Understanding Hard Disks and File Systems
11 practice questions under this official exam objective (312-49v10), each with the answer key, an option-by-option explanation and instant feedback.
Questions under this objective
11 total · page 1 of 1Master Boot Record Missing Component
This question tests knowledge of the Master Boot Record (MBR) structure, specifically identifying the component located at the end of the record. The
File Sector Allocation and Fragmentation in Forensics
This question tests the calculation of disk sectors for a given file size and the forensic implications of storage allocation. The correct answer iden
R-Studio for Restoring Deleted Partition Data
This question addresses the correct tool selection for recovering data from a deleted partition in computer forensics. It establishes that R-Studio is
ASCII Code Interpretation in Cybercrime Investigations
This question tests the interpretation of lower and higher ASCII codes within a cybercrime investigation context. It establishes that lower ASCII (0-1
Which Tool Restores Files from a Damaged MBR?
When a failed OS install leaves the master boot record or partition sector damaged, a file-recovery utility must reconstruct partitions and carve file
Which File System Stores MAC Timestamps in UTC?
MAC (Modified, Accessed, Created) timestamps are stored differently depending on the file system, and forensic examiners must know which ones are reco
Which RAID Gives Different Volume and Disk Images
When a Hardware RAID volume is imaged through its controller, the resulting image only matches separate per-disk images in mirroring configurations. T
Which Item Is Not Part of an NTFS EFS DDF?
NTFS Encrypting File System (EFS) stores a Data Decryption Field (DDF) inside the $EFS attribute of an encrypted file, holding the per-user material n
Identifying Lost Clusters in File System Forensics
This question explores how to identify a cluster marked as used but not allocated, establishing that it is classified as a lost cluster. It clarifies
Where Does EnCase Search to Recover NTFS Files and Folders?
This question asks where EnCase searches to recover NTFS files and folders, and the answer is the Master File Table (MFT), not the MBR, slack space, o
What Is the Smallest Physical Storage Unit on a Hard Drive?
This question tests hard disk geometry — specifically whether a sector, cluster, track or platter is the smallest physical storage unit. The correct a