to eliminate wrong answers

Option A is wrong because bs=4096 with skip=8 gives an offset of 32768 bytes (4096 × 8 = 32768), but count=1 reads only 4096 bytes, which is too large and would include data beyond the 1024-byte superblock, potentially corrupting the extracted data. Option C is wrong because bs=1024 with skip=32 gives an offset of 32768 bytes (1024 × 32 = 32768), but count=1 reads only 1024 bytes, which is correct for the superblock size; however, the skip value is incorrect because the superblock backup at offset 32768 is the first backup, but the primary superblock is at offset 1024, and the backup at 32768 is the second superblock; the skip=32 is actually correct for the offset, but the command would extract the superblock correctly; the issue is that the question asks for the backup superblock at offset 32768, and this option would work, but it is not listed as correct because the exam expects the bs=512 approach; however, the trap is that bs=1024 skip=32 count=1 is technically valid but not the intended answer because the CHFI exam often tests the standard dd syntax with bs=512 for disk images. Option D is wrong because bs=32768 with skip=1 gives an offset of 32768 bytes (32768 × 1 = 32768), but count=1 reads 32768 bytes, which is far larger than the 1024-byte superblock and would extract a huge chunk of data, not just the superblock.

Practice this question →
29
MCQeasy

Which tool is specifically designed for file carving and can recover files based on headers and footers without relying on file system metadata?

A.FTK Imager
B.Foremost
C.Autopsy
D.Volatility
AnswerB

Foremost is a dedicated command-line file carver that recovers files by scanning raw disk images and matching known binary signatures for file headers, footers, and internal data structures. It was originally developed from the Air Force Office of Special Investigations' carving tool and is configured via a customizable configuration file (foremost.conf), allowing investigators to add custom signatures. Its sole purpose is to extract data based on file structure, making it the classic, focused file-carving utility rather than a general forensic suite.

Why this answer

Foremost is a file carving tool that recovers files by scanning raw data for known header and footer signatures, such as JPEG headers (0xFFD8) and footers (0xFFD9), without relying on file system metadata like MFT entries or inodes. This makes it ideal for data recovery from damaged or formatted volumes where the file system structure is unavailable.

Exam trap

The CHFI exam often tests the distinction between file carving tools (like Foremost) and forensic analysis suites (like Autopsy or FTK Imager), expecting candidates to know that carving operates at the raw data level without file system metadata.

How to eliminate wrong answers

Option A (FTK Imager) is wrong because it is primarily a forensic imaging and preview tool that acquires disk images and mounts them for analysis, not a dedicated file carver; while it can export files, it relies on file system metadata for logical file extraction. Option C (Autopsy) is wrong because it is a digital forensics platform that provides a GUI for analyzing disk images and file systems, but its file carving capabilities are limited and typically rely on external tools like Foremost or Scalpel; it is not specifically designed for header/footer-based carving. Option D (Volatility) is wrong because it is a memory forensics framework for analyzing RAM dumps (e.g., processes, network connections), not a tool for file carving from disk images.

Practice this question →
30
MCQeasy

What is the primary purpose of the Host Protected Area (HPA) on a hard disk drive?

A.To provide a write-cache for improved performance
B.To store diagnostic data or allow vendors to hide data from the OS
C.To store the partition table when using GPT
D.To store the operating system boot loader
AnswerB

The HPA is defined by the ATA/ATAPI specification as a reserved region beyond the normal maximum address reported to the host, created and modified with the SET MAX ADDRESS and DEVICE CONFIGURATION OVERLAY commands. Because operating systems enumerate only the accessible LBA range, the HPA is invisible to the OS, allowing vendors to store diagnostic firmware, crash dumps, or recovery utilities without consuming ordinary user-visible space. In forensic practice, the HPA must be checked and disabled to see the true full capacity of the drive and recover hidden data.

Why this answer

HPA is a reserved area on the disk that is not visible to the operating system, intended for vendor-specific data. It can be used to hide data from forensic acquisition.

Practice this question →
31
MCQmedium

An analyst is recovering deleted files from a FAT32 file system. The file system uses a cluster size of 4096 bytes. The first cluster of a deleted file is cluster 100. Which structure contains the chain of clusters for this file?

A.Volume boot record
B.Directory entry
C.File Allocation Table (FAT)
D.Boot sector
AnswerC

The File Allocation Table (FAT) is the core structure for recovering deleted files on a FAT32 filesystem. It contains an array of entries that map each cluster to the next cluster in a file's chain, effectively recording how clusters are linked to form files. When a file is deleted, the directory entry is flagged as deleted, but the FAT entries for the file's clusters are often not immediately cleared, leaving the chain intact and recoverable. An analyst can scan the FAT for orphaned clusters and reconstruct the original file by traversing the cluster linkage, making this option the correct choice.

