Practice Test GeeksCHFI - Computer Hacking Forensic Investigator Practice Test
← All CHFI Flashcard Decks

Hard Disk and File Systems Flashcards

7 cards from real CHFI practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 Hard Disk and File Systems flashcards as text

  1. Which disk partitioning scheme supports more than 2 TB volumes and up to 128 primary partitions on Windows?

    Answer: GPT

    GUID Partition Table (GPT) supports drives larger than 2 TB and allows up to 128 primary partitions, overcoming MBR limitations.

  2. In NTFS, which metadata file stores the location of all other metadata files and is always located at the beginning of the volume?

    Answer: $MFT

    The $MFT (Master File Table) is the first file in an NTFS volume and contains records for every file and directory on the volume.

  3. A forensic investigator finds a file with a .txt extension but the file header shows 'FF D8 FF E0'. What does this indicate?

    Answer: The file extension has been changed to hide a JPEG image

    The magic bytes FF D8 FF E0 identify a JPEG file; a .txt extension on such a file indicates deliberate obfuscation.

  4. What is the purpose of the Volume Boot Record (VBR) in a disk partition?

    Answer: Contains the bootstrap code to load the operating system for that partition

    The VBR resides at the first sector of each partition and contains bootstrap code that the MBR passes control to during boot.

  5. In FAT32, what is the maximum supported file size?

    Answer: 4 GB minus 1 byte

    FAT32 uses a 32-bit file size field, limiting individual files to 4 GB minus 1 byte (4,294,967,295 bytes).

  6. Which NTFS feature creates a hidden copy of data that can be used to recover files even after deletion?

    Answer: Volume Shadow Copies (VSS)

    Volume Shadow Copy Service creates point-in-time snapshots of volumes, which forensic investigators can use to recover deleted files.

  7. What term describes the area between the last partition and the end of the disk that is not allocated to any partition?

    Answer: Unpartitioned space

    Unpartitioned space (also called unallocated space at the disk level) exists between the last partition boundary and the physical end of the disk.