Disk Drive Types and Logical Structure of a Disk DFE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A forensic analyst is examining a hard disk drive that has been partitioned with a single NTFS volume. The analyst needs to locate a specific file that was deleted. The file's data was stored in clusters that are now marked as free. The analyst wants to recover the file by manually examining the raw disk. Which logical structure should the analyst focus on to find the file's data?

   • AThe file system's bitmap, which indicates which clusters are allocated and which are free.
   • BThe Master File Table (MFT) entries that may still contain the file's cluster runs.
   • CThe partition table, which defines the boundaries of the partition on the disk.
   • DThe boot sector, which contains the file system parameters such as cluster size and number of sectors per cluster.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A forensic examiner is analyzing a disk image from a Windows 10 system. The image contains a single NTFS partition. The examiner needs to determine the cluster size of the volume to calculate the number of clusters that a particular file occupies. Which structure should the examiner examine to find the cluster size?

   • AThe Master File Table (MFT) entry for the file.
   • BThe file system's bitmap.
   • CThe partition table entry for the partition.
   • DThe boot sector of the NTFS volume.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which disk drive type uses NAND flash memory to store data with no moving parts?

   • AHDD
   • BOptical drive
   • CSSD
   • DHybrid drive
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary purpose of disk partitioning?

   • ATo permanently erase all data on the disk
   • BTo combine multiple physical disks into a single logical volume
   • CTo increase the physical rotation speed of the disk platters
   • DTo divide a physical disk into logical sections that can be formatted with file systems and used independently
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A forensic examiner is analyzing a disk image from an old computer that used a FAT32 file system. The examiner needs to recover a deleted file. The file was stored in a cluster that is now marked as free. The examiner knows the cluster size is 4 KB. Which of the following best describes the logical structure the examiner should focus on?

   • AThe File Allocation Table (FAT) and the cluster chain.
   • BThe superblock and inode table.
   • CThe Master Boot Record (MBR) and the partition table.
   • DThe Master File Table (MFT) and its entries.
   Reveal Solution Discussion Select an answer first