Why this answer

The File Allocation Table (FAT) is the core structure that stores the chain of clusters for files in FAT32 file systems. When a file is deleted, its directory entry is marked as available, but the FAT entries for its clusters (starting at cluster 100) remain intact until overwritten, allowing recovery by following the cluster chain in the FAT.

Exam trap

EC-CHFI often tests the misconception that the directory entry stores the entire cluster chain, when in fact it only stores the starting cluster number, and the FAT holds the linked list of subsequent clusters.

How to eliminate wrong answers

Option A is wrong because the Volume Boot Record (VBR) contains metadata about the file system (e.g., cluster size, total sectors) and the boot code, but does not store cluster chains for individual files. Option B is wrong because a directory entry holds the file name, attributes, timestamps, and starting cluster number (e.g., cluster 100), but not the chain of subsequent clusters; the chain is stored in the FAT. Option D is wrong because the boot sector is synonymous with the VBR and serves the same purpose—it does not contain cluster allocation information for files.

Practice this question →
32
MCQhard

During a forensic examination of an NTFS drive, an analyst runs 'fsutil usn readjournal C:' and observes a large number of USN journal entries for a specific file after a certain date. The file's $MFT record shows a last modified timestamp far earlier than the journal entries. What does this discrepancy suggest?

A.The file's metadata was modified without changing its content, possibly using timestomping or ADS manipulation
B.The file is a system file that is excluded from USN journaling
C.The file system is corrupted and the MFT is not updating correctly
D.The file was accessed via a mounted volume shadow copy, which does not update MFT
AnswerA

A recorded USN journal entry that does not correspond to an observable MFT timestamp change indicates that metadata was altered without updating the file's content. Attackers commonly use timestomping to directly modify $STANDARD_INFORMATION or $FILE_NAME timestamps in the MFT, bypassing the normal NTFS APIs that would trigger a journaled update; alternatively, ADS manipulation can change attribute-level metadata while leaving the main file data untouched. The consistency of the journal and MFT in this case makes accidental or corrupted behavior unlikely, pointing to deliberate anti-forensic action.

Why this answer

The USN journal records all changes to files and directories on an NTFS volume, including metadata modifications. When the USN journal shows numerous entries after a date but the $MFT record's last modified timestamp is earlier, it indicates that the file's metadata (e.g., timestamps, ADS) was altered without updating the $MFT's last modified field—a classic sign of timestomping or ADS manipulation. This discrepancy arises because timestomping tools can directly modify $MFT attributes while the USN journal still logs the change event.

Exam trap

The trap here is that candidates assume the USN journal only tracks data content changes, not metadata changes, leading them to incorrectly attribute the discrepancy to corruption or shadow copies instead of recognizing it as evidence of timestomping.

How to eliminate wrong answers

Option B is wrong because system files are not excluded from USN journaling; the USN journal records changes for all files on an NTFS volume, including system files, unless specifically filtered by the analyst. Option C is wrong because file system corruption would typically cause inconsistent or missing entries across both the USN journal and $MFT, not a clean discrepancy where the journal is updated but the $MFT timestamp is not. Option D is wrong because accessing a file via a mounted volume shadow copy does not update the live $MFT record at all, but the USN journal entries in this scenario are on the live volume, not the shadow copy; shadow copies have their own separate $MFT and USN journal.

Practice this question →
33
MCQhard

An investigator notes that a file on an NTFS volume has a resident data size of 900 bytes, but the $DATA attribute lists an allocated size of 1024 bytes. What does this indicate?

A.The file is compressed using NTFS compression
B.The file has slack space that may contain remnants of previously deleted data
C.The file's data is stored in the MFT as a resident attribute
D.The file is stored in an alternate data stream
AnswerB

File slack occurs because NTFS allocates disk space in fixed-size clusters, while a file's logical size is measured in bytes. If the final cluster is only partially used, the remaining bytes from the end of the file to the end of that cluster are not initialized by the filesystem, so they may still contain data from a previously deleted file or from an earlier, larger version of the current file. This residual data is a common forensic target because it survives normal file deletion and can be carved during analysis. The observed discrepancy between allocated size and logical size directly indicates that such slack space exists.

Why this answer

On an NTFS volume, when a file's data is stored as a resident attribute within the MFT, the $DATA attribute's allocated size is typically 0 because the data occupies space only within the MFT record itself. Here, the allocated size is 1024 bytes, which is larger than the resident data size of 900 bytes. This indicates that the file is stored non-resident (i.e., in clusters outside the MFT), and the allocated size reflects the cluster size (e.g., 1024 bytes per cluster).

