A forensic examiner needs to acquire data from a Mac with a T2 chip. The Mac is running macOS Catalina and has FileVault enabled. The examiner has the user's password. Which acquisition method is most appropriate?

Boot the Mac into Recovery Mode and use Terminal to image the internal drive.

Boot the Mac normally and use a forensic tool to image the mounted volume.

Use Target Disk Mode, but note that T2 Macs require approval on the target Mac.

Remove the SSD and connect it to a forensic workstation using a hardware write-blocker.

A company uses a legacy Windows 7 system that boots from a FAT32 partition. The system also has an NTFS data partition. The administrator needs to ensure that the system can boot after a firmware update. Which consideration is most important?

The firmware must support booting from a FAT32 partition, as the boot files reside there.

NTFS is required for the boot partition because it supports larger files and journaling.

FAT32 does not support file permissions, so the boot files are vulnerable to modification.

The firmware update will automatically convert FAT32 to NTFS.

EC-CouncilDigital Forensics Essentials

Domain 2Objective 2

Boot Processes and File Systems Across Windows, Linux, and macOS DFE Practice Questions (Page 4)

Part of the Storage Media and Data Acquisition domain, which makes up ~12% of our current practice bank.

38questions here

8free pages

7concepts

Questions 16–20

16expert · hard
A forensic examiner needs to acquire data from a Mac with a T2 chip. The Mac is running macOS Catalina and has FileVault enabled. The examiner has the user's password. Which acquisition method is most appropriate?
Select an answer first
17foundation · easy
Which Windows file system is best suited for USB flash drives and SD cards that need to be compatible with many devices, including cameras and game consoles?
Select an answer first
18foundation · easy
Which file system is natively supported for both reading and writing by Windows, Linux, and macOS without third-party drivers?
Select an answer first
19application · medium
A company uses a legacy Windows 7 system that boots from a FAT32 partition. The system also has an NTFS data partition. The administrator needs to ensure that the system can boot after a firmware update. Which consideration is most important?
Select an answer first
20foundation · easy
Which component in the Linux boot process is responsible for loading the kernel into memory and passing control to it?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.

Boot Processes and File Systems Across Windows, Linux, and macOS DFE Practice Questions (Page 4)

Questions 16–20

A forensic examiner needs to acquire data from a Mac with a T2 chip. The Mac is running macOS Catalina and has FileVault enabled. The examiner has the user's password. Which acquisition method is most appropriate?

Which Windows file system is best suited for USB flash drives and SD cards that need to be compatible with many devices, including cameras and game consoles?

Which file system is natively supported for both reading and writing by Windows, Linux, and macOS without third-party drivers?

A company uses a legacy Windows 7 system that boots from a FAT32 partition. The system also has an NTFS data partition. The administrator needs to ensure that the system can boot after a firmware update. Which consideration is most important?

Which component in the Linux boot process is responsible for loading the kernel into memory and passing control to it?

Keep studying — Storage Media and Data Acquisition