Hard Disks and File Systems ECSS Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which area of a hard disk is often examined by forensic investigators because it can contain hidden data that is not visible in the normal file system?

   • AThe Master Boot Record (MBR)
   • BThe slack space between the end of a file and the end of its last allocated cluster
   • CThe file allocation table (FAT)
   • DThe root directory
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A forensic examiner is documenting the physical layout of a seized hard drive. The drive has 4 platters, 8 heads, and 1,024 cylinders. During analysis, the examiner needs to identify the total number of tracks on the drive. Which calculation is correct?

   • A8 heads × 4 platters × 1,024 cylinders = 32,768 tracks
   • B4 platters × 1,024 cylinders = 4,096 tracks
   • C8 heads × 1,024 cylinders = 8,192 tracks
   • D4 platters × 8 heads = 32 tracks
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A forensic lab receives a USB drive that was used to transfer evidence between Windows and Linux systems. The drive is formatted with exFAT. The examiner needs to recover a deleted file that was stored in multiple non-contiguous clusters. Which characteristic of exFAT is most relevant to the recovery effort?

   • AexFAT uses a FAT (File Allocation Table) that stores cluster chain information, which can be used to reconstruct fragmented files if the FAT entries are still intact.
   • BexFAT stores all files as contiguous clusters, so fragmentation is not an issue.
   • CexFAT stores file data in a journal, allowing recovery from the journal.
   • DexFAT uses MFT records similar to NTFS, which contain data runs for fragmented files.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   An examiner is investigating a suspect's external drive formatted with NTFS. The examiner finds a deleted file that was stored in a single cluster, but the MFT record has been reused by another file. The original data cluster is still intact. Which technique is most appropriate to recover the file content?

   • AUse the Recycle Bin to restore the file.
   • BParse the $LogFile to recover the original MFT record.
   • CPerform file carving on the unallocated space using the file's known signature.
   • DRead the $Bitmap to locate the cluster and extract the data.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   In a file system, what is the primary purpose of file metadata?

   • ATo provide a backup copy of the file
   • BTo encrypt the file's contents
   • CTo describe the file's attributes, such as size, timestamps, and permissions
   • DTo store the actual content of the file
   Reveal Solution Discussion Select an answer first