CHFI Hard Disk and File Systems 2

Question 1

Which disk partitioning scheme supports more than 2 TB volumes and up to 128 primary partitions on Windows?

Accepted Answer

GPT

Answer

GUID Partition Table (GPT) supports drives larger than 2 TB and allows up to 128 primary partitions, overcoming MBR limitations.

Question 2

In NTFS, which metadata file stores the location of all other metadata files and is always located at the beginning of the volume?

Accepted Answer

$MFT

Answer

The $MFT (Master File Table) is the first file in an NTFS volume and contains records for every file and directory on the volume.

Question 3

A forensic investigator finds a file with a .txt extension but the file header shows 'FF D8 FF E0'. What does this indicate?

Accepted Answer

The file extension has been changed to hide a JPEG image

Answer

The magic bytes FF D8 FF E0 identify a JPEG file; a .txt extension on such a file indicates deliberate obfuscation.

Question 4

What is the purpose of the Volume Boot Record (VBR) in a disk partition?

Accepted Answer

Contains the bootstrap code to load the operating system for that partition

Answer

The VBR resides at the first sector of each partition and contains bootstrap code that the MBR passes control to during boot.

Question 5

In FAT32, what is the maximum supported file size?

Accepted Answer

4 GB minus 1 byte

Answer

FAT32 uses a 32-bit file size field, limiting individual files to 4 GB minus 1 byte (4,294,967,295 bytes).

CHFI - Computer Hacking Forensic Investigator Practice Test