Hard Disks and File Systems ECSS Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An examiner is recovering files from a FAT32 volume. The examiner finds a directory entry with the first byte set to 0xE5. What does this indicate, and what is the next step in recovery?

   • AThe file is a system file; the examiner should skip it to avoid corrupting the volume.
   • BThe file is active; the examiner should read the starting cluster from the entry and follow the FAT chain.
   • CThe file is encrypted; the examiner needs the decryption key from the FAT.
   • DThe file is deleted; the examiner should note the starting cluster and attempt to reconstruct the FAT chain from the directory entry.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   An examiner is investigating a drive that was formatted with NTFS and then used for a short time. The examiner needs to recover files that were deleted before the format. Which statement best describes the recovery outlook?

   • AThe format completely erases all data, so recovery is impossible.
   • BThe format preserves the old MFT, so pre-format files can be recovered exactly as before.
   • CThe format converts the file system to FAT32, so NTFS recovery tools are ineffective.
   • DThe format likely overwrote the MFT and key metadata, making recovery of pre-format files difficult but not impossible if data clusters remain.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   An examiner is investigating a Windows 10 system that was used to download sensitive documents. The user claims the files were deleted using Shift+Delete. The examiner needs to recover the files. The system uses NTFS with a 4 KB cluster size. The examiner has a forensic image of the drive. Which approach is most likely to recover the files?

   • ACheck the MFT for the files' entries and read the data runs directly.
   • BUse the Previous Versions feature to recover the files from shadow copies.
   • CScan unallocated space for file signatures and carve the files.
   • DRestore the files from the Recycle Bin using the $Recycle.Bin folder.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which file system is natively supported by modern Windows operating systems and provides features such as file permissions, encryption, and journaling?

   • AFAT32
   • BNTFS
   • Cext4
   • DHFS+
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A forensic investigator needs to recover a deleted file from an NTFS volume. The file was small enough to fit entirely within its MFT record. Which approach is most likely to recover the file content?

   • AUse the FAT to follow the cluster chain and read the data clusters.
   • BScan the unallocated clusters for the file signature and carve the data.
   • CRecover the file from the Recycle Bin by restoring it to its original location.
   • DExamine the $MFT for the file record and extract the data from the resident attribute.
   Reveal Solution Discussion Select an answer first