Chapter 10: Advanced EnCase
1. E. The first 63 sectors of a hard drive are reserved for the MBR even though its contents are contained in the very first sector.
2. D. The first sector of a formatted hard drive with an operating system is referred to as a boot sector, which contains the MBR and is located at absolute sector 0.
3. C. The partition table allows for four logical partitions. It consists of 64 bytes, and each of the four partitions is described by 16-byte string.
4. D. The first sector of a partition contains the volume boot record.
5. B. EnCase can still recover deleted partitions if you point to the first sector of the partition, which is the volume boot record, and select the Add Partition command from the Partition menu. ...
Get EnCE EnCase Computer Forensics: The Official EnCase Certified Examiner Study Guide, 3rd Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
