Practice Test Geeks(CCE) Certified Computer Examiner Practice Test
← All CCE Flashcard Decks

File Systems & Data Recovery Flashcards

7 cards from real CCE practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 File Systems & Data Recovery flashcards as text

  1. In a forensic investigation involving an SSD, why is traditional file recovery often less successful than with HDDs?

    Answer: The TRIM command allows the OS to zero out deleted data blocks proactively

    The TRIM command notifies the SSD controller that deleted blocks can be wiped immediately, causing the underlying data to be erased before forensic recovery is attempted.

  2. What is the maximum file size supported by the FAT32 file system?

    Answer: 4 GB minus 1 byte

    FAT32 uses a 32-bit file size field, which allows a maximum file size of 4,294,967,295 bytes (4 GB – 1 byte).

  3. When examining the $UsnJrnl ($J) file in NTFS, what type of evidence does a forensic examiner primarily find?

    Answer: A chronological log of file system changes including creates, deletes, and renames

    The NTFS Update Sequence Number Journal ($UsnJrnl) records change reasons and timestamps for file and directory operations, providing a timeline of file system activity.

  4. In exFAT (used on large flash media), what replaces the traditional File Allocation Table for tracking cluster usage?

    Answer: Allocation Bitmap

    exFAT uses an Allocation Bitmap to track which clusters are in use rather than a linked-list FAT structure, improving performance for large volumes.

  5. A CCE candidate examines a disk and finds that sectors 63 through 2047 are empty before the first partition starts. What most likely explains this gap?

    Answer: Partition alignment to a cylinder or 4K boundary left unused sectors

    Modern partitioning tools align partitions to 4K sector boundaries (often LBA 2048), leaving the sectors between the MBR and the partition start empty or padding space.

  6. Which of the following file carving signatures correctly identifies the start of a JPEG file?

    Answer: FF D8 FF

    JPEG files begin with the magic bytes FF D8 FF, which represent the Start of Image (SOI) marker used to identify JPEG/JFIF data.

  7. What is 'slack space' at the volume level (also called 'volume slack' or 'partition slack')?

    Answer: Unused space between the end of the file system and the end of the partition

    Volume slack is the space between the last sector used by the file system and the last sector defined by the partition entry, which may contain residual data from prior use.