An investigator is examining a Linux system where a deleted file's slack space may contain remnants of a password. The file system is ext4. Which method would be most appropriate to extract data from slack space?

Use `file` command on the partition to identify the deleted file's type

Use `dd` to image the partition and then analyze the image with a forensic tool that supports slack space extraction

Use `debugfs` to read the raw block data of the deleted file

Use `grep` directly on the mounted file system to search for the password

A forensic examiner is analyzing a macOS system and needs to determine whether FileVault was enabled at the time of acquisition. Which artifact would provide this information?

The /Library/Preferences/com.apple.security.plist

The output of 'fdesetup status'

In Linux file system forensics, what is 'slack space'?

The space reserved for the root user's files.

The unused space between the end of a file's data and the end of the last allocated block.

The free space on the filesystem that is available for new files.

The space used by system logs and temporary files.

EC-CouncilComputer Hacking Forensic Investigator

Domain 3Objective 2

Linux and Mac Forensics CHFI Practice Questions (Page 1)

Part of the Operating System Forensics domain, which makes up ~12% of our current practice bank.

31questions here

7free pages

12concepts

Questions 1–5

1foundation · easy
During a Linux forensic examination, you need to locate system-wide configuration files that affect the boot process and user environment. Which directory in the standard Linux hierarchy is the primary location for such configuration files?
Select an answer first
2expert · hard
An investigator is examining a Linux system where a deleted file's slack space may contain remnants of a password. The file system is ext4. Which method would be most appropriate to extract data from slack space?
Select an answer first
3application · easy
A forensic examiner is analyzing a macOS system and needs to locate user-specific application data, such as browser profiles and application preferences. Which directory should be examined?
Select an answer first
4application · medium
A forensic examiner is analyzing a macOS system and needs to determine whether FileVault was enabled at the time of acquisition. Which artifact would provide this information?
Select an answer first
5foundation · easy
In Linux file system forensics, what is 'slack space'?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.

Linux and Mac Forensics CHFI Practice Questions (Page 1)

Questions 1–5

During a Linux forensic examination, you need to locate system-wide configuration files that affect the boot process and user environment. Which directory in the standard Linux hierarchy is the primary location for such configuration files?

An investigator is examining a Linux system where a deleted file's slack space may contain remnants of a password. The file system is ext4. Which method would be most appropriate to extract data from slack space?

A forensic examiner is analyzing a macOS system and needs to locate user-specific application data, such as browser profiles and application preferences. Which directory should be examined?

A forensic examiner is analyzing a macOS system and needs to determine whether FileVault was enabled at the time of acquisition. Which artifact would provide this information?

In Linux file system forensics, what is 'slack space'?

Keep studying — Operating System Forensics