Understanding Hard Disks and File Systems CHFI Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   During a forensic examination, you need to access a specific sector on a modern hard drive. The drive's documentation provides the LBA address 0x0F00. You are using a tool that only accepts CHS addressing. What is the correct CHS value for this LBA, assuming the drive has 63 sectors per track and 16 heads?

   • AC=0, H=15, S=61
   • BC=3, H=15, S=1
   • CC=3, H=12, S=61
   • DC=0, H=0, S=3841
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is file slack?

   • AThe space on the disk that is never used because it is physically damaged
   • BThe unused space between the end of a file's data and the end of the last allocated cluster
   • CThe space reserved for the operating system's swap file
   • DThe space occupied by the file allocation table itself
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   When a file is deleted from a hard disk, what typically happens to the data in the file's clusters?

   • AThe data remains intact but the clusters are marked as unallocated.
   • BThe data is encrypted to prevent recovery.
   • CThe data is moved to a hidden system file.
   • DThe data is immediately overwritten with zeros.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   In NTFS, which of the following is stored as a file attribute in the Master File Table (MFT)?

   • AThe file's creation timestamp
   • BThe physical sector number where the file's data begins
   • CThe file's MD5 hash value
   • DThe IP address of the computer that created the file
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   You are comparing forensic artifacts from two different file systems. In one image, you find a Master File Table (MFT) with $STANDARD_INFORMATION and $FILE_NAME attributes. In another image, you find a directory entry with a 32-byte structure and a separate File Allocation Table. Which pair of file systems are you most likely examining?

   • AFAT32 and NTFS
   • Bext4 and HFS+
   • CHFS+ and ext4
   • DNTFS and FAT32
   Reveal Solution Discussion Select an answer first