How should I use these Storage Forensics and File System Analysis practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

CHFI · topic practice

Storage Forensics and File System Analysis practice questions

Q: Can I practise just Storage Forensics and File System Analysis questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Storage Forensics and File System Analysis domain.

Practise Computer Hacking Forensic Investigator CHFI Storage Forensics and File System Analysis practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Storage Forensics and File System Analysis

Practice 10 questions Browse domain →

What the exam tests

What to know about Storage Forensics and File System Analysis

Storage Forensics and File System Analysis questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Storage Forensics and File System Analysis exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Storage Forensics and File System Analysis questions

20 questions · select your answer, then reveal the explanation

Question 1easymultiple choice

Read the full Storage Forensics and File System Analysis explanation →

An analyst recovers a hard drive from a suspect's computer. The drive has a partition table that uses a 32-bit identifier and a maximum partition size of 2 TB. Which partition table type is present?

Trap 1: HFS+

HFS+ is a file system, not a partition table.

Trap 2: GPT

GPT uses 64-bit identifiers and supports partitions larger than 2 TB.

Trap 3: APFS

APFS is a file system, not a partition table.

Study all Storage Forensics and File System Analysis common traps →

A
HFS+
Why wrong: HFS+ is a file system, not a partition table.
B
GPT
Why wrong: GPT uses 64-bit identifiers and supports partitions larger than 2 TB.
C
APFS
Why wrong: APFS is a file system, not a partition table.
D
MBR
MBR uses 32-bit partition table entries with a maximum partition size of 2 TB.

Storage Forensics and File System Analysis practice questions

What to know about Storage Forensics and File System Analysis

Common Storage Forensics and File System Analysis exam traps

Storage Forensics and File System Analysis questions

An analyst recovers a hard drive from a suspect's computer. The drive has a partition table that uses a 32-bit identifier and a maximum partition size of 2 TB. Which partition table type is present?

During a forensic investigation, an examiner wants to recover deleted files from a FAT32 file system. Which structure is most critical for file recovery?

Which tool is specifically designed for file carving and can recover files based on headers and footers without relying on file system metadata?

An analyst notices that a file on an NTFS volume occupies 4096 bytes on disk but its actual data is only 100 bytes. The extra space contains remnants of a previously deleted file. What is this extra space called?

A forensic investigator is analyzing a Linux ext4 file system. They suspect a file was deleted but its inode may still be intact. Which tool can be used to recover the file by referencing the inode?

During a forensic examination of an NTFS drive, an investigator finds that a file 'notes.txt' has an additional data stream named 'hidden.txt' attached. Which feature of NTFS allows this?

A security analyst is investigating a compromised Windows system and wants to see which processes were running at the time of memory capture. Which Volatility command should they use?

An examiner acquires a forensic image of an SSD from a suspect's laptop. The SSD was connected to a system with TRIM enabled. What challenge will the examiner most likely face when trying to recover deleted files?

During a forensic analysis of a drive, the examiner discovers a Host Protected Area (HPA). What is the primary purpose of an HPA?

An investigator is analyzing a RAID 5 array consisting of three disks. One disk fails and is replaced. After rebuilding, the file system appears corrupted. What is the MOST likely cause?

During memory analysis, an examiner uses the Volatility 'malfind' plugin and discovers a process with executable code in an executable heap. Which technique is most likely being used by malware to avoid detection?

An investigator uses FTK Imager to capture a forensic image of a suspect's hard drive. During acquisition, the tool reports that the DCO (Device Configuration Overlay) is present. What does this indicate?

Which TWO of the following are file systems that use journaling to maintain integrity?

Which THREE of the following are techniques used to hide data on a hard drive?

Which TWO of the following are challenges specific to SSD forensics compared to HDD forensics?

During a forensic examination of a Windows 10 system, an investigator runs the following command: 'fsutil usn readjournal C: > usn_output.txt'. What is the primary purpose of this action?

An analyst recovers a disk image from a Linux server that used ext4. The image shows a superblock backup at multiple offsets. Which dd command would correctly extract the backup superblock located at offset 32768 bytes?

Which file system artifact in NTFS is used to hide data by appending a stream to an existing file without affecting its primary data stream?

During a forensic investigation, an analyst finds a file with a creation timestamp earlier than the volume's formatted timestamp. Which of the following is the most likely explanation?

In an ext3 file system, after deleting a file, the inode's link count drops to 0, but the data blocks remain. Which of the following is true regarding recovery?

Track your progress over time

Start a Storage Forensics and File System Analysis only practice session

Related CHFI topic practice pages

Computer Forensics Investigation Process practice questions

Computer Forensics Fundamentals and Process practice questions

Storage Forensics and File System Analysis practice questions

Incident Response and First Responder Skills practice questions

Computer Forensics Lab practice questions

Evidence Acquisition and Duplication practice questions

OS and Network Forensics practice questions

OS and File System Forensics practice questions

Application, Email and Cloud Forensics practice questions

Mobile and Malware Forensics practice questions

Network and Cloud Forensics practice questions

Database and Application Forensics practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid