An examiner is investigating a Windows 10 system. A suspect file was deleted from an NTFS volume, and the examiner wants to recover it. The volume is heavily fragmented, and the file was larger than one cluster. The examiner has a full disk image. Which recovery method is most likely to succeed?

Perform file carving on the unallocated space using the file's signature.

Use the Recycle Bin to restore the file.

Use forensic software to parse the $MFT and reconstruct the file from its data runs, even if the MFT record is marked as deleted.

Restore the file from the Volume Shadow Copy service.

Which of the following is a key difference between FAT and NTFS file systems?

FAT supports larger file sizes than NTFS.

NTFS supports journaling, while FAT does not.

FAT supports file-level permissions, while NTFS does not.

NTFS is compatible with all operating systems, while FAT is not.

A forensic examiner is documenting the physical structure of a hard disk for a report. The disk has 2 platters, 4 heads, 1000 cylinders, and 63 sectors per track. What is the total storage capacity of this disk, assuming 512 bytes per sector?

4 × 2 × 1000 × 63 × 512 bytes

An examiner is investigating a Linux system with an ext4 partition. A suspect file was deleted, and the partition has been unmounted since deletion. The examiner wants to recover the file. Which approach is most likely to succeed?

Use a tool like extundelete or debugfs to recover the file from the ext4 journal and inode data.

Mount the partition read-write and copy the file from the Recycle Bin.

Run a FAT file system recovery tool to scan the partition.

Read the $MFT to locate the deleted file's record.

EC-CouncilCertified Security Specialist

Domain 5Objective 3

Hard Disks and File Systems ECSS Practice Questions (Page 5)

Part of the Digital Forensics Fundamentals and Acquisition domain, which makes up ~12% of our current practice bank.

33questions here

7free pages

4concepts

Questions 21–25

21foundation · easy
Which hard disk structure is defined as the set of all tracks that are at the same distance from the center of the platters?
Select an answer first
22expert · hard
An examiner is investigating a Windows 10 system. A suspect file was deleted from an NTFS volume, and the examiner wants to recover it. The volume is heavily fragmented, and the file was larger than one cluster. The examiner has a full disk image. Which recovery method is most likely to succeed?
Select an answer first
23foundation · easy
Which of the following is a key difference between FAT and NTFS file systems?
Select an answer first
24application · medium
A forensic examiner is documenting the physical structure of a hard disk for a report. The disk has 2 platters, 4 heads, 1000 cylinders, and 63 sectors per track. What is the total storage capacity of this disk, assuming 512 bytes per sector?
Select an answer first
25expert · hard
An examiner is investigating a Linux system with an ext4 partition. A suspect file was deleted, and the partition has been unmounted since deletion. The examiner wants to recover the file. Which approach is most likely to succeed?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.