CHFI Hard Disk and File Systems 4

Question 1

What is 'file carving' in digital forensics?

Accepted Answer

Recovering files from unallocated space based on file headers and footers without relying on file system metadata

Answer

File carving reconstructs files from raw disk data by identifying known file signatures (magic bytes) without using the file system's directory or allocation tables.

Question 2

In a GPT-partitioned disk, where is the backup copy of the partition table stored?

Accepted Answer

At the end of the disk

Answer

GPT stores a secondary (backup) copy of the partition table at the last sectors of the disk to allow recovery if the primary GPT header is damaged.

Question 3

Which NTFS timestamp is NOT updated when a file is simply read (accessed) on a default Windows 10/11 system?

Accepted Answer

$STANDARD_INFORMATION last access time

Answer

By default, Windows disables updating of the $SI last access time (NtfsDisableLastAccessUpdate=1) to improve performance, so reading a file does not update it.

Question 4

What is the Device Configuration Overlay (DCO) on ATA hard drives?

Accepted Answer

A hidden area similar to HPA that restricts features and capacity visible to the OS and BIOS

Answer

DCO is an ATA feature that allows manufacturers or users to permanently hide disk capacity and features; like HPA, it requires special ATA commands to detect.

Question 5

In a FAT file system, what happens to a deleted file's directory entry?

Accepted Answer

The first byte of the filename is replaced with 0xE5 and cluster chain is marked free in the FAT

Answer

When a file is deleted in FAT, the directory entry's first character is set to 0xE5 and the FAT chain entries are set to 0x00 (free), but the actual data remains until overwritten.

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI Hard Disk and File Systems 4