How should I use these OS and File System Forensics practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just OS and File System Forensics questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the OS and File System Forensics domain.

CHFI · topic practice

OS and File System Forensics practice questions

Practise Computer Hacking Forensic Investigator CHFI OS and File System Forensics practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

10 questionsDomain: OS and File System Forensics

Practice 10 questions Browse domain →

What the exam tests

What to know about OS and File System Forensics

OS and File System Forensics questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common OS and File System Forensics exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

OS and File System Forensics questions

10 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full OS and File System Forensics explanation →

During a forensic investigation of a compromised Linux server, an investigator needs to recover deleted files from an ext4 filesystem. Which method should the investigator use to maximize recovery of file content, considering the filesystem may have been partially overwritten?

Trap 1: Use 'grep -a' to search the raw disk for file signatures.

'grep -a' can find strings but does not reconstruct files; it will not recover file content effectively.

Trap 2: Use 'scalpel' to perform a deep scan of the filesystem.

Scalpel is a file carver but foremost is more commonly used and referenced in CHFI; both are similar but foremost is the canonical answer.

Trap 3: Use 'extundelete' to recover files from the ext4 filesystem.

extundelete relies on filesystem metadata which may be overwritten; it is less effective when metadata is damaged.

Study all OS and File System Forensics common traps →

A
Use 'foremost' to carve files based on file headers and footers.
Foremost is a file carving tool that recovers files by scanning for known headers/footers, making it effective for partially overwritten filesystems.
B
Use 'grep -a' to search the raw disk for file signatures.
Why wrong: 'grep -a' can find strings but does not reconstruct files; it will not recover file content effectively.
C
Use 'scalpel' to perform a deep scan of the filesystem.
Why wrong: Scalpel is a file carver but foremost is more commonly used and referenced in CHFI; both are similar but foremost is the canonical answer.
D
Use 'extundelete' to recover files from the ext4 filesystem.
Why wrong: extundelete relies on filesystem metadata which may be overwritten; it is less effective when metadata is damaged.

Full breakdown with real-world context →

Question 2hardmultiple choice

Read the full OS and File System Forensics explanation →

A forensic analyst is examining a Windows 10 system and needs to determine the last boot time of the system. Which registry hive and key should the analyst query to find this information?

Trap 1: NTUSER.DAT hive, key 'Control Panel\Desktop\'

NTUSER.DAT stores user-specific settings, not system boot information.

Trap 2: SOFTWARE hive, key 'Microsoft\Windows NT\CurrentVersion\'

This key contains OS version info, not boot time.

Trap 3: SAM hive, key 'SAM\Domains\Account\Users\'

SAM hive stores user account details, not system boot time.

Study all OS and File System Forensics common traps →

A
NTUSER.DAT hive, key 'Control Panel\Desktop\'
Why wrong: NTUSER.DAT stores user-specific settings, not system boot information.
B
SYSTEM hive, key 'CurrentControlSet\Control\Windows\', value 'ShutdownTime'
The 'ShutdownTime' value in this key records the last system shutdown time, which can be used to infer the last boot time (as the system boots after shutdown).
C
SOFTWARE hive, key 'Microsoft\Windows NT\CurrentVersion\'
Why wrong: This key contains OS version info, not boot time.
D
SAM hive, key 'SAM\Domains\Account\Users\'
Why wrong: SAM hive stores user account details, not system boot time.

Full breakdown with real-world context →

Question 3easymultiple choice

Read the full OS and File System Forensics explanation →

During a forensic investigation, an analyst needs to preserve the integrity of evidence on a hard drive. Which of the following is the best practice for acquiring an image of the drive?

Trap 1: Use the 'dd' command to create a raw image without a write blocker.

'dd' can read the drive but does not prevent writes; a write blocker must be used.

Trap 2: Connect the drive to a forensic workstation and use the operating…

The OS may write to the drive (e.g., updating timestamps) compromising integrity.

Trap 3: Format the drive before imaging to ensure no hidden data is missed.

Formatting destroys data and is never acceptable in forensic acquisition.

