Disk Drive Types and Logical Structure of a Disk DFE Practice Questions (Page 7)

Questions 31–34

1. 31foundation · easy

   Which best practice should be followed when acquiring data from a disk to preserve its evidentiary integrity?

   • AUse a hardware write-blocker to prevent any modifications to the source disk
   • BCopy only active files to a new disk to save time
   • CBoot the suspect system normally to ensure the disk is ready for imaging
   • DRun disk repair tools before imaging to fix any errors
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A forensic examiner is analyzing a disk image from a Windows system that has a single NTFS partition. The examiner needs to determine the size of a file's data on disk, which may be larger than the file's logical size due to slack space. Which structure should the examiner examine to find the file's allocated size?

   • AThe file's directory entry, which contains the file's logical size.
   • BThe volume bitmap, which shows which clusters are allocated.
   • CThe boot sector, which contains the cluster size.
   • DThe MFT entry's data attribute, which contains the file's data runs and the allocated size.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A forensic examiner is analyzing a disk image from a system that uses a RAID 0 array. The examiner needs to recover data from the array. Which of the following is the most important consideration?

   • ARAID 0 uses parity, which can be used to recover data.
   • BRAID 0 provides redundancy, so data can be recovered from any single disk.
   • CThe examiner can acquire each disk individually and analyze them separately.
   • DThe examiner must reconstruct the RAID array to access the data.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A forensic examiner is acquiring evidence from a computer that has a hybrid drive (SSHD). The examiner needs to ensure that all data, including data that may have been cached on the SSD portion, is acquired. Which of the following is the most appropriate approach?

   • AAcquire only the HDD portion, as the SSD cache is not relevant.
   • BAcquire only the SSD portion, as it contains the most recent data.
   • CAcquire the entire hybrid drive as a single logical unit.
   • DAcquire the HDD and SSD portions separately using specialized hardware.
   Reveal Solution Discussion Select an answer first