Disk Drive Types and Logical Structure of a Disk DFE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A forensic examiner is analyzing a disk image from a Windows 10 system that uses NTFS. The examiner needs to locate the Master File Table (MFT) to find evidence of deleted files. Which of the following is the most accurate statement about the MFT?

   • AThe MFT is always located at the beginning of the partition.
   • BThe MFT is stored in a single contiguous block of clusters.
   • CThe MFT contains a record for every file and directory on the volume.
   • DThe MFT is only accessible when the system is running.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A forensic examiner is analyzing a disk image from a Windows system that uses NTFS. The examiner needs to identify the cluster size and the location of the MFT. Which of the following tools would be most appropriate?

   • A`wmic`
   • B`diskpart`
   • C`chkdsk`
   • D`fsutil fsinfo ntfsinfo`
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A forensic examiner is acquiring evidence from a computer that has an SSD. The examiner is concerned about the wear-leveling algorithm and its effect on data recovery. Which of the following is the most accurate statement regarding wear-leveling and forensic acquisition?

   • AWear-leveling ensures that deleted data is immediately overwritten.
   • BWear-leveling only affects HDDs, not SSDs.
   • CWear-leveling can cause data to be moved, making recovery more complex.
   • DWear-leveling has no effect on forensic acquisition.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A forensic examiner receives a laptop that was used to store sensitive documents. The laptop has a 512 GB SSD and a 1 TB HDD. The examiner needs to acquire a forensic image of the drive that contains the documents. The laptop is currently running, and the examiner wants to minimize the risk of altering data on the drive. Which approach is most appropriate?

   • AShut down the laptop and perform a static acquisition of both drives using a hardware write blocker.
   • BBoot the laptop from a forensic live CD and acquire both drives over the network.
   • CRemove the SSD and acquire it using a software write blocker, leaving the HDD in place.
   • DPerform a live acquisition of the SSD using a hardware write blocker.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A forensic examiner is analyzing a disk image from a system that uses a file system with a journaling feature. The examiner needs to recover a file that was recently deleted. Which of the following is the most important consideration?

   • AThe journal is overwritten immediately after a file is deleted.
   • BThe journal is only used for system files, not user files.
   • CThe journal may contain metadata about the deleted file, which can aid in recovery.
   • DThe journal does not contain any information about deleted files.
   Reveal Solution Discussion Select an answer first