The difference between the allocated size (1024 bytes) and the actual data size (900 bytes) is slack space, which may contain remnants of previously deleted data.

Exam trap

A common misconception is that a resident data size smaller than allocated size implies the file is resident in the MFT, but in reality, resident files have an allocated size of 0, and a non-zero allocated size indicates non-resident storage with potential slack space.

How to eliminate wrong answers

Option A is wrong because NTFS compression would typically result in an allocated size smaller than the uncompressed data size, not larger; compression reduces cluster usage, but here the allocated size (1024 bytes) is larger than the data size (900 bytes), which is inconsistent with compression. Option C is wrong because if the file's data were stored as a resident attribute in the MFT, the allocated size would be 0 (since no clusters are allocated), not 1024 bytes. Option D is wrong because an alternate data stream (ADS) would have its own $DATA attribute with its own allocated size; the scenario describes a single $DATA attribute with a specific allocated size, not the presence of multiple streams.

Practice this question →
34
MCQhard

An investigator acquires an SSD from a laptop that has been turned off for 24 hours. The suspect recently deleted several incriminating files. Using a forensic imager, the investigator creates a bit-for-bit copy. However, when analyzing the image, the deleted files' data appears to be zeros. What is the MOST likely cause?

A.The files were stored in the paging file, which is volatile
B.The SSD controller performed wear leveling, moving data to unallocated blocks
C.The imaging tool incorrectly interpreted the data due to encryption
D.The TRIM command was issued, causing the SSD to erase the freed blocks
AnswerD

Correct. TRIM can cause permanent loss of deleted data on SSDs.

Why this answer

The TRIM command is an ATA command that allows an operating system to inform an SSD which data blocks are no longer in use and can be wiped internally. When the suspect deleted the files, the OS likely issued a TRIM command to the SSD, causing the controller to erase the freed physical blocks. Since the laptop was off for 24 hours, the SSD had ample time to complete the garbage collection process, resulting in the deleted files' data appearing as zeros in the forensic image.

Exam trap

The EC-CHFI exam often tests the misconception that wear leveling (Option B) causes data loss, but wear leveling only relocates data to balance write cycles; it does not erase the original data—TRIM and garbage collection are the mechanisms that actively zero out freed blocks on SSDs.

How to eliminate wrong answers

Option A is wrong because the paging file (pagefile.sys) is stored on the SSD, not in volatile memory, and while it can contain remnants of data, it is not inherently volatile; the issue here is that the deleted files' data is zeros, not that it was never written to disk. Option B is wrong because wear leveling moves data to different physical blocks to extend the SSD's lifespan, but it does not erase the original data; the data would still exist in the moved location unless explicitly erased by TRIM or garbage collection. Option C is wrong because encryption would make the data appear as ciphertext, not zeros; the imaging tool would still capture the encrypted data, and the question states the data appears as zeros, not as unreadable encrypted content.

Practice this question →
35
MCQhard

A forensic analyst is examining a RAID 5 array consisting of three disks. One disk has failed and has been replaced. The array is rebuilt automatically. However, the analyst needs to recover deleted files that existed before the rebuild. What is the MOST significant challenge in this scenario?

A.File carving techniques do not work on RAID volumes
B.The rebuild process may overwrite data in slack space and previously unallocated clusters
C.The file system becomes corrupted after rebuild
D.The RAID controller encrypts data, preventing direct disk access
AnswerB

Rebuilding RAID 5 writes new parity and data, overwriting free space and slack.

Why this answer

When a RAID 5 array with a failed disk is rebuilt, the controller reconstructs data using parity information and writes it to the replacement disk. This rebuild process writes to all previously unallocated clusters and slack space across the array, potentially overwriting the very data the analyst hopes to recover. Deleted files that existed before the rebuild are at high risk of being overwritten during this automatic reconstruction, making recovery extremely difficult or impossible.

Exam trap

The trap here is that candidates may think the rebuild only affects the failed disk's data, but in reality, the rebuild process writes to all disks in the array, overwriting unallocated space and slack space across the entire volume.

How to eliminate wrong answers

Option A is wrong because file carving techniques can work on RAID volumes; they search for file signatures in raw data and are not inherently blocked by RAID structures, though they may need to account for striping. Option C is wrong because a properly executed RAID 5 rebuild does not corrupt the file system; the array remains logically consistent after reconstruction, though data in previously unallocated areas may be lost. Option D is wrong because RAID controllers do not encrypt data by default; encryption is a separate feature (e.g., self-encrypting drives or software encryption) and is not an inherent property of RAID 5.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Chfi Storage Filesystem questions.

Start 20-question session