Study all OS and File System Forensics common traps →

A
Use the 'dd' command to create a raw image without a write blocker.
Why wrong: 'dd' can read the drive but does not prevent writes; a write blocker must be used.
B
Connect the drive to a forensic workstation and use the operating system's copy command.
Why wrong: The OS may write to the drive (e.g., updating timestamps) compromising integrity.
C
Use a hardware write blocker and create a bit-stream image.
A write blocker ensures no data is altered on the original drive during acquisition.
D
Format the drive before imaging to ensure no hidden data is missed.
Why wrong: Formatting destroys data and is never acceptable in forensic acquisition.

Full breakdown with real-world context →

Question 4mediummulti select

Read the full OS and File System Forensics explanation →

Which TWO of the following are valid locations in a Windows system where forensic evidence of USB device connection can be found?

Trap 1: Amcache.hve file

Amcache stores application execution artifacts, not device connection history.

Trap 2: Event Logs with source 'Device Setup'

Device installation events are logged under Microsoft-Windows-Kernel-PnP/Configuration, not 'Device Setup'.

Trap 3: C:\Windows\Prefetch folder

Prefetch stores execution traces of applications, not USB device connections.

Study all OS and File System Forensics common traps →

A
SYSTEM\CurrentControlSet\Enum\USBSTOR registry key
This key enumerates all USB storage devices that have been connected to the system.
B
Amcache.hve file
Why wrong: Amcache stores application execution artifacts, not device connection history.
C
SetupAPI.dev.log file
This log file records Plug and Play device installations, including USB devices.
D
Event Logs with source 'Device Setup'
Why wrong: Device installation events are logged under Microsoft-Windows-Kernel-PnP/Configuration, not 'Device Setup'.
E
C:\Windows\Prefetch folder
Why wrong: Prefetch stores execution traces of applications, not USB device connections.

Full breakdown with real-world context →

Question 5mediummultiple choice

Read the full OS and File System Forensics explanation →

You are a forensic investigator responding to a security incident at a medium-sized company. The incident involved an attacker gaining unauthorized access to a Windows Server 2019 system. The server was taken offline by the IT team immediately after detection. Your task is to acquire forensic evidence from the server's hard drive. The server has a single 500 GB NTFS partition. You have a forensic workstation with a write blocker, a SATA-to-USB adapter, and a forensic imaging tool that supports both dd and EWF (E01) formats. The server is still physically in the server room, and the IT team has powered it off. You need to create a forensic image that preserves the integrity of the evidence and allows for efficient analysis. Which of the following is the most appropriate course of action?

Trap 1: Boot the server using a forensic live CD, connect an external USB…

Booting from live CD may write to the system and the dd command does not use a write blocker; also, live acquisition is riskier.

Trap 2: Use the server's built-in backup utility to create a system state…

Backup utilities do not create a bit-for-bit forensic image and may miss deleted data; network transfer risks integrity.

Trap 3: Remove the hard drive, connect it via a write blocker to the…

Imaging over the network is not recommended due to potential data corruption and slower speeds; local imaging is preferred.

Study all OS and File System Forensics common traps →

A
Boot the server using a forensic live CD, connect an external USB drive to the server, and use 'dd' to create a raw image on the external drive.
Why wrong: Booting from live CD may write to the system and the dd command does not use a write blocker; also, live acquisition is riskier.
B
Use the server's built-in backup utility to create a system state backup and copy it to a network share.
Why wrong: Backup utilities do not create a bit-for-bit forensic image and may miss deleted data; network transfer risks integrity.
C
Remove the hard drive, connect it via a write blocker to the forensic workstation, and then use 'dd' over a network connection to send the image to a remote server.
Why wrong: Imaging over the network is not recommended due to potential data corruption and slower speeds; local imaging is preferred.
D
Remove the hard drive, connect it via a write blocker to the forensic workstation, and create an EWF (E01) image stored locally on the forensic workstation's internal drive.
This method uses a write blocker to preserve integrity, and EWF format provides compression and metadata for efficient analysis.

