File Systems & Data Recovery Flashcards
7 cards from real CCE practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 File Systems & Data Recovery flashcards as text
What is the default cluster size for an NTFS volume formatted on a partition larger than 2 GB?
Answer: 4,096 bytes
Windows defaults to 4,096-byte (4 KB) clusters for NTFS volumes larger than 2 GB, balancing storage efficiency and performance.
In HFS+ (Mac OS Extended), which structure is equivalent to the NTFS MFT and stores file metadata?
Answer: Catalog File
The HFS+ Catalog File is a B-tree that stores records for all files and directories on the volume, serving the same metadata role as the NTFS MFT.
When recovering data from a RAID 5 array with one failed drive, what is the minimum number of remaining drives needed to reconstruct the missing data?
Answer: All remaining drives
RAID 5 stores parity distributed across all drives, so ALL remaining drives (n-1) must be operational to reconstruct the data from the failed drive using XOR parity.
What is the role of the Volume Boot Record (VBR) in a FAT or NTFS volume?
Answer: Contains the BPB and bootstrap code needed to mount the volume
The Volume Boot Record contains the BIOS Parameter Block (BPB), which describes volume geometry and layout, and bootstrap code that initiates the OS loading process.
A forensic examiner is analyzing a disk and finds that the first sector of a partition contains 'EB 52 90 4E 54 46 53'. What does this indicate?
Answer: The partition uses NTFS
'EB 52 90' is the x86 jump instruction prefix and '4E 54 46 53' is the ASCII string 'NTFS', which are the first bytes of an NTFS Volume Boot Record.
Which data recovery scenario benefits most from the use of a write blocker?
Answer: Imaging a suspect drive without altering its contents
A write blocker prevents any write commands from reaching the source drive during imaging, preserving the forensic integrity of the original evidence.
What does the term 'orphaned file' mean in the context of file system forensics?
Answer: A file whose directory entry exists but has no parent directory reference
An orphaned file is one whose inode or MFT record still exists but has been disconnected from its parent directory, often due to corruption or anti-forensics techniques.