CHFI File System Forensics Quiz

Reviewed by Editorial Team
The ProProfs editorial team is comprised of experienced subject matter experts. They've collectively created over 10,000 quizzes and lessons, serving over 100 million users. Our team includes in-house content moderators and subject matter experts, as well as a global network of rigorously trained contributors. All adhere to our comprehensive editorial guidelines, ensuring the delivery of high-quality content.
Learn about Our Editorial Process
| By Thames
T
Thames
Community Contributor
Quizzes Created: 8865 | Total Attempts: 106,055
| Questions: 20 | Updated: Aug 15, 2026
Please wait...
Question 1 / 21
🏆 Rank #-- ▾
0 %
0/100
Score 0/100

1. In NTFS, what is an alternate data stream (ADS)?

Submit
Please wait...
About This Quiz
CHFI File System Forensics Quiz - Quiz

This quiz assesses your understanding of file system forensics, a critical component of digital investigations. You will explore file allocation tables, slack space, metadata analysis, and recovery techniques used to uncover evidence on storage devices. Mastering these concepts is essential for certified forensic investigators and cybersecurity professionals.

2.

What first name or nickname would you like us to use?

You may optionally provide this to label your report, leaderboard, or certificate.

2. Which forensic tool is widely used for examining NTFS file systems?

Submit

3. What does the 'C' in MACE timestamps represent?

Submit

4. In forensic imaging, what is a 'bitstream copy'?

Submit

5. Which of the following is a characteristic of NTFS compression?

Submit

6. What is the significance of file signatures or 'magic numbers' in forensics?

Submit

7. In forensic analysis, what does 'write blocking' prevent?

Submit

8. What is the primary function of journaling in file systems?

Submit

9. Which file system is primarily used on macOS?

Submit

10. What tool is commonly used to calculate MD5 hashes for forensic verification?

Submit

11. What does FAT stand for in file system terminology?

Submit

12. What is the maximum file size supported by FAT32?

Submit

13. How many bits does a FAT32 entry use to store cluster addresses?

Submit

14. What does the 'M' in MACE timestamps represent?

Submit

15. Which technique recovers deleted files from unallocated space?

Submit

16. In ext4 file systems, what is an inode?

Submit

17. What is the primary purpose of the Master File Table (MFT) in NTFS?

Submit

18. Which metadata attribute tracks when a file was last accessed?

Submit

19. What is slack space in file system forensics?

Submit

20. Which file system is commonly used in modern Windows operating systems?

Submit
×
Saved
Thank you for your feedback!
View My Results
Cancel
  • All
    All (20)
  • Unanswered
    Unanswered ()
  • Answered
    Answered ()
In NTFS, what is an alternate data stream (ADS)?
Which forensic tool is widely used for examining NTFS file systems?
What does the 'C' in MACE timestamps represent?
In forensic imaging, what is a 'bitstream copy'?
Which of the following is a characteristic of NTFS compression?
What is the significance of file signatures or 'magic numbers' in...
In forensic analysis, what does 'write blocking' prevent?
What is the primary function of journaling in file systems?
Which file system is primarily used on macOS?
What tool is commonly used to calculate MD5 hashes for forensic...
What does FAT stand for in file system terminology?
What is the maximum file size supported by FAT32?
How many bits does a FAT32 entry use to store cluster addresses?
What does the 'M' in MACE timestamps represent?
Which technique recovers deleted files from unallocated space?
In ext4 file systems, what is an inode?
What is the primary purpose of the Master File Table (MFT) in NTFS?
Which metadata attribute tracks when a file was last accessed?
What is slack space in file system forensics?
Which file system is commonly used in modern Windows operating...
play-Mute sad happy unanswered_answer up-hover down-hover success oval cancel Check box square blue
Alert!