CHFI Hard Disk and File Systems 5

Question 1

What does the NTFS $LogFile record, and why is it forensically valuable?

Accepted Answer

Transactional metadata changes to the file system, allowing reconstruction of recent file operations

Answer

The NTFS $LogFile is a circular transaction log that records metadata changes; forensic tools can parse it to reconstruct file creation, deletion, and renaming events even after file system operations.

Question 2

In ext4, what is the 'journal' and what mode provides the strongest data integrity?

Accepted Answer

A write-ahead log for file system metadata; 'data=journal' mode journals both metadata and data blocks

Answer

ext4's journal records operations before committing them; 'data=journal' mode (writeback < ordered < journal) provides the highest integrity by journaling both data and metadata.

Question 3

A suspect's drive shows a partition type code of 0x07 in the MBR partition table. What file system does this typically indicate?

Accepted Answer

NTFS or exFAT

Answer

Partition type code 0x07 is assigned to NTFS (and exFAT) partitions in the MBR partition table scheme.

Question 4

What is 'timeline analysis' in file system forensics, and which three NTFS timestamps are primarily used?

Accepted Answer

Chronologically ordering file system events; primarily uses Modified, Accessed, and Created (MAC) times from $STANDARD_INFORMATION

Answer

Timeline analysis arranges file system events chronologically using MAC times (Modified, Accessed, Created) along with the MFT entry change time to reconstruct attacker or user activity.

Question 5

Which technique do attackers use to manipulate NTFS timestamps to make malicious files appear to have existed long before an attack?

Accepted Answer

Timestomping

Answer

Timestomping involves modifying the MAC timestamps in an NTFS file's $STANDARD_INFORMATION attribute to disguise when a file was created or modified.

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI Hard Disk and File Systems 5