CHFI - Computer Hacking Forensic Investigator Hard Disk and File Systems Questions and Answers

Question 1

A forensic investigator is examining a 4 TB hard drive from a modern Windows 11 system. The investigator needs to understand the partitioning scheme to locate potential hidden partitions. Which partitioning scheme would the investigator most likely encounter, and what is its primary advantage over the older standard?

Accepted Answer

GUID Partition Table (GPT), because it supports disks larger than 2 TB and allows for up to 128 primary partitions.

Answer

Modern systems with hard drives larger than 2 TB use the GUID Partition Table (GPT) scheme. MBR has a limitation of 2 TB and only supports up to four primary partitions. Ext4 is a file system, not a partitioning scheme, primarily used in Linux. FAT32 is an older file system with significant file and volume size limitations.

Question 2

During a digital forensics investigation of a compromised Linux server running the Ext4 file system, a file containing sensitive data appears to have been deleted. Which of the following data structures is the most crucial for a forensic analyst to examine to find metadata about this deleted file, such as its permissions, ownership, and pointers to its data blocks?

Accepted Answer

The Inode table

Answer

In Linux file systems like Ext4, the inode table contains the metadata for every file and directory. This metadata includes file type, permissions, ownership, timestamps, and pointers to the data blocks where the file's content is stored. The superblock contains general information about the file system, the MBR is a partitioning structure, and the MFT is specific to the NTFS file system.

Question 3

An investigator is analyzing an NTFS-formatted drive and suspects that a user has hidden data in the space between the logical end of a file and the end of the last cluster allocated to that file. What is this area of the disk called?

Accepted Answer

File Slack

Answer

File slack is the storage space from the end of a file's content to the end of the last cluster allocated to that file. This area can contain remnant data from previously stored files or random data from RAM. It is composed of RAM slack (the space between the end of the file and the end of the sector) and drive slack (the remaining sectors in the cluster).

Question 4

A forensic examiner is creating an image of a hard drive that uses the Master Boot Record (MBR) partitioning scheme. Which of the following correctly describes the structure and location of the MBR?

Accepted Answer

It is located in the first 512-byte sector of the disk and contains the boot code and partition table.

Answer

The Master Boot Record (MBR) is a critical data structure located in the very first 512-byte sector of a partitioned storage device. It contains the master boot code (which initiates the boot process), the partition table (which defines the primary partitions), and a boot signature.

Question 5

Which of the following is the central and most critical metadata file in an NTFS file system, containing records for every file and directory on the volume?

Accepted Answer

$MFT (Master File Table)

Answer

The Master File Table ($MFT) is the heart of the NTFS file system. It contains at least one entry for every file and directory on the volume, storing all their metadata, such as name, size, timestamps, and permissions. For small files, the data itself can even be stored directly within the MFT record.

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI - Computer Hacking Forensic Investigator Hard Disk and File Systems Questions and Answers