Practice Test GeeksCHFI - Computer Hacking Forensic Investigator Practice Test
← All CHFI Flashcard Decks

Hard Disk and File Systems Flashcards

7 cards from real CHFI practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 Hard Disk and File Systems flashcards as text

  1. What is 'file carving' in digital forensics?

    Answer: Recovering files from unallocated space based on file headers and footers without relying on file system metadata

    File carving reconstructs files from raw disk data by identifying known file signatures (magic bytes) without using the file system's directory or allocation tables.

  2. In a GPT-partitioned disk, where is the backup copy of the partition table stored?

    Answer: At the end of the disk

    GPT stores a secondary (backup) copy of the partition table at the last sectors of the disk to allow recovery if the primary GPT header is damaged.

  3. Which NTFS timestamp is NOT updated when a file is simply read (accessed) on a default Windows 10/11 system?

    Answer: $STANDARD_INFORMATION last access time

    By default, Windows disables updating of the $SI last access time (NtfsDisableLastAccessUpdate=1) to improve performance, so reading a file does not update it.

  4. What is the Device Configuration Overlay (DCO) on ATA hard drives?

    Answer: A hidden area similar to HPA that restricts features and capacity visible to the OS and BIOS

    DCO is an ATA feature that allows manufacturers or users to permanently hide disk capacity and features; like HPA, it requires special ATA commands to detect.

  5. In a FAT file system, what happens to a deleted file's directory entry?

    Answer: The first byte of the filename is replaced with 0xE5 and cluster chain is marked free in the FAT

    When a file is deleted in FAT, the directory entry's first character is set to 0xE5 and the FAT chain entries are set to 0x00 (free), but the actual data remains until overwritten.

  6. What is the purpose of a write blocker in forensic disk imaging?

    Answer: To prevent any write commands from reaching the evidence drive, preserving its integrity

    A write blocker (hardware or software) intercepts and blocks write commands sent to the evidence drive, ensuring the forensic process does not modify the original evidence.

  7. Which sector on a standard 512-byte sector MBR disk contains the partition table?

    Answer: Sector 0 (the first sector of the disk)

    On an MBR disk, sector 0 contains the 446-byte bootstrap code, the 64-byte partition table (4 entries of 16 bytes each), and the 2-byte signature 0x55AA.