CHFI Hard Disk and File Systems 3 — Questions and Answers
Question 1: Which Windows registry hive stores the most recently accessed files and applications, useful for establishing user activity timelines?
- HKEY_LOCAL_MACHINE\SAM
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs (Correct answer)
- HKEY_LOCAL_MACHINE\SYSTEM
- HKEY_USERS\.DEFAULT
Correct answer: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
The RecentDocs registry key tracks files recently opened by the user in Windows Explorer, providing a timeline of file access.
Question 2: In NTFS, what are Alternate Data Streams (ADS) and why are they forensically significant?
- Backup copies of corrupted files stored in the MFT
- Additional data attached to a file without appearing in its normal size, used to hide data (Correct answer)
- Encrypted file fragments stored in free space
- Metadata records for directories only
Correct answer: Additional data attached to a file without appearing in its normal size, used to hide data
ADS allows data to be attached to an NTFS file under a different stream name and is invisible to Windows Explorer, making it a common data-hiding technique.
Question 3: What does the term 'inode' refer to in Linux/ext4 file systems?
- The physical block where file data is stored
- A data structure containing file metadata such as permissions, timestamps, and block pointers (Correct answer)
- The journal entry for a file transaction
- The directory entry linking a filename to data
Correct answer: A data structure containing file metadata such as permissions, timestamps, and block pointers
An inode is a data structure in ext file systems that stores all metadata about a file except its name, including ownership, permissions, and pointers to data blocks.
Question 4: A forensic examiner uses the 'dd' command to image a drive. What is the significance of the 'bs' (block size) parameter?
- It sets the encryption key length for the image
- It determines the amount of data read and written per operation, affecting speed and sector alignment (Correct answer)
- It specifies the number of bad sectors to skip
- It defines the hash algorithm used for verification
Correct answer: It determines the amount of data read and written per operation, affecting speed and sector alignment
The block size (bs) parameter controls how many bytes dd reads and writes at once; aligning it to the disk's sector size (512 or 4096 bytes) improves accuracy and performance.
Question 5: What is the Host Protected Area (HPA) on a hard disk drive?
- A special partition created by Windows for recovery files
- A hidden area at the end of the disk that is excluded from normal OS disk size reporting (Correct answer)
- An encrypted volume used to store credentials
- The first track reserved for the MBR and partition table
Correct answer: A hidden area at the end of the disk that is excluded from normal OS disk size reporting
The HPA is a hidden region defined by ATA standard SET MAX ADDRESS commands that the BIOS and OS cannot normally detect, commonly used to hide data from forensic tools.
Question 6: Which tool is commonly used in Linux forensics to recover deleted files from an ext4 file system by scanning unallocated inode entries?
- fdisk
- extundelete (Correct answer)
- mkfs
- blkid
Correct answer: extundelete
extundelete is a Linux tool that analyzes ext3/ext4 journal and inode tables to recover deleted files from unallocated space.
Question 7: What does the MFT entry attribute $DATA contain in NTFS?
- The file's MAC timestamps
- The actual file content or data runs pointing to the file's data clusters (Correct answer)
- The file's security descriptor and ACL
- The parent directory reference
Correct answer: The actual file content or data runs pointing to the file's data clusters
The $DATA attribute in an MFT entry either contains the file's data directly (resident) or data runs that map to the clusters holding the file's content (non-resident).
CHFI Hard Disk and File Systems 3
Which Windows registry hive stores the most recently accessed files and applications, useful for establishing user activity timelines?