Hard Disks and File Systems ECSS Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A forensic examiner is analyzing a disk image and needs to determine the cluster size of an NTFS volume. Which structure or field provides this information directly?

   • AThe $Bitmap file
   • BThe File Record Segment (FRS) number
   • CThe $MFT record header
   • DThe Boot Sector's BPB (BIOS Parameter Block)
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A forensic examiner is analyzing a FAT32 volume and finds a deleted file's directory entry. The entry indicates the starting cluster number, but the FAT entries for the file's clusters have been zeroed. The file was stored in multiple non-contiguous clusters. Which recovery approach is most likely to succeed?

   • APerform file carving on the unallocated space using the file's signature.
   • BUse the starting cluster number to read the file sequentially from the disk.
   • CRestore the file from the Volume Shadow Copy service.
   • DParse the NTFS $MFT to find the file's data runs.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   During an investigation, an examiner finds a file that was deleted from an NTFS volume. The file's MFT record has been reused by another file, but the original data clusters are still intact in unallocated space. Which technique is most appropriate to recover the file content?

   • APerform file carving based on the file's known signature.
   • BRead the data from the $Bitmap to locate the clusters.
   • CParse the $LogFile to recover the original MFT record.
   • DUse the Recycle Bin to restore the file.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A forensic examiner is comparing the file systems of two seized drives: one is FAT32 and the other is NTFS. The examiner needs to recover deleted files from both. Which statement accurately describes a key difference that affects the recovery process?

   • AFAT32 stores file data in a central file table, while NTFS uses a linked list of clusters.
   • BNTFS uses a Master File Table that contains file metadata, while FAT32 stores metadata in directory entries.
   • CFAT32 supports file permissions and encryption, while NTFS does not.
   • DNTFS uses a File Allocation Table, while FAT32 uses an index of inodes.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A forensic examiner is analyzing a Linux system that uses ext4. The examiner needs to recover a deleted file that was stored in a directory. The file's inode is still present but marked as free. Which statement best describes the recovery challenge?

   • AThe file's data is encrypted with the inode's key, so recovery requires the user's password.
   • BThe inode's block pointers are cleared, so the examiner must rely on journal or directory entry remnants to locate the data blocks.
   • CThe file's data is still accessible through the directory entry, so recovery is straightforward.
   • Dext4 automatically moves deleted files to a hidden trash folder, making recovery trivial.
   Reveal Solution Discussion Select an answer first