Understanding Hard Disks and File Systems CHFI Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A forensic examiner is analyzing a disk image from a Linux system. The disk has a GPT partition table. The examiner needs to identify the location of the root file system partition. Which of the following is the most reliable method?

   • ARead the GPT entries to find the partition with the Linux filesystem type GUID.
   • BExamine the boot sector of the disk to find the partition.
   • CLook at the MBR partition table to find the Linux partition.
   • DSearch the disk image for the string 'ext4' to find the partition.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which file system is natively used by modern Linux distributions and supports features such as journaling, extended attributes, and large file sizes?

   • Aext4
   • BHFS+
   • CFAT32
   • DNTFS
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A forensic examiner is analyzing a hard disk that has a reported geometry of 16,383 cylinders, 16 heads, and 63 sectors per track. The disk uses LBA addressing. The examiner needs to determine the total number of sectors on the disk. Which calculation is correct?

   • A16,383 × 16 × 63
   • B16,383 × 63
   • C16,383 × 16
   • D16,384 × 16 × 63
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An examiner is investigating a case involving a suspect who allegedly edited a document on an NTFS volume. The file's $STANDARD_INFORMATION attribute shows a last modified time of 10:00 AM, but the $FILE_NAME attribute shows a last modified time of 9:45 AM. Which of the following is the most likely explanation for this discrepancy?

   • AThe file was modified by a program that updated the $FILE_NAME attribute but not the $STANDARD_INFORMATION attribute.
   • BThe file system has a bug that causes the $FILE_NAME attribute to be updated incorrectly.
   • CThe file was renamed or moved within the same volume, which updated the $FILE_NAME attribute but not the $STANDARD_INFORMATION attribute.
   • DThe file was copied from another volume, and the $FILE_NAME attribute retained the original timestamps.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A forensic examiner is analyzing a disk image from a Windows 10 system. The disk has a GPT partition table with an EFI System Partition (ESP) and a Windows C: drive (NTFS). The examiner needs to locate the boot sector of the C: drive. Which of the following is the most reliable method?

   • ARead the GPT entry for the C: partition to get its starting LBA, then examine the first sector of that partition.
   • BSearch the entire disk image for the ASCII string 'NTFS' to locate the boot sector.
   • CLook for the NTFS boot sector at LBA 0 of the disk, since the boot sector is always at the beginning of the disk.
   • DUse the MBR partition table to find the starting sector of the C: partition, then read the first sector of that partition.
   Reveal Solution Discussion Select an answer first