Understanding Hard Disks and File Systems CHFI Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A forensic examiner is analyzing a disk image from a Windows 10 workstation. The disk has a GPT partition table with three partitions: an EFI System Partition, a Windows C: drive (NTFS), and a recovery partition. The examiner needs to locate the NTFS boot sector of the C: drive. Which of the following is the most reliable method to find it?

   • ARead the GPT entry for the C: partition to get its starting LBA, then examine the first sector of that partition.
   • BLook for the NTFS boot sector at LBA 0 of the disk, since the boot sector is always at the beginning of the disk.
   • CSearch the entire disk image for the ASCII string 'NTFS' to locate the boot sector.
   • DUse the MBR partition table to find the starting sector of the C: partition, then read the first sector of that partition.
   Reveal Solution Discussion Select an answer first
2. 27expert · medium

   A forensic examiner is analyzing a hard drive that has been subject to a low-level format. The drive's firmware reports a total of 1,000,000 LBA sectors. The examiner needs to determine the physical geometry of the drive to estimate the number of platters. The drive's documentation states it has 8 heads and 63 sectors per track. What is the approximate number of cylinders on this drive?

   • A125,000 cylinders
   • B1,984 cylinders
   • C15,873 cylinders
   • D1,000,000 cylinders
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which of the following is an example of file system metadata that is forensically significant?

   • AThe file's last access timestamp
   • BThe room temperature where the computer was located
   • CThe brand name of the disk manufacturer
   • DThe physical color of the hard drive casing
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   You are examining a disk that uses a GUID Partition Table (GPT). The disk has a protective MBR at sector 0. What is the primary purpose of this protective MBR?

   • ATo store the disk's unique GUID identifier.
   • BTo provide a secondary boot loader for the operating system.
   • CTo store a backup of the GPT header and partition entries.
   • DTo prevent legacy BIOS-based tools from misinterpreting the disk as unpartitioned and overwriting it.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which statement correctly describes the difference between CHS and LBA addressing?

   • ACHS uses a linear number to address sectors, while LBA uses cylinder, head, and sector numbers.
   • BCHS addresses sectors by their physical geometry, while LBA assigns a sequential number to each sector.
   • CCHS is a modern addressing scheme, while LBA is an older scheme used only in legacy BIOS.
   • DCHS and LBA are identical addressing schemes with different names.
   Reveal Solution Discussion Select an answer first