Unit 2: Hard Disks, File Systems and Data Acquisition - Practice Quiz

1 Which storage device uses spinning magnetic platters to store data?

2 Which type of drive has no moving mechanical parts?

3 What is the smallest physical storage unit on a hard disk called?

4 A group of sectors treated as a single logical unit by the file system is called a:

5 Which structure contains the partition table and code used to start the boot process on a legacy disk?

6 What does BIOS stand for?

7 Which of the following is a common boot loader used by Linux systems?

8 Which modern firmware interface is intended to replace the traditional BIOS?

9 Which file system is the default for modern Windows operating systems?

10 Which file system is commonly used by Linux operating systems?

11 Which file system was introduced by Apple as the default for modern macOS versions?

12 Which file system is often used on USB flash drives for compatibility across operating systems?

13 Autopsy is best described as a:

14 The Sleuth Kit (TSK) is primarily a collection of:

15 What does RAID stand for in storage systems?

16 Which storage technology connects storage devices to servers over a dedicated high-speed network?

17 A hex editor displays the raw contents of a file primarily in which number system?

18 Which encoding standard uses 7 bits to represent basic English characters?

19 In digital forensics, what is the main purpose of a write blocker during data acquisition?

20 Which type of acquisition creates an exact bit-by-bit copy of an entire storage device?

21 A forensic examiner notes that a suspect's storage device has no moving parts, uses NAND flash memory, and implements wear leveling and TRIM. Which characteristic makes forensic recovery of deleted data more difficult on this device?

22 A hard disk uses 512-byte sectors. A file of size bytes is stored on this disk. How many sectors are needed to store the file (ignoring metadata)?

23 In the CHS (Cylinder-Head-Sector) addressing scheme, what does the head number logically correspond to?

24 On a modern UEFI-based Windows system using a GPT disk, which partition stores the bootloader files that firmware reads to start the OS?

25 During a Linux boot on a BIOS system, which component is responsible for loading the kernel and the initramfs/initrd image into memory?

26 An examiner recovers an NTFS volume. Where is the metadata for every file and directory (including timestamps, permissions, and data run pointers) primarily stored?

27 A file smaller than about 700 bytes is stored on an NTFS volume. How does NTFS typically store its data?

28 In a Linux ext4 file system, which structure holds a file's metadata such as ownership, permissions, and block pointers, but not the file name?

29 Which file system is the modern default on recent macOS versions and was designed with SSDs, snapshots, and encryption in mind?

30 Which Sleuth Kit command-line tool would an examiner use to list the files and directories (including deleted entries) within a specified directory of a disk image?

31 An examiner has the inode number of a deleted file in a disk image. Which Sleuth Kit tool should be used to extract the content of that file by its inode?

32 Before analyzing individual file systems, an examiner needs to view the partition layout and the starting offsets of each volume in a disk image. Which tool provides this?

33 A RAID configuration stripes data across two disks with no redundancy to maximize performance. If one disk fails, all data is lost. Which RAID level is this?

34 In a RAID 5 array of disks each with capacity , how much usable storage is available after accounting for parity?

35 While viewing a file in a hex editor, an examiner sees it begins with the bytes FF D8 FF E0. Which file type does this magic number most likely indicate?

36 In ASCII encoding, the uppercase letter 'A' is represented by the decimal value . What is its hexadecimal representation?

37 During data acquisition, why is a write blocker essential when connecting a suspect's drive to a forensic workstation?

38 After imaging a drive, an examiner computes an MD5 hash of both the source and the image and finds they match. What does this primarily verify?

39 An examiner must acquire data from a running server that cannot be shut down because volatile memory and active connections are relevant. Which acquisition approach is most appropriate?

40 An examiner wants to analyze a disk image using tools that require a mounted file system, without altering the original evidence image. What is the correct practice?

41 An investigator seizes an SSD that was in active use in a running system. During acquisition, the hash of the imaged drive differs from a second image taken 10 minutes later, even though no user wrote data. Which SSD characteristic most likely explains this discrepancy?

42 A 2 TB disk is partitioned using MBR. The investigator notices only about 2 TB is unusable beyond a certain point. What is the fundamental logical limitation causing this?

43 On a UEFI-based Windows system, an examiner must identify where the boot manager (bootmgfw.efi) resides. Where is it correctly located?

44 In NTFS, a small file's data can be stored entirely within its MFT record. What is this feature called, and what is its forensic significance?

45 An examiner recovers a deleted file on an ext4 volume but cannot reconstruct its full content, unlike on ext3. Which ext4 design change most directly causes this difficulty?

46 Using The Sleuth Kit, an examiner runs fls -r -d image.dd and then istat image.dd 5023 on a deleted entry. The istat output shows the inode's allocation status as unallocated but lists valid data block addresses. What can be reliably concluded?

47 A forensic examiner must acquire data from a RAID 5 array of four disks after the controller failed. What is the primary challenge in reconstructing the logical volume from individual disk images?

48 In a hex editor, an examiner sees the byte sequence FF D8 FF E0 at the start of a file with a .txt extension. What is the most accurate forensic interpretation?

49 An examiner needs to interpret the little-endian 4-byte value 0x00 0x10 0x00 0x00 found in a hex editor as an unsigned integer. What is its decimal value?

50 During a live acquisition of a running system, the examiner prioritizes capturing RAM before imaging the disk. Which principle best justifies this ordering?

51 An examiner cannot remove a suspect drive due to a soldered SSD in a laptop and must acquire it while booted from external forensic media. Which acquisition approach best preserves integrity in this constraint?

52 An examiner has a raw dd image and needs to verify integrity while enabling metadata and compression for archival. Which image format conversion best meets all three goals?

53 A hardware write blocker is used, yet the acquired image hash differs from a re-read of the source drive on a HPA-enabled disk. What is the most probable cause?

54 On a macOS system using APFS, an examiner finds that deleted files leave little recoverable trace compared to HFS+. Which APFS feature most contributes to this?

55 A disk reports a physical sector size of 4096 bytes but emulates 512-byte logical sectors (512e). What forensic concern does this Advanced Format behavior raise during alignment analysis?

56 An examiner uses blkls from TSK on an NTFS image to extract only unallocated space, then runs a carving tool. What is the primary rationale for this two-step workflow?

57 In a SAN environment, an examiner must acquire evidence from a specific LUN presented to a compromised server. What makes this fundamentally different from imaging a local disk?

58 On a Linux system using GRUB2 with a separate /boot partition, the boot fails after a disk was re-imaged to a differently sized target. Which stored value most likely became invalid?

59 An examiner acquiring a 4 TB drive obtains a valid MD5 but management requires defensibility against collision claims. Which approach best strengthens integrity assurance without re-imaging?

60 An examiner must analyze a split E01 image set (E01–E05) using an open-source tool that only reads raw formats. What is the correct preparation step?