CHFI - Computer Hacking Forensic Investigator Hard Disk and File Systems Questions and Answers

Question 1

A forensic investigator is examining a 4 TB hard drive from a modern Windows 11 system.
The investigator needs to understand the partitioning scheme to locate potential hidden partitions.
Which partitioning scheme would the investigator most likely encounter, and what is its primary advantage over the older standard?

Accepted Answer

GUID Partition Table (GPT), because it supports disks larger than 2 TB and allows for up to 128 primary partitions.

Answer

Master Boot Record (MBR), because it is compatible with all systems.

Answer

Extended File System (Ext4), as it is the default for modern operating systems.

Answer

File Allocation Table (FAT32), due to its simplicity and widespread use on external media.

Question 2

During a digital forensics investigation of a compromised Linux server running the Ext4 file system, a file containing sensitive data appears to have been deleted. Which of the following data structures is the most crucial for a forensic analyst to examine to find metadata about this deleted file, such as its permissions, ownership, and pointers to its data blocks?

Accepted Answer

The Inode table

Answer

The Superblock

Answer

The Master Boot Record (MBR)

Answer

The Master File Table (MFT)

Question 3

An investigator is analyzing an NTFS-formatted drive and suspects that a user has hidden data in the space between the logical end of a file and the end of the last cluster allocated to that file. What is this area of the disk called?

Accepted Answer

File Slack

Answer

Unallocated Space

Answer

RAM Slack

Answer

Swap Space

Question 4

A forensic examiner is creating an image of a hard drive that uses the Master Boot Record (MBR) partitioning scheme. Which of the following correctly describes the structure and location of the MBR?

Accepted Answer

It is located in the first 512-byte sector of the disk and contains the boot code and partition table.

Answer

It is located at the end of the disk and contains a backup of the partition table.

Answer

It can be located anywhere on the disk and primarily contains user data.

Answer

It is a variable-sized structure stored within the first partition that defines the file system.

Question 5

Which of the following is the central and most critical metadata file in an NTFS file system, containing records for every file and directory on the volume?

Accepted Answer

$MFT (Master File Table)

Answer

$LogFile

Answer

$Bitmap

Answer

$Boot

Question 6

A forensic investigator is analyzing a hard drive from a suspect's computer and finds a small file. The file's logical size is 300 bytes. The file system uses a cluster size of 4096 bytes and a sector size of 512 bytes. The investigator wants to examine the area from the end of the 300-byte file to the end of the first sector. What is this specific area known as?

Accepted Answer

RAM Slack

Answer

Drive Slack

Answer

Unallocated Cluster

Answer

File Slack