CCE File Systems & Data Recovery 3

Question 1

What term describes the area on a hard disk between the end of one partition and the start of the next, which may contain hidden or deleted data?

Accepted Answer

Unpartitioned space

Answer

Unpartitioned space (also called inter-partition space) is the area on a disk not assigned to any partition and can be used to hide data or may contain remnants of old partitions.

Question 2

Which Windows artifact stores up to the last 1,000 commands typed into the command prompt during a session?

Accepted Answer

ConsoleHost history

Answer

PowerShell/ConsoleHost_history.txt and the in-memory console command history store recently executed commands, which can provide evidence of attacker or user activity.

Question 3

In a GUID Partition Table (GPT) disk, where is the primary partition table header located?

Accepted Answer

Sector 1

Answer

In GPT, sector 0 holds a Protective MBR for legacy compatibility, and the primary GPT header is stored in sector 1 (LBA 1), with a backup at the last sector.

Question 4

What is the purpose of the $LogFile in NTFS?

Accepted Answer

Provides transaction journaling for metadata changes

Answer

$LogFile is NTFS's transaction log that records metadata changes, allowing the file system to recover from crashes by replaying or rolling back incomplete transactions.

Question 5

During data carving, a forensic tool identifies a file header signature but cannot find a footer signature. What is the most likely outcome?

Accepted Answer

The tool will carve a file up to a maximum size limit

Answer

When no footer is found, most carving tools recover data up to a configurable maximum file size, which may result in a larger-than-actual file or truncated output.

(CCE) Certified Computer Examiner Practice Test

(CCE) Certified Computer Examiner Practice Test

CCE File Systems & Data Recovery 3