CCE File Systems & Data Recovery 4 — Questions and Answers
Question 1: What is the default cluster size for an NTFS volume formatted on a partition larger than 2 GB?
- 512 bytes
- 1,024 bytes
- 4,096 bytes (Correct answer)
- 8,192 bytes
Correct answer: 4,096 bytes
Windows defaults to 4,096-byte (4 KB) clusters for NTFS volumes larger than 2 GB, balancing storage efficiency and performance.
Question 2: In HFS+ (Mac OS Extended), which structure is equivalent to the NTFS MFT and stores file metadata?
- Catalog File (Correct answer)
- Extents Overflow File
- Allocation File
- Journal
Correct answer: Catalog File
The HFS+ Catalog File is a B-tree that stores records for all files and directories on the volume, serving the same metadata role as the NTFS MFT.
Question 3: When recovering data from a RAID 5 array with one failed drive, what is the minimum number of remaining drives needed to reconstruct the missing data?
- All remaining drives (Correct answer)
- Any two drives
- Any one drive
- The parity drive only
Correct answer: All remaining drives
RAID 5 stores parity distributed across all drives, so ALL remaining drives (n-1) must be operational to reconstruct the data from the failed drive using XOR parity.
Question 4: What is the role of the Volume Boot Record (VBR) in a FAT or NTFS volume?
- Stores user account security identifiers
- Contains the BPB and bootstrap code needed to mount the volume (Correct answer)
- Tracks bad cluster locations
- Stores the partition style (MBR vs GPT)
Correct answer: Contains the BPB and bootstrap code needed to mount the volume
The Volume Boot Record contains the BIOS Parameter Block (BPB), which describes volume geometry and layout, and bootstrap code that initiates the OS loading process.
Question 5: A forensic examiner is analyzing a disk and finds that the first sector of a partition contains 'EB 52 90 4E 54 46 53'. What does this indicate?
- The partition uses FAT32
- The partition uses NTFS (Correct answer)
- The sector is a GPT header
- The partition is unformatted
Correct answer: The partition uses NTFS
'EB 52 90' is the x86 jump instruction prefix and '4E 54 46 53' is the ASCII string 'NTFS', which are the first bytes of an NTFS Volume Boot Record.
Question 6: Which data recovery scenario benefits most from the use of a write blocker?
- Recovering data from a network share
- Imaging a suspect drive without altering its contents (Correct answer)
- Rebuilding a corrupted RAID array
- Decrypting a BitLocker-protected volume
Correct answer: Imaging a suspect drive without altering its contents
A write blocker prevents any write commands from reaching the source drive during imaging, preserving the forensic integrity of the original evidence.
Question 7: What does the term 'orphaned file' mean in the context of file system forensics?
- A file with no read permissions
- A file whose directory entry exists but has no parent directory reference (Correct answer)
- A file that has been wiped with DoD-standard overwriting
- A file stored in slack space
Correct answer: A file whose directory entry exists but has no parent directory reference
An orphaned file is one whose inode or MFT record still exists but has been disconnected from its parent directory, often due to corruption or anti-forensics techniques.
CCE File Systems & Data Recovery 4
What is the default cluster size for an NTFS volume formatted on a partition larger than 2 GB?