EC-CouncilDigital Forensics Essentials
Domain 2Objective 3
File System Analysis and Data Recovery DFE Practice Questions (Page 4)
Part of the Storage Media and Data Acquisition domain, which makes up ~12% of our current practice bank.
41questions here
9free pages
7concepts
Questions 16–20
- 16
Which file system is natively used by modern macOS systems and supports features such as journaling, snapshots, and case-sensitive file names?
Select an answer first - 17
An investigator is analyzing a disk image from a suspect's computer. The file system is heavily fragmented, and many files were deleted months ago. The investigator wants to recover a specific PDF document that was deleted. The file system metadata for the PDF is no longer available. What is the best approach?
Select an answer first - 18
Which file system is commonly used on USB flash drives and memory cards because of its wide compatibility with operating systems, but has a maximum file size limit of 4 GB?
Select an answer first - 19
Which file system metadata is used by the operating system to control which users or groups can read, write, or execute a file?
Select an answer first - 20
Which component of a file system is responsible for dividing a storage device into logical sections that the operating system can address?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.