Understanding Hard Disks and File Systems CHFI Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   You are examining a Linux system and need to recover a deleted file. The file system is ext4. Which of the following is a unique feature of ext4 that can aid in file recovery compared to older ext3?

   • AThe presence of an MFT that stores file records and timestamps.
   • BThe ability to disable the journal, which leaves more data in unallocated space.
   • CThe use of extents to reduce metadata overhead and improve performance.
   • DThe use of a journal that records all file data, not just metadata.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   While examining a FAT32 filesystem image, you notice that a deleted file's directory entry still exists but the first byte of the filename has been changed to 0xE5. You also observe that the file's data clusters are marked as free in the FAT. What is the most accurate forensic interpretation of this state?

   • AThe file was deleted normally, and the directory entry and FAT entries are consistent with a standard deletion.
   • BThe file was moved to the recycle bin, and the directory entry is a shortcut.
   • CThe file was securely deleted using a wiping tool that also cleared the directory entry.
   • DThe file is still allocated but hidden by the 0xE5 marker, and the FAT entries are corrupted.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   You are analyzing a disk image and find a file that is 10,000 bytes in size. The file system uses 4,096-byte clusters. The file is stored in three clusters. How many bytes of file slack exist in the last cluster?

   • A4,096 bytes
   • B1,808 bytes
   • C1,808 bytes
   • D2,288 bytes
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the primary role of a partition table on a hard disk?

   • ATo manage the physical rotation speed of the disk
   • BTo hold the operating system's boot loader code
   • CTo define the boundaries and type of each partition on the disk
   • DTo store the file system's directory entries
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   You are analyzing a file system image and need to locate the root directory. The file system is FAT32. Where is the root directory typically located?

   • AIn the Master File Table (MFT)
   • BImmediately after the File Allocation Tables
   • CIn the first cluster of the data area, as indicated by the RootDirCluster field in the BPB
   • DAt a fixed location immediately after the boot sector
   Reveal Solution Discussion Select an answer first