Full breakdown with real-world context →

Question 6mediummulti select

Read the full OS and File System Forensics explanation →

During a forensic investigation of a Windows 10 system, you need to analyze the file system to recover deleted files. Which TWO file system artifacts would be most useful for this purpose?

Trap 1: $Boot file

The boot sector contains partition info, not file deletion records.

Trap 2: $Volume

The $Volume attribute stores volume information, not file deletion artifacts.

Trap 3: $Bitmap

$Bitmap tracks cluster allocation, not file records; useful for locating free space but not direct file recovery.

Study all OS and File System Forensics common traps →

A
$LogFile
The $LogFile records metadata changes, including deletions; can help reconstruct file history.
B
$Boot file
Why wrong: The boot sector contains partition info, not file deletion records.
C
$MFT (Master File Table)
The MFT contains file records; even after deletion, the record may remain until overwritten.
D
$Volume
Why wrong: The $Volume attribute stores volume information, not file deletion artifacts.
E
$Bitmap
Why wrong: $Bitmap tracks cluster allocation, not file records; useful for locating free space but not direct file recovery.

Full breakdown with real-world context →

Question 7hardmultiple choice

Read the full network assurance explanation →

A forensic analyst is reviewing the syslog from a compromised Linux server. Based on the exhibit, what does the 'orphan inode deleted' message indicate?

Exhibit

Refer to the exhibit.

=== Linux log excerpt (var/log/syslog) ===
Jan 12 10:15:32 server1 kernel: [ 1234.5678] EXT4-fs (sda1): recovery complete
Jan 12 10:15:33 server1 kernel: [ 1234.5680] EXT4-fs (sda1): mounted filesystem with ordered data mode. Opts: (null)
Jan 12 10:15:34 server1 sshd[2345]: Accepted publickey for root from 192.168.1.10 port 54321 ssh2: RSA SHA256:abc...
Jan 12 10:15:35 server1 sshd[2346]: Received disconnect from 192.168.1.10 port 54321:11: disconnected by user
Jan 12 10:15:36 server1 kernel: [ 1234.5700] EXT4-fs (sda1): 1 orphan inode deleted
Jan 12 10:15:37 server1 kernel: [ 1234.5702] EXT4-fs (sda1): 1 orphan inode deleted

Trap 1: A hidden file was permanently removed from the filesystem.

The deletion is of an orphan inode, not a hidden file.

Trap 2: A rootkit has attempted to hide files by marking them as orphan…

Rootkits may hide files, but the orphan inode message is a normal filesystem operation.

Trap 3: A critical system file has been deleted, and the filesystem is…

The message is informational; it does not indicate deletion of a critical system file.

Study all OS and File System Forensics common traps →

A
A hidden file was permanently removed from the filesystem.
Why wrong: The deletion is of an orphan inode, not a hidden file.
B
A file was deleted while still open, and the filesystem has cleaned up the orphan inode.
Orphan inodes occur when a file is deleted while open; the filesystem cleans them on mount.
C
A rootkit has attempted to hide files by marking them as orphan inodes.
Why wrong: Rootkits may hide files, but the orphan inode message is a normal filesystem operation.
D
A critical system file has been deleted, and the filesystem is warning the administrator.
Why wrong: The message is informational; it does not indicate deletion of a critical system file.

Full breakdown with real-world context →

Question 8easymultiple choice

Read the full OS and File System Forensics explanation →

You are a forensic investigator responding to an incident on a Windows 10 workstation used by a finance manager. The user reports that a critical spreadsheet containing quarterly budget data was accidentally deleted from the Desktop yesterday at approximately 3:00 PM. The system has been used normally since then, and the user has not emptied the Recycle Bin. You have created a forensic image of the drive using FTK Imager. The Recycle Bin contains a file named 'Quarterly_Budget.xlsx', but it appears to be a shortcut (size 1 KB). The user insists the original file was several megabytes. You need to recover the original file. Which action should you take next?

Trap 1: Restore a previous version of the Desktop folder from Volume Shadow…

Volume Shadow Copy may have a copy, but the Recycle Bin is more likely to have the file since it was recently deleted.

