Boot Processes and File Systems Across Windows, Linux, and macOS DFE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A forensic investigator is examining a Windows 10 system that was found with the power cord unplugged. The investigator needs to determine whether the system was shut down cleanly or if the power loss was sudden. Which Windows event log entry would be most useful?

   • AEvent ID 6006 (The Event log service was stopped) in the System log
   • BEvent ID 41 (Kernel-Power) in the System log
   • CEvent ID 6008 (The previous system shutdown was unexpected) in the System log
   • DEvent ID 1074 (The process has initiated a shutdown) in the System log
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A Mac user reports that their system will not boot and shows a folder with a question mark. The administrator suspects the startup disk is not recognized. Which step should be taken to diagnose the issue?

   • AUse Target Disk Mode to connect the Mac to another Mac and check the disk.
   • BReset the NVRAM by holding Command+Option+P+R during boot.
   • CReinstall macOS from the Recovery partition.
   • DBoot into Recovery Mode and use Disk Utility to verify the startup disk.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A forensic examiner is analyzing a Mac that runs macOS Catalina (10.15) with APFS. The examiner needs to determine when a specific file was last modified. Which APFS feature provides the most reliable timestamp information?

   • AThe file's modification time (mtime) stored in the APFS metadata.
   • BThe file's access time (atime) stored in the APFS metadata.
   • CThe file's change time (ctime) stored in the APFS metadata.
   • DThe file's creation time (crtime) stored in the APFS metadata.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A forensic investigator is examining a Windows 10 system that has both NTFS and FAT32 partitions. The investigator needs to recover a deleted file from the FAT32 partition. Which characteristic of FAT32 is most relevant to the recovery?

   • AFAT32 stores the file's cluster chain in the File Allocation Table, which can be used to reassemble the file if the clusters are not overwritten.
   • BFAT32 supports journaling, which records the deletion and can be used to undo the deletion.
   • CFAT32 stores a backup of the file's directory entry in the File Allocation Table, allowing easy recovery.
   • DFAT32 uses a Master File Table (MFT) that stores file metadata, including the file's cluster chain.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A forensic investigator is examining a USB flash drive that was used to transfer files between a Windows 10 computer and a macOS computer. The drive is formatted with exFAT. Which characteristic of exFAT is most relevant to the investigation?

   • AexFAT uses a Master File Table (MFT) that contains metadata about every file, including timestamps and file names.
   • BexFAT has a maximum file size of 4 GB, which limits the types of files that could have been stored on the drive.
   • CexFAT does not support file permissions, so it cannot store the original Windows ACLs or macOS POSIX permissions.
   • DexFAT supports journaling, which records file system changes and can help recover deleted files.
   Reveal Solution Discussion Select an answer first