Hard Disks and File Systems ECSS Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A forensic examiner is analyzing a disk image and needs to determine the cluster size of an NTFS volume. The examiner knows the volume's total size and the number of clusters. Which additional information is required to calculate the cluster size?

   • AThe size of the Master File Table (MFT).
   • BThe volume's serial number.
   • CThe number of sectors per cluster.
   • DThe number of heads and cylinders.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An examiner is analyzing a USB drive that was used on both Windows and macOS systems. The drive contains a deleted file that the examiner wants to recover. The examiner notices the file's directory entry still exists but the data clusters are marked as free. Which file system is most likely in use, and what does this indicate?

   • Aext4 — the inode is cleared, and the data blocks are wiped for security.
   • BNTFS — the file's $MFT entry is marked as deleted, and the clusters are immediately zeroed.
   • CFAT32 — the file's directory entry remains, but the clusters are unallocated and may be overwritten.
   • DAPFS — the file is purged immediately, and recovery is impossible.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which file system concept defines the smallest logical unit of disk space that can be allocated to store a file?

   • ADirectory
   • BAllocation unit (cluster)
   • CPartition
   • DSector
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   During an investigation, an examiner finds a deleted file on an NTFS volume. The file's MFT record is still present but marked as deleted. The file was stored in a single cluster. Which step is most directly required to recover the file content?

   • ACheck the FAT to locate the cluster chain.
   • BRun a file carving tool that searches for the file signature in unallocated space.
   • CRestore the file from the Recycle Bin.
   • DParse the MFT record to obtain the data run and read the corresponding cluster.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   During a forensic investigation, an examiner finds a file that was deleted from an NTFS volume. The file's MFT entry is still present, but the data runs are no longer referenced. What is the most likely reason the file's data can still be recovered?

   • ANTFS automatically backs up all deleted files to the System Volume Information folder.
   • BThe file was encrypted with EFS, and the decryption key is stored in the MFT entry.
   • CThe MFT entry is marked as deleted, but the data clusters have not been overwritten.
   • DThe file was a resident file, and its data is stored in the MFT entry, which is never overwritten.
   Reveal Solution Discussion Select an answer first