Disk Drive Types and Logical Structure of a Disk DFE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A forensic examiner must acquire a laptop that has a 256 GB SSD with hardware-based full-disk encryption (FDE) enabled. The laptop is powered off, and the examiner does not have the password. The examiner needs to acquire the data for analysis. Which approach is most likely to yield usable evidence?

   • AObtain the password from the suspect or use legal authority to compel disclosure, then power on the laptop and acquire the data.
   • BPerform a physical acquisition of the SSD and attempt to decrypt the image using brute-force or dictionary attacks.
   • CAcquire the RAM first to look for the encryption key, then perform a physical acquisition of the SSD.
   • DPerform a logical acquisition by booting the laptop with a live forensic OS, because the encryption is transparent to the OS.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A forensic examiner is analyzing a disk image from a Linux system. The image contains a partition formatted with ext4. The examiner needs to determine the block size of the file system. Which structure should the examiner examine?

   • AThe directory entry, which contains the file name and inode number.
   • BThe block group descriptor, which describes each block group.
   • CThe superblock, which contains the block size field.
   • DThe inode of a file, which contains the file's block pointers.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A forensic analyst is comparing the logical structure of a traditional HDD and an SSD. The analyst needs to explain to a colleague why the concept of 'cylinders' is less relevant for SSDs. Which statement is accurate?

   • ASSDs use sectors but not tracks, so cylinders are not needed.
   • BSSDs do not have moving parts, so there is no physical cylinder geometry; data is stored in NAND flash cells and addressed by logical block addresses.
   • CSSDs still use cylinders, but they are smaller than those on HDDs.
   • DSSDs use cylinders but they are virtualized in firmware, making them irrelevant to the operating system.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A forensic team must acquire the internal SSD of a laptop that was used to send threatening emails. The SSD supports the TRIM command and has been in use for several months. The team needs to maximize the chance of recovering deleted email fragments. Which acquisition strategy is most appropriate?

   • APerform a physical acquisition using a hardware write blocker immediately, before the SSD's garbage collection can erase more blocks.
   • BPerform a forensic image of only the free space, because deleted email fragments are likely in unallocated space.
   • CUse a software tool that sends a secure erase command to the SSD to ensure all data is wiped before acquisition.
   • DPerform a logical acquisition of the file system, because TRIM has likely already erased deleted data blocks.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which file system is commonly used by modern Linux distributions as the default native file system?

   • AHFS+
   • BFAT32
   • CNTFS
   • Dext4
   Reveal Solution Discussion Select an answer first