CHFI Hard Disk and File Systems 3

Question 1

Which Windows registry hive stores the most recently accessed files and applications, useful for establishing user activity timelines?

Accepted Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

Answer

The RecentDocs registry key tracks files recently opened by the user in Windows Explorer, providing a timeline of file access.

Question 2

In NTFS, what are Alternate Data Streams (ADS) and why are they forensically significant?

Accepted Answer

Additional data attached to a file without appearing in its normal size, used to hide data

Answer

ADS allows data to be attached to an NTFS file under a different stream name and is invisible to Windows Explorer, making it a common data-hiding technique.

Question 3

What does the term 'inode' refer to in Linux/ext4 file systems?

Accepted Answer

A data structure containing file metadata such as permissions, timestamps, and block pointers

Answer

An inode is a data structure in ext file systems that stores all metadata about a file except its name, including ownership, permissions, and pointers to data blocks.

Question 4

A forensic examiner uses the 'dd' command to image a drive. What is the significance of the 'bs' (block size) parameter?

Accepted Answer

It determines the amount of data read and written per operation, affecting speed and sector alignment

Answer

The block size (bs) parameter controls how many bytes dd reads and writes at once; aligning it to the disk's sector size (512 or 4096 bytes) improves accuracy and performance.

Question 5

What is the Host Protected Area (HPA) on a hard disk drive?

Accepted Answer

A hidden area at the end of the disk that is excluded from normal OS disk size reporting

Answer

The HPA is a hidden region defined by ATA standard SET MAX ADDRESS commands that the BIOS and OS cannot normally detect, commonly used to hide data from forensic tools.

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI Hard Disk and File Systems 3