Unit 2: Understanding Hard Disks and File Systems - Practice Quiz

1 Which type of disk drive stores data on rotating magnetic platters?

2 Which storage drive uses flash memory and has no moving mechanical parts?

3 What is a sector on a disk?

4 What is a disk partition?

5 Which legacy disk structure contains partition information and initial boot code in the first sector?

6 Which Windows component manages the boot menu and starts the Windows operating system loader?

7 Which bootloader is commonly used by Linux systems?

8 What is the main role of the operating system kernel during booting?

9 Which file system is commonly used by modern Windows installations?

10 Which file system is commonly associated with Linux?

11 How does a typical Linux file system treat the names report.txt and Report.txt?

12 What is a primary purpose of a file system?

13 What is Autopsy primarily used for?

14 What is a disk image examined in Autopsy?

15 Which Autopsy activity helps an examiner find files containing a particular word?

16 Which RAID level stores the same data on two drives through mirroring?

17 What does NAS stand for?

18 Which storage system typically provides shared block-level storage over a dedicated network?

19 What is the purpose of a character encoding standard such as ASCII or Unicode?

20 What does a hex editor allow an examiner to view and modify?

21 An examiner receives an SSD from a running computer and learns that the operating system supports TRIM. Why should the examiner acquire the drive as soon as possible?

22 A seized laptop contains an M.2 storage module. What should an examiner determine before selecting an acquisition adapter?

23 While examining a traditional MBR sector, an investigator wants to locate the first partition-table entry. At which hexadecimal offset should examination begin?

24 The primary GPT header of a disk is damaged, but most sectors remain readable. Which structure is most useful for reconstructing the GPT metadata?

25 A partition begins at LBA 2048 on a disk with 512-byte sectors. What is the partition's byte offset from the beginning of the disk?

26 Which sequence best represents a normal Windows boot on a UEFI-based computer?

27 A Windows system reaches Windows Boot Manager but reports that the selected operating system cannot be found. Which artifact should be examined first?

28 GRUB loads a Linux kernel, but the kernel cannot access the root file system because the required storage driver is unavailable. Which boot component is most likely missing or damaged?

29 An NTFS file's $DATA attribute is marked as resident. Where should the examiner expect to find the file's content?

30 A file was recently deleted from a FAT32 volume. Its directory entry remains, but the FAT cluster chain has been cleared. Which condition most improves the chance of complete recovery?

31 An examiner recovers an ext4 inode containing file metadata but cannot determine the original filename from the inode alone. Why?

32 A suspicious NTFS path is recorded as report.docx:hidden.txt. What does hidden.txt most likely represent?

33 During an Autopsy examination, an investigator wants common operating-system files to be identified as known files so attention can focus on unusual files. Which feature should be used?

34 Autopsy shows browser activity five hours earlier than the time documented in an incident report. What should the examiner verify before concluding that the timestamps were altered?

35 A file named holiday.jpg begins with the bytes 4D 5A, indicating a Windows executable rather than a JPEG. Which Autopsy function is designed to highlight this mismatch?

36 A four-disk RAID 5 array uses 2 TB disks of equal size. Ignoring formatting overhead, what is its usable capacity?

37 One disk in a two-disk RAID 0 set fails during evidence acquisition. What is the most likely consequence?

38 Which observation most strongly indicates that a storage device is a NAS rather than a SAN?

39 A hex editor displays the byte sequence 41 00 42 00 43 00. Which interpretation is most likely?

40 While carving unallocated space in a hex editor, an examiner finds the bytes 25 50 44 46 2D. Which file type most likely begins at that location?

41 A partition on a 512e disk begins at LBA 63. The disk exposes 512-byte logical sectors but uses 4096-byte physical sectors. Which statement correctly describes the partition alignment?

42 An SSD receives a TRIM command for clusters belonging to a deleted file and remains powered for several hours before acquisition. Which forensic conclusion is most defensible?

43 The primary GPT header at LBA 1 has an invalid signature and CRC, but the backup GPT header is intact. What is the soundest method for deriving the partition layout?

44 An MBR extended partition begins at LBA 2,048. Its first EBR is at LBA 2,048 and contains a link value of 100,000 to the next EBR. The next EBR's first entry has a relative start of 63. At which absolute LBA does the second logical partition begin?

45 A nonresident, uncompressed, nonsparse file has a logical size of 10,000 bytes on a filesystem with 4,096-byte clusters. Assuming exactly three clusters are allocated, how much file slack exists?

46 Which sequence best represents a normal 64-bit Windows UEFI boot after firmware initialization and before the operating-system kernel begins executing?

47 On a legacy BIOS Windows system using an MBR-partitioned disk, which damage would allow the BIOS to execute the disk's initial boot code but prevent control from reaching the volume boot record through the normal chain?

48 A Linux kernel successfully loads an initramfs, but the real root filesystem is located on an encrypted logical volume. Which description most accurately explains the initramfs role?

49 An NTFS $MFT record has a mismatched two-byte value at the end of one sector relative to its update sequence array. What is the strongest interpretation?

50 An NTFS file contains its ordinary unnamed data stream and an alternate data stream named secret. It is copied to FAT32 using a conventional file-copy operation that preserves only visible file contents. Which result is most likely?

51 A recently deleted extent-based ext4 file cannot be opened by pathname, but its former data blocks have not yet been reallocated. Which statement is most accurate?

52 An ext4 filesystem uses the default data=ordered journaling mode. After an unexpected power loss, which expectation is justified when replaying the journal?

53 An NTFS $MFT record shows recent timestamps in $STANDARD_INFORMATION but substantially older corresponding timestamps in $FILE_NAME. Which conclusion is forensically strongest?

54 In Autopsy, a file matches a hash in a known-bad set. What is the most defensible interpretation of that result?

55 An Autopsy timeline combines NTFS timestamps and FAT timestamps from media used in two time zones during a daylight-saving transition. Which procedure minimizes temporal misinterpretation?

56 An examiner adds only an exported directory of logical files as an Autopsy data source and enables a file-carving ingest module. Why are deleted files from the original volume not recovered?

57 In one RAID 5 stripe, three surviving bytes are data bytes 0x3A and 0xC5 and parity byte 0x7F. A third data byte is missing. Assuming XOR parity, what is the missing byte?

58 A four-disk RAID 10 uses mirrored pairs (A,B) and (C,D), with data striped across the two pairs. Each disk has capacity . Which statement is correct?

59 A hex editor displays the byte sequence FF FE 3D D8 00 DE at the beginning of a text file. Interpreting the first two bytes as a BOM, what follows?

60 A filesystem structure stores a 64-bit unsigned Unix timestamp in little-endian order. A hex editor shows 00 F1 53 65 00 00 00 00. What decimal timestamp should be interpreted?