Back to Subject

Unit 2: Understanding Hard Disks and File Systems - Practice Quiz

INT250 — Digital Evidence Analysis 50 Questions
0 Correct 0 Wrong 50 Left
0/50

1 Which component of a traditional Hard Disk Drive (HDD) is responsible for physically holding the magnetic data?

A. Spindle
B. Platter
C. Read/Write Head
D. Actuator Arm

2 What is the smallest physical storage unit on a standard hard disk drive?

A. Sector
B. Track
C. Cluster
D. Cylinder

3 Which term describes the concentric circles on a hard disk platter where data is written?

A. Tracks
B. Sectors
C. Clusters
D. Cylinders

4 In the context of disk addressing, what does CHS stand for?

A. Cluster Head Sector
B. Cylinder Host System
C. Cylinder Head Sector
D. Circular Hard Storage

5 Which logical addressing scheme replaces CHS by assigning a sequential number to each sector?

A. ZBR (Zone Bit Recording)
B. GPT (GUID Partition Table)
C. MBR (Master Boot Record)
D. LBA (Logical Block Addressing)

6 What is a 'Cluster' in the context of file systems?

A. A group of hard drives working together
B. The smallest unit of disk space allocatable by the Operating System
C. A specific type of magnetic encoding
D. A physical defect on the disk surface

7 Which area of the hard drive is often hidden from the operating system and can be used to hide data?

A. HPA (Host Protected Area)
B. FAT Area
C. Boot Sector
D. MFT

8 How does a Solid State Drive (SSD) store data compared to an HDD?

A. Using NAND Flash memory
B. Using laser pits and lands
C. Using magnetic fields on platters
D. Using magnetic tape

9 What process do SSDs use to ensure memory cells wear out evenly?

A. Journaling
B. Wear Leveling
C. Striping
D. Defragmentation

10 Which command allows an operating system to inform an SSD which blocks of data are no longer considered in use?

A. FORMAT
B. CLEAN
C. CHKDSK
D. TRIM

11 What is the standard size of the Master Boot Record (MBR)?

A. 4096 bytes
B. 512 bytes
C. 256 bytes
D. 1024 bytes

12 What is the specific hex signature located at the end of the MBR (offset 510-511)?

A. 0xAA55
B. 0xFF00
C. 0x55AA
D. 0x00FF

13 How many primary partitions does the MBR partition table support by default?

A. 2
B. 128
C. 16
D. 4

14 Which partitioning scheme overcomes the 2TB size limit of MBR?

A. GPT (GUID Partition Table)
B. LBA
C. FAT32
D. CHS

15 What is the first step in the general booting process of a computer?

A. Starting the Init process
B. Loading the Kernel
C. Reading the MBR
D. POST (Power-On Self-Test)

16 In the Windows Vista and later boot process, which file replaces NTLDR?

A. winload.exe
B. ntoskrnl.exe
C. boot.ini
D. bootmgr

17 Where is the Boot Configuration Data (BCD) store typically located in a modern Windows system?

A. Inside the MBR
B. C:\Windows\System32
C. \Boot\BCD on the active partition
D. Inside the Registry

18 What is the most common bootloader used in Linux distributions?

A. LILO
B. NTLDR
C. Bootmgr
D. GRUB

19 Which specific Linux directory contains the kernel image and bootloader files?

A. /sys
B. /etc
C. /dev
D. /boot

20 What is 'File Slack'?

A. The metadata stored in the file header
B. The space occupied by deleted files
C. The space used by the MFT
D. The unused space between the end of the file and the end of the cluster

21 What is the maximum file size supported by the FAT32 file system?

A. 16 TB
B. 32 GB
C. 2 GB
D. 4 GB

22 Which file system is the default for modern Windows operating systems?

A. exFAT
B. NTFS
C. FAT32
D. HFS+

23 In NTFS, where is all information about a file, including its name, timestamps, and permissions, stored?

A. Inode Table
B. FAT Table
C. MFT (Master File Table)
D. Superblock

24 What is a 'Resident File' in NTFS?

A. A file stored in the system registry
B. A file that cannot be deleted
C. A file whose data fits entirely within its MFT record
D. A file located in the Windows directory

25 Which NTFS feature allows data to be hidden 'behind' a file without changing the file's visible size?

A. Compression
B. ADS (Alternate Data Streams)
C. Journaling
D. Encryption

26 Which file system was designed by Microsoft specifically for flash drives to handle large files without the overhead of NTFS?

