Understanding Hard Disks and File Systems CHFI Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A forensic examiner is analyzing a hard disk that was used to store sensitive documents. The documents were deleted using the Shift+Delete command in Windows, which bypasses the Recycle Bin. The examiner wants to recover the deleted files. Which of the following is the most accurate statement about the deleted data?

   • AThe data is moved to the Recycle Bin and can be restored from there.
   • BThe data is immediately overwritten by the file system when the file is deleted.
   • CThe data is encrypted by the file system when the file is deleted.
   • DThe data remains in the unallocated space and can be recovered until it is overwritten by new data.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   In LBA addressing, how is a logical block address mapped to a physical disk location?

   • AThe operating system uses the LBA as the physical sector number without any translation.
   • BThe file system converts the LBA to a file path before accessing the disk.
   • CThe operating system directly sends the LBA to the disk controller, which translates it to a physical CHS address.
   • DThe BIOS translates the LBA to a CHS address before sending it to the disk.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary purpose of a file system on a storage device?

   • ATo control the rotation speed of the hard disk platters
   • BTo encrypt all data stored on the disk to prevent unauthorized access
   • CTo physically format the disk platters with magnetic patterns
   • DTo organize and manage how data is stored, retrieved, and named on the device
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   During a forensic examination of a FAT32 USB drive, an examiner finds a deleted file that was 2,500 bytes in size. The cluster size is 4,096 bytes. The file's directory entry shows the starting cluster and the file size. Which of the following best describes the data that remains on the disk and its forensic significance?

   • AThe file's data is stored across two clusters because the file size exceeds the cluster size, and the second cluster contains only 1,596 bytes of file data.
   • BOnly the first 2,500 bytes of the cluster are allocated to the file, and the rest of the cluster is unallocated space that the file system can reuse immediately.
   • CThe file's data is stored in the directory entry itself because the file is smaller than the cluster size, and no cluster is allocated to the file.
   • DThe entire 2,500 bytes are stored in the cluster, and the remaining 1,596 bytes of the cluster are file slack that may contain remnants of previously deleted files.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is a key advantage of the GUID Partition Table (GPT) over the traditional Master Boot Record (MBR) partitioning scheme?

   • AGPT does not require any partition table at all.
   • BGPT stores the partition table in a single sector at the beginning of the disk.
   • CGPT supports disks larger than 2 TB, while MBR is limited to 2 TB.
   • DGPT is compatible with all legacy BIOS systems without any modifications.
   Reveal Solution Discussion Select an answer first