CCE File Systems & Data Recovery 5 — Questions and Answers
Question 1: In a forensic investigation involving an SSD, why is traditional file recovery often less successful than with HDDs?
- SSDs use proprietary encryption by default
- The TRIM command allows the OS to zero out deleted data blocks proactively (Correct answer)
- SSDs compress all data before writing
- SSD sectors are too small for standard carving tools
Correct answer: The TRIM command allows the OS to zero out deleted data blocks proactively
The TRIM command notifies the SSD controller that deleted blocks can be wiped immediately, causing the underlying data to be erased before forensic recovery is attempted.
Question 2: What is the maximum file size supported by the FAT32 file system?
- 2 GB
- 4 GB minus 1 byte (Correct answer)
- 8 GB
- 16 TB
Correct answer: 4 GB minus 1 byte
FAT32 uses a 32-bit file size field, which allows a maximum file size of 4,294,967,295 bytes (4 GB – 1 byte).
Question 3: When examining the $UsnJrnl ($J) file in NTFS, what type of evidence does a forensic examiner primarily find?
- Encrypted file keys
- A chronological log of file system changes including creates, deletes, and renames (Correct answer)
- User logon and logoff events
- Registry hive transaction records
Correct answer: A chronological log of file system changes including creates, deletes, and renames
The NTFS Update Sequence Number Journal ($UsnJrnl) records change reasons and timestamps for file and directory operations, providing a timeline of file system activity.
Question 4: In exFAT (used on large flash media), what replaces the traditional File Allocation Table for tracking cluster usage?
- Allocation Bitmap (Correct answer)
- B-tree Index
- Inode Table
- Cluster Map File
Correct answer: Allocation Bitmap
exFAT uses an Allocation Bitmap to track which clusters are in use rather than a linked-list FAT structure, improving performance for large volumes.
Question 5: A CCE candidate examines a disk and finds that sectors 63 through 2047 are empty before the first partition starts. What most likely explains this gap?
- The disk has bad sectors in that region
- Partition alignment to a cylinder or 4K boundary left unused sectors (Correct answer)
- The MBR occupies all sectors up to sector 2048
- A hidden bootloader is stored in that area
Correct answer: Partition alignment to a cylinder or 4K boundary left unused sectors
Modern partitioning tools align partitions to 4K sector boundaries (often LBA 2048), leaving the sectors between the MBR and the partition start empty or padding space.
Question 6: Which of the following file carving signatures correctly identifies the start of a JPEG file?
- 89 50 4E 47
- FF D8 FF (Correct answer)
- 50 4B 03 04
- 25 50 44 46
Correct answer: FF D8 FF
JPEG files begin with the magic bytes FF D8 FF, which represent the Start of Image (SOI) marker used to identify JPEG/JFIF data.
Question 7: What is 'slack space' at the volume level (also called 'volume slack' or 'partition slack')?
- The unused space within the last cluster of a file
- Unused space between the end of the file system and the end of the partition (Correct answer)
- Space reserved by the OS for system files
- The space allocated to the MFT zone
Correct answer: Unused space between the end of the file system and the end of the partition
Volume slack is the space between the last sector used by the file system and the last sector defined by the partition entry, which may contain residual data from prior use.
CCE File Systems & Data Recovery 5
In a forensic investigation involving an SSD, why is traditional file recovery often less successful than with HDDs?