Trap 2: Use file carving techniques to recover the file from unallocated…

File carving is useful when file metadata is gone, but the file may still be intact in the Recycle Bin, which is a better first step.

Trap 3: Check the Recycle Bin on the live system; the file should be there…

The Recycle Bin shows only a shortcut, not the original data. The file is not restorable from the live Recycle Bin.

Study all OS and File System Forensics common traps →

A
Search the $Recycle.Bin folder on the forensic image to locate the original file data, which may be stored under a different name.
The Recycle Bin stores original file data in the $Recycle.Bin folder, often with a renamed file. The shortcut is just a reference.
B
Restore a previous version of the Desktop folder from Volume Shadow Copy.
Why wrong: Volume Shadow Copy may have a copy, but the Recycle Bin is more likely to have the file since it was recently deleted.
C
Use file carving techniques to recover the file from unallocated space on the Desktop.
Why wrong: File carving is useful when file metadata is gone, but the file may still be intact in the Recycle Bin, which is a better first step.
D
Check the Recycle Bin on the live system; the file should be there and can be restored.
Why wrong: The Recycle Bin shows only a shortcut, not the original data. The file is not restorable from the live Recycle Bin.

Full breakdown with real-world context →

Question 9mediumdrag order

Read the full OS and File System Forensics explanation →

Drag and drop the steps to perform a forensic analysis of a Windows registry using RegRipper into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 10mediummatching

Read the full OS and File System Forensics explanation →

Match each forensic acquisition method to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Collecting data from a running system

Collecting data from powered-off media

Copying only active files and metadata

Bit-for-bit copy of entire storage device

Collecting only fragments of unallocated space

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused OS and File System Forensics sessions

Start a OS and File System Forensics only practice session

Every question in these sessions is drawn from the OS and File System Forensics domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all OS and File System Forensics questions →Mixed CHFI session

Frequently asked questions

What does the CHFI exam test about OS and File System Forensics?: OS and File System Forensics questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just OS and File System Forensics questions in a focused session?: Yes — the session launcher on this page draws every question from the OS and File System Forensics domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other CHFI topics?: Use the topic links above to move to related areas, or go back to the CHFI question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the CHFI exam covers. They are not copied from any real exam or dump site.

OS and File System Forensics only

10 questions 20 questions 30 questions 50 questions

Mixed CHFI session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All CHFI questions OS and File System Forensics domain overview CHFI exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

OS and File System Forensics practice questions

What to know about OS and File System Forensics

Common OS and File System Forensics exam traps

OS and File System Forensics questions

During a forensic investigation of a compromised Linux server, an investigator needs to recover deleted files from an ext4 filesystem. Which method should the investigator use to maximize recovery of file content, considering the filesystem may have been partially overwritten?

A forensic analyst is examining a Windows 10 system and needs to determine the last boot time of the system. Which registry hive and key should the analyst query to find this information?

During a forensic investigation, an analyst needs to preserve the integrity of evidence on a hard drive. Which of the following is the best practice for acquiring an image of the drive?

Which TWO of the following are valid locations in a Windows system where forensic evidence of USB device connection can be found?

During a forensic investigation of a Windows 10 system, you need to analyze the file system to recover deleted files. Which TWO file system artifacts would be most useful for this purpose?

A forensic analyst is reviewing the syslog from a compromised Linux server. Based on the exhibit, what does the 'orphan inode deleted' message indicate?

Exhibit

Drag and drop the steps to perform a forensic analysis of a Windows registry using RegRipper into the correct order.

Match each forensic acquisition method to its description.

Track your progress over time

Start a OS and File System Forensics only practice session

Related CHFI topic practice pages

Computer Forensics Investigation Process practice questions

Computer Forensics Fundamentals and Process practice questions

Storage Forensics and File System Analysis practice questions

Incident Response and First Responder Skills practice questions

Computer Forensics Lab practice questions

Evidence Acquisition and Duplication practice questions

OS and Network Forensics practice questions