Practice Test Geeks(CCE) Certified Computer Examiner Practice Test
← All CCE Flashcard Decks

File Systems & Data Recovery Flashcards

7 cards from real CCE practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 File Systems & Data Recovery flashcards as text

  1. What term describes the area on a hard disk between the end of one partition and the start of the next, which may contain hidden or deleted data?

    Answer: Unpartitioned space

    Unpartitioned space (also called inter-partition space) is the area on a disk not assigned to any partition and can be used to hide data or may contain remnants of old partitions.

  2. Which Windows artifact stores up to the last 1,000 commands typed into the command prompt during a session?

    Answer: ConsoleHost history

    PowerShell/ConsoleHost_history.txt and the in-memory console command history store recently executed commands, which can provide evidence of attacker or user activity.

  3. In a GUID Partition Table (GPT) disk, where is the primary partition table header located?

    Answer: Sector 1

    In GPT, sector 0 holds a Protective MBR for legacy compatibility, and the primary GPT header is stored in sector 1 (LBA 1), with a backup at the last sector.

  4. What is the purpose of the $LogFile in NTFS?

    Answer: Provides transaction journaling for metadata changes

    $LogFile is NTFS's transaction log that records metadata changes, allowing the file system to recover from crashes by replaying or rolling back incomplete transactions.

  5. During data carving, a forensic tool identifies a file header signature but cannot find a footer signature. What is the most likely outcome?

    Answer: The tool will carve a file up to a maximum size limit

    When no footer is found, most carving tools recover data up to a configurable maximum file size, which may result in a larger-than-actual file or truncated output.

  6. Which of the following best describes the concept of 'time stomping' in a forensic investigation?

    Answer: Deliberately modifying file timestamps to obscure activity

    Time stomping is an anti-forensics technique where an attacker alters MAC(E) timestamps on files to disguise when they were created, modified, or accessed.

  7. What Windows file system feature can store alternate versions of a file's $DATA attribute under a different name, sometimes used to hide data?

    Answer: Alternate Data Streams

    NTFS Alternate Data Streams (ADS) allow additional data to be associated with a file under a colon-separated name (e.g., file.txt:hidden), which is invisible in standard directory listings.