CHFI Hard Disk and File Systems 2 — Questions and Answers
Question 1: Which disk partitioning scheme supports more than 2 TB volumes and up to 128 primary partitions on Windows?
- MBR
- GPT (Correct answer)
- APT
- VBR
Correct answer: GPT
GUID Partition Table (GPT) supports drives larger than 2 TB and allows up to 128 primary partitions, overcoming MBR limitations.
Question 2: In NTFS, which metadata file stores the location of all other metadata files and is always located at the beginning of the volume?
- $LogFile
- $MFT (Correct answer)
- $Boot
- $Bitmap
Correct answer: $MFT
The $MFT (Master File Table) is the first file in an NTFS volume and contains records for every file and directory on the volume.
Question 3: A forensic investigator finds a file with a .txt extension but the file header shows 'FF D8 FF E0'. What does this indicate?
- The file is encrypted
- The file extension has been changed to hide a JPEG image (Correct answer)
- The file is corrupted
- The file uses Unicode encoding
Correct answer: The file extension has been changed to hide a JPEG image
The magic bytes FF D8 FF E0 identify a JPEG file; a .txt extension on such a file indicates deliberate obfuscation.
Question 4: What is the purpose of the Volume Boot Record (VBR) in a disk partition?
- Stores the partition table for the disk
- Contains the bootstrap code to load the operating system for that partition (Correct answer)
- Holds the file allocation table
- Maps bad sectors on the disk
Correct answer: Contains the bootstrap code to load the operating system for that partition
The VBR resides at the first sector of each partition and contains bootstrap code that the MBR passes control to during boot.
Question 5: In FAT32, what is the maximum supported file size?
- 2 GB
- 4 GB minus 1 byte (Correct answer)
- 8 GB
- 16 TB
Correct answer: 4 GB minus 1 byte
FAT32 uses a 32-bit file size field, limiting individual files to 4 GB minus 1 byte (4,294,967,295 bytes).
Question 6: Which NTFS feature creates a hidden copy of data that can be used to recover files even after deletion?
- EFS encryption
- Volume Shadow Copies (VSS) (Correct answer)
- NTFS compression
- Alternate Data Streams
Correct answer: Volume Shadow Copies (VSS)
Volume Shadow Copy Service creates point-in-time snapshots of volumes, which forensic investigators can use to recover deleted files.
Question 7: What term describes the area between the last partition and the end of the disk that is not allocated to any partition?
- Slack space
- Host protected area
- Disk slack
- Unpartitioned space (Correct answer)
Correct answer: Unpartitioned space
Unpartitioned space (also called unallocated space at the disk level) exists between the last partition boundary and the physical end of the disk.
CHFI Hard Disk and File Systems 2
Which disk partitioning scheme supports more than 2 TB volumes and up to 128 primary partitions on Windows?