CCE File Systems & Data Recovery 5

Question 1

In a forensic investigation involving an SSD, why is traditional file recovery often less successful than with HDDs?

Accepted Answer

The TRIM command allows the OS to zero out deleted data blocks proactively

Answer

The TRIM command notifies the SSD controller that deleted blocks can be wiped immediately, causing the underlying data to be erased before forensic recovery is attempted.

Question 2

What is the maximum file size supported by the FAT32 file system?

Accepted Answer

4 GB minus 1 byte

Answer

FAT32 uses a 32-bit file size field, which allows a maximum file size of 4,294,967,295 bytes (4 GB – 1 byte).

Question 3

When examining the $UsnJrnl ($J) file in NTFS, what type of evidence does a forensic examiner primarily find?

Accepted Answer

A chronological log of file system changes including creates, deletes, and renames

Answer

The NTFS Update Sequence Number Journal ($UsnJrnl) records change reasons and timestamps for file and directory operations, providing a timeline of file system activity.

Question 4

In exFAT (used on large flash media), what replaces the traditional File Allocation Table for tracking cluster usage?

Accepted Answer

Allocation Bitmap

Answer

exFAT uses an Allocation Bitmap to track which clusters are in use rather than a linked-list FAT structure, improving performance for large volumes.

Question 5

A CCE candidate examines a disk and finds that sectors 63 through 2047 are empty before the first partition starts. What most likely explains this gap?

Accepted Answer

Partition alignment to a cylinder or 4K boundary left unused sectors

Answer

Modern partitioning tools align partitions to 4K sector boundaries (often LBA 2048), leaving the sectors between the MBR and the partition start empty or padding space.

(CCE) Certified Computer Examiner Practice Test

(CCE) Certified Computer Examiner Practice Test

CCE File Systems & Data Recovery 5