CHFI Storage Forensics and File System Analysis Practice Question
Which TWO of the following are challenges specific to SSD forensics compared to traditional HDD forensics?
⚠ Common exam trap
A common misconception is that TRIM is the only SSD-specific challenge, but wear leveling is equally critical because it affects data recovery of both deleted and existing files by altering physical storage locations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Wear leveling
Wear leveling (B) is a challenge specific to SSD forensics because SSDs use a flash translation layer (FTL) to remap logical block addresses (LBAs) to physical NAND pages, so the same LBA can point to different physical locations over time and data may be spread across multiple dies, making it difficult to reconstruct the true physical layout or recover prior versions of data. The TRIM command (D) is also SSD-specific: when the OS issues TRIM (e.g., via ATA DATA SET MANAGEMENT or SCSI UNMAP), the drive marks deleted LBAs as invalid and may erase or garbage-collect those blocks, so deleted data can be unrecoverable and the drive's contents change even without user activity, complicating imaging and timeline analysis. By contrast, bad sectors (A), file fragmentation (C), and slack space (E) are challenges common to traditional HDD forensics as well, since they arise from magnetic platter media, file-system allocation behavior, and cluster-level storage rather than from SSD flash management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Bad sectors
Why it's wrong here
Bad sectors occur on both HDDs and SSDs, so they are not unique to SSD forensics. SSD-specific challenges are wear levelling, TRIM, and the flash translation layer. Bad-sector imaging is the right choice when a failing magnetic drive needs hardware-assisted recovery before forensic acquisition.
- ✓
Wear leveling
Why this is correct
Wear levelling spreads writes across NAND blocks and relocates data transparently, so logical block addresses no longer map predictably to physical locations. This defeats the contiguous, sequential imaging assumptions that traditional HDD forensics relies upon.
- ✗
File fragmentation
Why it's wrong here
File fragmentation affects both HDDs and SSDs; SSD controllers actively avoid it through wear levelling and out-of-place writes. The SSD-specific challenges are TRIM, garbage collection, and the flash translation layer. Fragmentation analysis is correct when reconstructing deleted files from fragmented HDD clusters.
- ✓
TRIM command
Why this is correct
The TRIM command lets SSDs erase invalid data blocks proactively, so the controller may wipe deleted file remnants within minutes, independent of the operating system. This defeats HDD-style recovery of deleted artefacts, directly satisfying the stem's demand for an SSD-specific forensic challenge.
- ✗
Slack space
Why it's wrong here
Slack space exists on both SSDs and HDDs; it is not SSD-specific. SSD controllers use over-provisioning and wear levelling, so slack space is not the distinguishing forensic challenge. Slack space analysis is the correct choice when recovering residual file fragments from unallocated clusters on magnetic media.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CHFI question from scratch — 745 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.