CCE File Systems & Data Recovery 4

Question 1

What is the default cluster size for an NTFS volume formatted on a partition larger than 2 GB?

Accepted Answer

4,096 bytes

Answer

Windows defaults to 4,096-byte (4 KB) clusters for NTFS volumes larger than 2 GB, balancing storage efficiency and performance.

Question 2

In HFS+ (Mac OS Extended), which structure is equivalent to the NTFS MFT and stores file metadata?

Accepted Answer

Catalog File

Answer

The HFS+ Catalog File is a B-tree that stores records for all files and directories on the volume, serving the same metadata role as the NTFS MFT.

Question 3

When recovering data from a RAID 5 array with one failed drive, what is the minimum number of remaining drives needed to reconstruct the missing data?

Accepted Answer

All remaining drives

Answer

RAID 5 stores parity distributed across all drives, so ALL remaining drives (n-1) must be operational to reconstruct the data from the failed drive using XOR parity.

Question 4

What is the role of the Volume Boot Record (VBR) in a FAT or NTFS volume?

Accepted Answer

Contains the BPB and bootstrap code needed to mount the volume

Answer

The Volume Boot Record contains the BIOS Parameter Block (BPB), which describes volume geometry and layout, and bootstrap code that initiates the OS loading process.

Question 5

A forensic examiner is analyzing a disk and finds that the first sector of a partition contains 'EB 52 90 4E 54 46 53'. What does this indicate?

Accepted Answer

The partition uses NTFS

Answer

'EB 52 90' is the x86 jump instruction prefix and '4E 54 46 53' is the ASCII string 'NTFS', which are the first bytes of an NTFS Volume Boot Record.

(CCE) Certified Computer Examiner Practice Test

(CCE) Certified Computer Examiner Practice Test

CCE File Systems & Data Recovery 4