A. FAT16
B. FAT32
C. exFAT
D. Ext4

27 What is the fundamental metadata structure for files in Linux file systems like Ext4?

A. Inode
B. FAT Entry
C. Registry Key
D. MFT Record

28 Which data structure in a Linux file system stores information about the file system itself (e.g., block size, total blocks)?

A. Group Descriptor
B. Boot Block
C. Data Block
D. Superblock

29 What is the primary advantage of a Journaling File System (like Ext4 or NTFS)?

A. Faster read speeds
B. Smaller cluster sizes
C. Recovery from crashes by keeping a log of changes
D. Automatic encryption

30 In a Linux file system, the directory structure is:

A. Dependent on the BIOS
B. Hierarchical tree starting at root (/)
C. Flat database
D. Drive-letter based (C:, D:)

31 Autopsy is a graphical interface for which underlying digital forensics tool suite?

A. EnCase
B. Wireshark
C. Volatility
D. The Sleuth Kit (TSK)

32 In Autopsy, what is the purpose of the 'Ingest Modules'?

A. To format the evidence drive
B. To automate analysis tasks like hashing and keyword searching
C. To crack passwords
D. To copy the hard drive

33 What does the term 'File Carving' refer to in digital forensics?

A. Encrypting sensitive data
B. Compressing files for storage
C. Recovering files based on headers and footers without file system metadata
D. Deleting files securely

34 Which RAID level uses 'Striping' to increase performance but offers no redundancy?

A. RAID 0
B. RAID 5
C. RAID 1
D. RAID 10

35 Which RAID level mirrors data across two disks for redundancy?

A. RAID 5
B. RAID 1
C. RAID 0
D. RAID 6

36 RAID 5 requires a minimum of how many disks?

A. 5
B. 2
C. 3
D. 4

37 What is the main difference between NAS and SAN?

A. There is no difference
B. NAS is block-level, SAN is file-level
C. NAS is file-level storage, SAN is block-level storage
D. NAS uses Fibre Channel, SAN uses Ethernet only

38 In hexadecimal notation, the value 'F' represents which decimal number?

A. 12
B. 10
C. 15
D. 16

39 How many bits are in a Nibble?

A. 16
B. 4
C. 8
D. 2

40 What is a 'Magic Number' or 'File Signature'?

A. The checksum of the file
B. The file size in bytes
C. The timestamp of creation
D. A unique sequence of bytes at the beginning of a file identifying its format

41 Which character encoding standard uses variable length (1 to 4 bytes) to represent text and covers almost all world languages?

A. EBCDIC
B. ASCII
C. UTF-8
D. Base64

42 In 'Little Endian' byte ordering, how is the hexadecimal value 0x1234 stored in memory?

A. 12 12
B. 34 12
C. 12 34
D. 34 34

43 Which tool allows an examiner to view and edit the raw binary data of a file or disk?

A. Word Processor
B. Hex Editor
C. Registry Editor
D. Compiler

44 The $Bitmap file in NTFS serves what purpose?

A. Stores file names
B. Stores the boot code
C. Tracks the allocation status (used/unused) of clusters
D. Encrypts the drive

45 What is the standard sector size for 'Advanced Format' (4Kn) drives?

A. 4096 bytes
B. 512 bytes
C. 2048 bytes
D. 1024 bytes

46 Which Linux command is commonly used to list block devices and their file systems?

A. netstat
B. grep
C. lsblk
D. ps

47 What is the purpose of the 'Hard Link' in Linux?

A. A pointer to the same inode as the original file
B. A shortcut to a file
C. A link to a web address
D. A copy of the file in a different partition

48 In a Windows Boot Process, what is the function of 'Winload.exe'?

A. It loads the OS kernel (ntoskrnl.exe) and core drivers
B. It manages the user login
C. It formats the hard drive
D. It performs the POST

49 Which interface is designed specifically to overcome the speed bottlenecks of SATA for SSDs?

A. SCSI
B. NVMe
C. USB 2.0
D. PATA

50 JBOD stands for:

A. Journaled Block Operation Data
B. Just Boot On Demand
C. Joint Boot Operation Disk
D. Just a Bunch of Disks
Previous MCQ
Unit 1
Next MCQ
Unit 3