Understanding Hard Disks and File Systems
8 practice questions under this official exam objective (312-49v10) — each with the community-verified answer, a full option-by-option explanation and instant feedback.
File Sector Allocation and Fragmentation in Forensics
This question tests the calculation of disk sectors for a given file size and the forensic implications of storage allocation. The correct answer iden
Which Tool Restores Files from a Damaged MBR?
When a failed OS install leaves the master boot record or partition sector damaged, a file-recovery utility must reconstruct partitions and carve file
Which File System Stores MAC Timestamps in UTC?
MAC (Modified, Accessed, Created) timestamps are stored differently depending on the file system, and forensic examiners must know which ones are reco
Which RAID Gives Different Volume and Disk Images
When a Hardware RAID volume is imaged through its controller, the resulting image only matches separate per-disk images in mirroring configurations. T
Which Item Is Not Part of an NTFS EFS DDF?
NTFS Encrypting File System (EFS) stores a Data Decryption Field (DDF) inside the $EFS attribute of an encrypted file, holding the per-user material n
Identifying Lost Clusters in File System Forensics
This question explores how to identify a cluster marked as used but not allocated, establishing that it is classified as a lost cluster. It clarifies
Where Does EnCase Search to Recover NTFS Files and Folders?
This question asks where EnCase searches to recover NTFS files and folders, and the answer is the Master File Table (MFT), not the MBR, slack space, o
What Is the Smallest Physical Storage Unit on a Hard Drive?
This question tests hard disk geometry — specifically whether a sector, cluster, track or platter is the smallest physical storage unit. The correct a