A Windows 10 system fails to boot with the error 'Bootmgr is missing'. The administrator suspects the Boot Configuration Data (BCD) is corrupted. Which recovery step should be attempted first?

Run 'bootrec /rebuildbcd' from the Windows Recovery Environment.

Use 'chkdsk /f' on the system partition.

Copy bootmgr from another system to the system partition.

Reinstall Windows from scratch.

A forensic examiner is analyzing a MacBook Pro that runs macOS Big Sur (11) with an Apple T2 security chip. The examiner needs to access the encrypted APFS volume. Which method is the most appropriate?

Use the user's FileVault recovery key to unlock the volume in a forensic tool.

Remove the T2 chip and connect the SSD to another Mac to bypass encryption.

Boot the Mac into Recovery Mode and disable FileVault from the terminal.

Create a forensic image of the SSD and use a brute-force tool to crack the encryption.

A Linux system with a UEFI firmware fails to boot after a GRUB configuration change. The administrator needs to restore the bootloader. Which command should be used to reinstall GRUB to the EFI System Partition?

mkinitramfs -o /boot/initrd.img

grub-install --target=x86_64-efi --efi-directory=/boot/efi

EC-CouncilDigital Forensics Essentials

Domain 2Objective 2

Boot Processes and File Systems Across Windows, Linux, and macOS DFE Practice Questions (Page 8)

Part of the Storage Media and Data Acquisition domain, which makes up ~12% of our current practice bank.

38questions here

8free pages

7concepts

Questions 36–38

36application · medium
A Windows 10 system fails to boot with the error 'Bootmgr is missing'. The administrator suspects the Boot Configuration Data (BCD) is corrupted. Which recovery step should be attempted first?
Select an answer first
37application · medium
A forensic examiner is analyzing a MacBook Pro that runs macOS Big Sur (11) with an Apple T2 security chip. The examiner needs to access the encrypted APFS volume. Which method is the most appropriate?
Select an answer first
38application · medium
A Linux system with a UEFI firmware fails to boot after a GRUB configuration change. The administrator needs to restore the bootloader. Which command should be used to reinstall GRUB to the EFI System Partition?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.

Boot Processes and File Systems Across Windows, Linux, and macOS DFE Practice Questions (Page 8)

Questions 36–38

A Windows 10 system fails to boot with the error 'Bootmgr is missing'. The administrator suspects the Boot Configuration Data (BCD) is corrupted. Which recovery step should be attempted first?

A forensic examiner is analyzing a MacBook Pro that runs macOS Big Sur (11) with an Apple T2 security chip. The examiner needs to access the encrypted APFS volume. Which method is the most appropriate?

A Linux system with a UEFI firmware fails to boot after a GRUB configuration change. The administrator needs to restore the bootloader. Which command should be used to reinstall GRUB to the EFI System Partition?

Keep studying — Storage Media and Data Acquisition