CHFI Hard Disk and File Systems 5 — Questions and Answers
Question 1: What does the NTFS $LogFile record, and why is it forensically valuable?
- User login events and failed authentication attempts
- Transactional metadata changes to the file system, allowing reconstruction of recent file operations (Correct answer)
- Content of recently opened documents
- Network connections associated with file transfers
Correct answer: Transactional metadata changes to the file system, allowing reconstruction of recent file operations
The NTFS $LogFile is a circular transaction log that records metadata changes; forensic tools can parse it to reconstruct file creation, deletion, and renaming events even after file system operations.
Question 2: In ext4, what is the 'journal' and what mode provides the strongest data integrity?
- A file listing all user logins; enabled by setting mount option 'log=full'
- A write-ahead log for file system metadata; 'data=journal' mode journals both metadata and data blocks (Correct answer)
- A backup copy of the superblock; activated via tune2fs -j
- A SMART monitoring log; enabled in BIOS settings
Correct answer: A write-ahead log for file system metadata; 'data=journal' mode journals both metadata and data blocks
ext4's journal records operations before committing them; 'data=journal' mode (writeback < ordered < journal) provides the highest integrity by journaling both data and metadata.
Question 3: A suspect's drive shows a partition type code of 0x07 in the MBR partition table. What file system does this typically indicate?
- FAT32
- NTFS or exFAT (Correct answer)
- Linux ext4
- Linux swap
Correct answer: NTFS or exFAT
Partition type code 0x07 is assigned to NTFS (and exFAT) partitions in the MBR partition table scheme.
Question 4: What is 'timeline analysis' in file system forensics, and which three NTFS timestamps are primarily used?
- Comparing access logs from IDS; uses firewall, proxy, and event log timestamps
- Chronologically ordering file system events; primarily uses Modified, Accessed, and Created (MAC) times from $STANDARD_INFORMATION (Correct answer)
- Analyzing network packet captures; uses SYN, ACK, and FIN timestamps
- Reconstructing database transactions; uses commit, rollback, and checkpoint timestamps
Correct answer: Chronologically ordering file system events; primarily uses Modified, Accessed, and Created (MAC) times from $STANDARD_INFORMATION
Timeline analysis arranges file system events chronologically using MAC times (Modified, Accessed, Created) along with the MFT entry change time to reconstruct attacker or user activity.
Question 5: Which technique do attackers use to manipulate NTFS timestamps to make malicious files appear to have existed long before an attack?
- Slack space injection
- Timestomping (Correct answer)
- ADS hiding
- Sector wiping
Correct answer: Timestomping
Timestomping involves modifying the MAC timestamps in an NTFS file's $STANDARD_INFORMATION attribute to disguise when a file was created or modified.
Question 6: What is 'slack space' and which two types are relevant to NTFS forensics?
- Unused sectors at the disk end; types are disk slack and partition slack
- Unused space within the last cluster of a file and unused bytes in the last sector of that cluster; file slack and RAM slack (Correct answer)
- Free space in the MFT and free space in unallocated clusters; MFT slack and cluster slack
- Padding in directory entries and padding in MFT records; directory slack and record slack
Correct answer: Unused space within the last cluster of a file and unused bytes in the last sector of that cluster; file slack and RAM slack
File slack is the unused space between the end of a file's logical data and the end of its last allocated cluster; RAM slack (within the sector) may contain remnant memory data, both can hold hidden or residual data.
Question 7: When performing a forensic hash verification of a disk image, which combination of algorithms is considered best practice to minimize collision risk?
- CRC32 and Adler-32
- MD5 and SHA-256 together (Correct answer)
- SHA-1 only
- Base64 encoding of MD5
Correct answer: MD5 and SHA-256 together
Using both MD5 (for legacy compatibility) and SHA-256 (for cryptographic strength) together minimizes the risk of an undetected collision or tampering in forensic evidence.
CHFI Hard Disk and File Systems 5
What does the NTFS $LogFile record, and why is it forensically valuable?