A forensic examiner is documenting the logical structure of a hard disk for a report. Which statement correctly describes the relationship between sectors and clusters?

A cluster is a group of one or more sectors and is the smallest unit of disk space that a file system can allocate.

A sector is the smallest unit of allocation in NTFS.

A sector is a group of clusters and is the smallest unit of allocation.

A cluster is always 512 bytes in size.

A forensic examiner is investigating a Linux system and needs to recover a deleted file from an ext4 partition. The file was recently deleted and the partition has been unmounted since deletion. Which approach is most likely to succeed?

Use a tool like extundelete or debugfs to recover the file from the ext4 journal and inode data.

Mount the partition read-write and copy the file from the Recycle Bin.

Run a FAT file system recovery tool to scan the partition.

Read the $MFT to locate the deleted file's record.

EC-CouncilCertified Security Specialist

Domain 5Objective 3

Hard Disks and File Systems ECSS Practice Questions (Page 6)

Part of the Digital Forensics Fundamentals and Acquisition domain, which makes up ~12% of our current practice bank.

33questions here

7free pages

4concepts

Questions 26–30

26application · medium
A forensic examiner is analyzing a disk image and finds that a file's directory entry indicates a file size of 10,000 bytes, but the file system's allocation unit size is 4,096 bytes. How many clusters are allocated to this file?
Select an answer first
27application · medium
A forensic examiner is comparing the maximum file size supported by different file systems to determine which one could have stored a large video file found on a seized drive. The file is 6 GB. Which file system could NOT have stored this file as a single file?
Select an answer first
28application · medium
A forensic examiner is documenting the logical structure of a hard disk for a report. Which statement correctly describes the relationship between sectors and clusters?
Select an answer first
29application · medium
A forensic examiner is investigating a Linux system and needs to recover a deleted file from an ext4 partition. The file was recently deleted and the partition has been unmounted since deletion. Which approach is most likely to succeed?
Select an answer first
30foundation · easy
In the physical structure of a hard disk, which term describes the concentric circular paths on the surface of a platter where data is stored?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.

Hard Disks and File Systems ECSS Practice Questions (Page 6)

Questions 26–30

A forensic examiner is analyzing a disk image and finds that a file's directory entry indicates a file size of 10,000 bytes, but the file system's allocation unit size is 4,096 bytes. How many clusters are allocated to this file?

A forensic examiner is comparing the maximum file size supported by different file systems to determine which one could have stored a large video file found on a seized drive. The file is 6 GB. Which file system could NOT have stored this file as a single file?

A forensic examiner is documenting the logical structure of a hard disk for a report. Which statement correctly describes the relationship between sectors and clusters?

A forensic examiner is investigating a Linux system and needs to recover a deleted file from an ext4 partition. The file was recently deleted and the partition has been unmounted since deletion. Which approach is most likely to succeed?

In the physical structure of a hard disk, which term describes the concentric circular paths on the surface of a platter where data is stored?

Keep studying — Digital Forensics Fundamentals and Acquisition