Understanding Hard Disks and File Systems CHFI Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A forensic examiner is analyzing a disk image from a Linux system that uses ext4. The examiner needs to recover a deleted file. The file was stored in a directory that has been deleted as well. Which of the following is the most likely place to find remnants of the deleted file's data?

   • AThe unallocated data blocks
   • BThe journal
   • CThe superblock
   • DThe inode table
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A forensic examiner is comparing two file systems: FAT32 and NTFS. The examiner needs to identify a key difference that affects forensic analysis. Which of the following is a true difference?

   • AFAT32 stores file data in the File Allocation Table, while NTFS stores file data in the MFT.
   • BFAT32 uses a File Allocation Table to track cluster allocation, while NTFS uses a Master File Table (MFT).
   • CFAT32 supports file permissions, while NTFS does not.
   • DFAT32 supports journaling, while NTFS does not.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A forensic examiner is documenting the physical layout of a hard disk. They note that the disk has 4 platters, 8 heads, and 1024 cylinders, with 63 sectors per track. What is the total storage capacity of this disk in bytes, assuming each sector is 512 bytes?

   • A264,241,152 bytes
   • B1,056,964,608 bytes
   • C132,120,576 bytes
   • D528,482,304 bytes
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   In a typical FAT file system, which structure contains the list of file names, starting cluster numbers, and attributes for files in a directory?

   • AMaster file table (MFT)
   • BDirectory entries
   • CFile allocation table (FAT)
   • DBoot sector
   Reveal Solution Discussion Select an answer first
6. 20expert · medium

   You are comparing the forensic artifacts of a file stored on NTFS and the same file stored on ext4. Which of the following differences is most significant for forensic analysis?

   • Aext4 stores file permissions in the inode, while NTFS stores them in the MFT.
   • Bext4 uses a Master File Table, while NTFS uses inodes.
   • CNTFS stores multiple data streams, while ext4 does not support alternate data streams.
   • DNTFS uses a journal, while ext4 does not.
   Reveal Solution Discussion Select an answer first