CHFI Hard Disk and File Systems 4 — Questions and Answers
Question 1: What is 'file carving' in digital forensics?
- Decrypting files protected by EFS
- Recovering files from unallocated space based on file headers and footers without relying on file system metadata (Correct answer)
- Extracting metadata from EXIF tags
- Converting binary files to readable text format
Correct answer: Recovering files from unallocated space based on file headers and footers without relying on file system metadata
File carving reconstructs files from raw disk data by identifying known file signatures (magic bytes) without using the file system's directory or allocation tables.
Question 2: In a GPT-partitioned disk, where is the backup copy of the partition table stored?
- In the MBR protective partition
- At the end of the disk (Correct answer)
- In the first partition's VBR
- In the EFI System Partition
Correct answer: At the end of the disk
GPT stores a secondary (backup) copy of the partition table at the last sectors of the disk to allow recovery if the primary GPT header is damaged.
Question 3: Which NTFS timestamp is NOT updated when a file is simply read (accessed) on a default Windows 10/11 system?
- $STANDARD_INFORMATION last access time (Correct answer)
- All timestamps are always updated on access
- $FILENAME last access time
- Only $MFT record change time updates
Correct answer: $STANDARD_INFORMATION last access time
By default, Windows disables updating of the $SI last access time (NtfsDisableLastAccessUpdate=1) to improve performance, so reading a file does not update it.
Question 4: What is the Device Configuration Overlay (DCO) on ATA hard drives?
- A firmware update mechanism for hard drives
- A hidden area similar to HPA that restricts features and capacity visible to the OS and BIOS (Correct answer)
- The error correction code area on each track
- A diagnostic partition created by the manufacturer
Correct answer: A hidden area similar to HPA that restricts features and capacity visible to the OS and BIOS
DCO is an ATA feature that allows manufacturers or users to permanently hide disk capacity and features; like HPA, it requires special ATA commands to detect.
Question 5: In a FAT file system, what happens to a deleted file's directory entry?
- The entire entry is zeroed out immediately
- The first byte of the filename is replaced with 0xE5 and cluster chain is marked free in the FAT (Correct answer)
- The entry is moved to a recycle bin sector
- The file's data clusters are immediately overwritten
Correct answer: The first byte of the filename is replaced with 0xE5 and cluster chain is marked free in the FAT
When a file is deleted in FAT, the directory entry's first character is set to 0xE5 and the FAT chain entries are set to 0x00 (free), but the actual data remains until overwritten.
Question 6: What is the purpose of a write blocker in forensic disk imaging?
- To encrypt the forensic image during acquisition
- To prevent any write commands from reaching the evidence drive, preserving its integrity (Correct answer)
- To speed up the imaging process by buffering writes
- To filter out bad sectors during imaging
Correct answer: To prevent any write commands from reaching the evidence drive, preserving its integrity
A write blocker (hardware or software) intercepts and blocks write commands sent to the evidence drive, ensuring the forensic process does not modify the original evidence.
Question 7: Which sector on a standard 512-byte sector MBR disk contains the partition table?
- Sector 0 (the first sector of the disk) (Correct answer)
- Sector 1 (the second sector)
- Sector 63 (the first usable sector)
- The last sector of the first track
Correct answer: Sector 0 (the first sector of the disk)
On an MBR disk, sector 0 contains the 446-byte bootstrap code, the 64-byte partition table (4 entries of 16 bytes each), and the 2-byte signature 0x55AA.
CHFI Hard Disk and File Systems 4
What is 'file carving' in digital forensics?