Disk Drive Types and Logical Structure of a Disk DFE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A forensic examiner is examining a disk image from a Windows system that has a single NTFS partition. The examiner needs to determine which clusters are allocated to a specific file. Which structure should the examiner examine to find the file's cluster allocation?

   • AThe File Allocation Table (FAT), which maps cluster chains.
   • BThe Master File Table (MFT) entry for the file, which contains data runs.
   • CThe volume bitmap, which shows which clusters are in use.
   • DThe boot sector, which contains the cluster size.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A forensic examiner is tasked with acquiring evidence from a laptop that has an SSD with hardware-based encryption. The laptop is powered on and the user is logged in. The examiner needs to acquire the disk while preserving the ability to decrypt the data. Which of the following is the most appropriate approach?

   • AShut down the laptop and acquire the disk using a hardware write blocker.
   • BPerform a logical acquisition of the files while the system is running.
   • CRemove the SSD and acquire it using a hardware write blocker.
   • DPerform a live acquisition while the system is running and the encryption keys are in memory.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A forensic examiner is analyzing a disk image from a system that uses BitLocker encryption. The examiner has the recovery key. Which of the following is the most appropriate way to decrypt the disk image?

   • AUse a hardware write blocker to bypass the encryption.
   • BAcquire the memory dump to extract the encryption key.
   • CMount the image and use the recovery key to unlock the volume.
   • DUse a brute-force attack to recover the encryption key.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which term describes all tracks that are at the same distance from the center of a hard disk platter?

   • ACylinder
   • BSector
   • CCluster
   • DPartition
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which characteristic is unique to hybrid drives (SSHDs) compared to standard HDDs?

   • AThey have no moving parts
   • BThey contain a small amount of NAND flash memory to cache frequently accessed data
   • CThey use laser beams to read data from a reflective surface
   • DThey use only flash memory for all data storage
   Reveal Solution Discussion Select an answer first