Disk Drive Types and Logical Structure of a Disk DFE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A forensic examiner is examining a USB flash drive that was found at a crime scene. The drive is formatted with FAT32. The examiner needs to recover a deleted file. Which aspect of FAT32 is most relevant to the recovery?

   • AThe volume bitmap tracks which clusters are in use.
   • BThe File Allocation Table contains entries that map clusters to files; after deletion, the entries are cleared, but the file's data may remain in the clusters.
   • CThe boot sector contains the file's starting cluster number.
   • DThe Master File Table (MFT) contains the file's metadata and data runs.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A forensic examiner is preparing to analyze a disk image from a Linux server that uses ext4. The examiner needs to identify the file system's block size and the location of the superblock. Which of the following tools or commands would be most appropriate?

   • AUse the `lsblk` command to list block devices.
   • BUse the `fdisk` command to view the partition table.
   • CUse the `dumpe2fs` command to display file system superblock information.
   • DUse the `mount` command to check the file system type.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A forensic lab receives a computer that was used to download illegal content. The computer has a solid-state drive (SSD). The examiner needs to acquire the drive. Which consideration is most important when acquiring an SSD compared to an HDD?

   • AThe SSD's wear-leveling and garbage collection may have already erased deleted data, so the acquisition should be performed as soon as possible.
   • BThe SSD's cluster size is larger than an HDD's, so the acquisition must be adjusted.
   • CThe SSD must be imaged using a software tool because hardware write blockers do not work with SSDs.
   • DThe SSD's platters must be removed and imaged separately.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A forensic examiner is asked to acquire evidence from a computer that has a hybrid drive (SSHD). The examiner needs to ensure that all data, including data that may have been cached on the SSD portion, is acquired. Which of the following is the most important consideration?

   • AThe SSD portion should be acquired separately from the HDD portion.
   • BThe SSD portion of the hybrid drive is volatile and may lose data when powered off.
   • CThe hybrid drive's cache is not relevant to forensic acquisition.
   • DThe hybrid drive should be treated as a single logical unit for acquisition.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A forensic examiner is analyzing a disk image from a Linux system that uses ext4. The examiner needs to find the location of a specific file's data on the disk. Which structure should the examiner consult to find the file's data blocks?

   • AThe inode of the file, which contains pointers to the data blocks.
   • BThe directory entry, which contains the file's name and inode number.
   • CThe superblock, which contains the file system's overall information.
   • DThe block group descriptor table, which describes each block group.
   Reveal Solution Discussion Select an answer first