CHFI Data Acquisition and Duplication 3 — Questions and Answers
Question 1: What is the Host Protected Area (HPA) and why is it forensically significant?
- A hardware encryption zone that stores BitLocker keys
- A hidden drive region invisible to the OS that may contain concealed data (Correct answer)
- A partition reserved for RAID metadata
- A manufacturer's diagnostic log stored in NVRAM
Correct answer: A hidden drive region invisible to the OS that may contain concealed data
The HPA is a reserved area at the end of a drive that the OS cannot see; suspects may hide data there, and standard imaging tools miss it unless configured to access it.
Question 2: During network-based forensic acquisition, which protocol is commonly used to stream a disk image over the network?
- FTP with passive mode
- netcat or dcfldd piped over SSH (Correct answer)
- HTTP multipart file upload
- TFTP with block-size negotiation
Correct answer: netcat or dcfldd piped over SSH
Forensic examiners commonly pipe dd or dcfldd output through netcat or SSH to transfer disk images over a network to a remote storage server.
Question 3: Which hash algorithm is currently recommended by NIST for forensic image verification due to collision resistance concerns with MD5?
- CRC-32
- SHA-256 (Correct answer)
- SHA-1
- RIPEMD-128
Correct answer: SHA-256
NIST recommends SHA-256 (or stronger) for forensic integrity verification because MD5 and SHA-1 are vulnerable to collision attacks.
Question 4: An examiner acquires a drive and calculates an MD5 hash that differs from the hash taken by the first responder. What is the MOST likely conclusion?
- The forensic tool used a different sector size
- The evidence was altered or the chain of custody was broken between acquisitions (Correct answer)
- The hash mismatch is expected because MD5 is non-deterministic
- The file system was journaled, causing automatic hash changes
Correct answer: The evidence was altered or the chain of custody was broken between acquisitions
A hash mismatch between acquisition points indicates that data changed, suggesting evidence tampering or a broken chain of custody.
Question 5: What is 'write blocking' and which layer does a software write blocker operate at?
- Physically disconnects the write pin; operates at the SATA controller layer
- Intercepts write commands via OS driver or API interception before they reach the drive (Correct answer)
- Encrypts all writes to prevent data modification
- Monitors SMART data to detect write operations
Correct answer: Intercepts write commands via OS driver or API interception before they reach the drive
Software write blockers intercept OS-level write commands (via drivers or system call hooks) before they reach the storage device, preventing data modification during examination.
Question 6: When imaging a solid-state drive (SSD), which characteristic makes forensic acquisition more challenging than with HDDs?
- SSDs do not support the ATA interface required for forensic tools
- Wear leveling and TRIM commands can overwrite deleted data, reducing recoverability (Correct answer)
- SSDs store data in volatile memory that disappears when powered off
- SSDs use proprietary encryption that cannot be bypassed
Correct answer: Wear leveling and TRIM commands can overwrite deleted data, reducing recoverability
SSD controllers use wear leveling to distribute writes, and TRIM actively zeroes deleted blocks, making traditional deleted-data recovery difficult on SSDs.
Question 7: Which tool is specifically designed for acquiring volatile memory (RAM) on a live Windows system?
- dcfldd
- WinPmem (Correct answer)
- Autopsy
- FTK Imager Lite (disk only mode)
Correct answer: WinPmem
WinPmem is an open-source Windows memory acquisition tool that dumps physical RAM to a file for forensic analysis of volatile data.
CHFI Data Acquisition and Duplication 3
What is the Host Protected Area (HPA) and why is it forensically significant?