Storage Technologies GBFA Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A forensic examiner is analyzing a disk image and finds that the file system reports a file size of 10 MB, but the data runs in the MFT only account for 8 MB of clusters. The remaining 2 MB is stored in an alternate data stream (ADS). Which layer of the storage hierarchy is responsible for tracking the ADS?

   • AThe disk firmware, which manages physical sector layout.
   • BThe partition table, which defines the boundaries of the volume.
   • CThe device driver, which handles I/O requests.
   • DThe file system metadata, which maintains multiple data streams for a single file.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A forensic examiner is preparing to acquire a SATA HDD that is connected to a forensic workstation via a hardware write-blocker. The write-blocker is connected to the workstation's eSATA port. The examiner notices that the write-blocker's LED indicates 'write' activity during the acquisition. What is the most appropriate action?

   • AStop the acquisition immediately and verify the write-blocker's configuration and connection.
   • BIgnore the LED and rely on the forensic imaging software to ensure write protection.
   • CContinue the acquisition, as the LED may indicate read activity due to a mislabeled indicator.
   • DDisconnect the write-blocker and connect the HDD directly to the workstation to speed up the acquisition.
   Reveal Solution Discussion Select an answer first
4. 38application · easy

   A forensic examiner receives a seized desktop computer with a traditional 3.5-inch SATA HDD. The examiner needs to create a forensically sound image. Which acquisition method is most appropriate?

   • ARemove the HDD and connect it to a forensic workstation via a hardware write-blocker, then image it using a forensic imaging tool.
   • BBoot the computer with a live Linux CD and use the dd command to image the HDD to an external USB drive.
   • CConnect the HDD directly to the forensic workstation's SATA port without a write-blocker and image it.
   • DUse a USB-to-SATA adapter without a write-blocker and image the HDD to a network share.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A field investigator must acquire a laptop SSD that uses an M.2 NVMe interface. The forensic workstation has only SATA and USB 3.0 ports. The investigator has a write-blocker that accepts only SATA drives. Which approach is most appropriate for acquiring the NVMe SSD while preserving evidentiary integrity?

   • AAttach the SSD to the SATA port using an M.2-to-SATA adapter and use the existing SATA write-blocker.
   • BUse a hardware write-blocker that supports NVMe over USB, then image the SSD through the blocker to a forensic image file.
   • CConnect the SSD to the workstation via a USB-to-NVMe adapter and image it without a hardware write-blocker, relying on software to prevent writes.
   • DBoot the laptop from a forensic live CD and acquire the SSD over the network using dd, avoiding the need for a write-blocker.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   What is the process of logically dividing a physical storage device into separate sections that can be formatted with different file systems?

   • ADefragmentation
   • BPartitioning
   • CImaging
   • DFormatting
   Reveal Solution Discussion Select an answer first