Boot Processes and File Systems Across Windows, Linux, and macOS DFE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A Linux administrator is setting up a new server and must choose a file system for the root partition. The server will host a database that requires high reliability and supports snapshots. Which file system should the administrator choose?

   • ABtrfs
   • Bext2
   • Cext3
   • Dext4
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A forensic investigator is examining a Windows 10 system that has a dual-boot configuration with Linux. The investigator needs to determine which operating system was used last. Which evidence would be most reliable?

   • AThe last boot time recorded in the Windows Event Log.
   • BThe last mount time of the NTFS volume, which is recorded in the $Volume metadata.
   • CThe system time and the last access time of the boot loader configuration file (e.g., GRUB).
   • DThe file system timestamps of the hibernation file (hiberfil.sys) and the swap partition.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A forensic examiner receives a Windows 10 laptop that will not boot. The examiner needs to acquire the evidence without altering the system. The examiner decides to remove the hard drive and connect it to a write-blocker on a forensic workstation. The drive contains a BitLocker-encrypted NTFS volume. Which approach should the examiner take to access the encrypted data?

   • AUse a forensic imaging tool that supports BitLocker decryption and provide the recovery key or password.
   • BFormat the drive to remove encryption and then create a forensic image.
   • CPerform a live acquisition by booting the original system and using a forensic tool to image the running volume.
   • DBoot the forensic workstation from a Linux live CD and mount the NTFS volume with the ntfs-3g driver.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A forensic examiner needs to recover deleted files from a Mac that runs macOS Catalina (10.15) with APFS. The user had enabled FileVault. Which statement correctly describes the challenge and the appropriate approach?

   • AThe examiner should first create a forensic image of the disk, then use a tool that can parse HFS+ metadata, because APFS is not supported by most forensic tools.
   • BAPFS does not support snapshots, so deleted files cannot be recovered; the only option is to use a commercial tool that bypasses FileVault.
   • CAPFS snapshots may contain previous versions of files, but FileVault encryption requires the user's password or recovery key to decrypt the volume before analysis.
   • DFileVault encryption does not affect forensic analysis because the encryption is only applied to the user data folder, not the entire disk.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which feature is unique to NTFS among the listed Windows file systems?

   • AUse of a file allocation table
   • BCompatibility with macOS
   • CSupport for file compression
   • DSupport for files larger than 4 GB
   Reveal Solution Discussion Select an answer first