Hard Disks and File Systems ECSS Practice Questions (Page 7)

Questions 31–33

1. 31application · hard

   During a forensic examination of an NTFS volume, an investigator finds a file that was supposedly deleted but its data is still accessible through the filesystem. The file's MFT entry is marked as in use, but the file is not visible in any directory. Which NTFS feature best explains this situation?

   • AThe file is an orphaned file whose MFT entry is still marked in use but has no directory entry pointing to it.
   • BThe file is a compressed file that NTFS keeps in a special cache.
   • CThe file is a system file that is hidden by the NTFS $AttrDef attribute.
   • DThe file is a resident file stored entirely within the MFT entry.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   When a file is deleted in a typical file system, what happens to the file's data blocks?

   • AThey are immediately overwritten with zeros.
   • BThey are moved to a hidden recovery partition.
   • CThey are encrypted to prevent recovery.
   • DThey are marked as free and may still contain the original data until overwritten.
   Reveal Solution Discussion Select an answer first
3. 33application · medium

   A forensic analyst is examining a disk image and needs to determine the cluster size of an NTFS volume. The analyst knows the volume's total size and the number of clusters. Which additional information is required to calculate the cluster size?

   • AThe volume's serial number.
   • BThe size of the Master File Table (MFT).
   • CThe number of sectors per cluster.
   • DThe number of heads and cylinders.
   Reveal Solution Discussion Select an answer first