Understanding Hard Disks and File Systems CHFI Practice Questions (Page 8)

Questions 36–37

1. 36application · medium

   You are analyzing a disk image and find a file that is 5,000 bytes in size. The file system uses 4,096-byte clusters. The file's data is stored in two clusters. How many bytes of file slack exist in the last cluster of this file?

   • A1,096 bytes
   • B904 bytes
   • C3,192 bytes
   • D4,096 bytes
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   During a forensic examination of a seized hard drive, you need to identify the exact physical location on the platter where a specific sector of data was read. The drive's documentation provides the CHS values (C=1023, H=4, S=63) for the target sector. However, the forensic imaging tool you are using reports the sector's LBA as 1,000,000. Why is the CHS value not directly usable for locating the physical platter position?

   • ACHS values are logical constructs that do not map to physical platter locations on modern drives.
   • BThe CHS value is in hexadecimal and must be converted to decimal to match the LBA.
   • CThe CHS value is only valid for SSDs, not for traditional magnetic hard disks.
   • DThe CHS value is encrypted and must be decrypted using the drive's firmware key before it can be used.
   Reveal Solution Discussion Select an answer first