Chapter 2 — Quiz

14 questions: 10 multiple choice, 2 true/false, 2 short answer. Work them closed-book first, then check the answer key at the bottom. The arithmetic and signature questions are the kind a working examiner answers reflexively.

Multiple choice

Q1. How many distinct values can a single byte represent, and how many bits is it? - A) 128 values, 7 bits - B) 255 values, 8 bits - C) 256 values, 8 bits - D) 1,024 values, 10 bits

Q2. In a hex dump, one hexadecimal digit represents exactly how many bits? - A) 1 bit - B) 4 bits (one nibble) - C) 8 bits (one byte) - D) 16 bits (one word)

Q3. The byte 0x4D equals which decimal value and which ASCII character? - A) 77 and M - B) 65 and A - C) 75 and K - D) 109 and m

Q4. Which byte sequence is the universal opening signature of a JPEG image? - A) 50 4B 03 04 - B) 25 50 44 46 - C) 4D 5A - D) FF D8 FF

Q5. A 16-bit field stored little-endian reads E8 03 on disk. What value does it hold? - A) 1,000 - B) 59,395 - C) 232 - D) 3,892,510,720

Q6. On a hard disk drive, a single bit is physically stored as: - A) An electrical charge trapped behind an insulator in a flash cell - B) The magnetic orientation of a tiny region of a spinning platter - C) A pit or land burned into a reflective layer - D) A capacitor that must be refreshed thousands of times per second

Q7. On a NAND-flash SSD, what is the smallest unit that can be erased? - A) A cell - B) A page - C) A block - D) A sector

Q8. A partition begins at LBA 2048 on a 512-byte-sector drive. Using byte offset = sector × sector size, where (in bytes) does it begin? - A) 1,024 - B) 524,288 - C) 1,048,576 - D) 4,194,304

Q9. When you "delete" a file (or quick-format a volume) on a typical magnetic drive, what actually changes on the medium? - A) Every data cluster is overwritten with zeros - B) The file's metadata/pointer is invalidated and its clusters are marked free, while the data clusters are left in place - C) The platter is degaussed in the affected region - D) The data is moved to a hidden partition

Q10. Drive slack (file slack) most commonly contains: - A) Zeros written by the operating system to clear the cluster - B) The current file's own header repeated - C) Leftover bytes from a previously deleted file that occupied the cluster earlier - D) Error-correction codes maintained by the drive firmware

True / False

Q11. A "quick format" overwrites all of a volume's data clusters, securely erasing the previous contents. (True / False)

Q12. On a TRIM-enabled SSD, files deleted by the operating system can become physically unrecoverable within seconds to minutes, even though the same deletion on a hard drive would leave the data intact for a long time. (True / False)

Short answer

Q13. State the chapter's central principle in one sentence, then name one concrete condition under which it does not help you — i.e., where the data really is gone.

Q14. Convert the byte 1111 1111 to hexadecimal and to decimal, and state what such a byte (alongside 0x00) most commonly represents when you see long runs of it in a hex dump.

---

Answer key

Q1 — C. A byte is 8 bits; 2⁸ = 256 distinct values (the integers 0–255). "255" names the largest single value, not the count, which is the trap in option B.

Q2 — B. Four bits have 2⁴ = 16 combinations, exactly matching the 16 hex digits 0–F; this clean nibble-to-digit mapping is the whole reason hex won over decimal for dumps.

Q3 — A. 0x4D = 4×16 + 13 = 77, and ASCII character 77 is capital M — the byte's three "costumes" (0100 1101 / 0x4D / 77 / M) from the chapter.

Q4 — D. FF D8 FF is the JPEG/JFIF Start-Of-Image signature. 50 4B 03 04 is ZIP/Office, 25 50 44 46 is %PDF, and 4D 5A (MZ) is a Windows executable.

Q5 — A. Little-endian stores the least-significant byte first, so E8 03 means 0x03E8 = 3×256 + 14×16 + 8 = 1,000. Reading it big-endian instead gives 0xE803 = 59,395 (the distractor in B).

Q6 — B. An HDD encodes each bit as the magnetic orientation of a microscopic region of the platter; option A describes an SSD, and the magnetism persists, undisturbed by reading, until a write head changes it.

Q7 — C. A page is the smallest read/write (program) unit, but the smallest erasable unit is the much larger block — the asymmetry that forces garbage collection, wear leveling, and the FTL.

Q8 — C. 2048 × 512 = 1,048,576 bytes = exactly 1 MiB, which is precisely why modern partitions start at LBA 2048 (it aligns cleanly to both 512-byte and 4 KB boundaries).

Q9 — B. Deletion is bookkeeping: it invalidates the directory/MFT entry and marks the clusters free, but does not touch the data clusters — the foundation of "deleted ≠ destroyed."

Q10 — C. The OS does not clear drive slack, so whatever bytes (often a previously deleted file's contents) were physically there remain inside the cluster the current file now nominally owns.

Q11 — False. A quick format lays down a fresh, nearly empty file system (new boot sector, new near-empty MFT) and marks the rest free; it does not walk the platter overwriting old data clusters. That is exactly why the reformatted wedding-photos drive is recoverable.

Q12 — True. TRIM tells the SSD controller the deleted blocks are no longer needed, freeing it to garbage-collect and physically erase the underlying flash pages on its own schedule — often within seconds or minutes. The medium decides what is possible.

Q13. Principle: Deleting a file removes the pointer (the directory/MFT entry plus a "this space is free" mark), not the data — the bits persist until something overwrites them. One exception (any one): the clusters were reused/overwritten; TRIM + garbage collection physically erased the flash; the volume is strongly encrypted and you lack the key; the medium was physically destroyed or degraded (degaussing, shredding, head crash, NAND wear-out).

Q14. 1111 1111 = 0xFF = 255 (the maximum value a byte can hold). Long runs of 0xFF (and of 0x00) most commonly represent empty, unused, or erased space — which is why those two are the most frequently seen bytes in a dump.

Scoring: 13–14 correct — you have the byte-level literacy this book assumes; proceed to Chapter 3 confidently. 10–12 — solid; re-read the sections behind any miss, especially endianness (Q5) and the slack/deletion model (Q9–Q12). 7–9 — re-read the chapter's "Hexadecimal," "logical/physical divide," and "deletion removes the pointer" sections and redo the arithmetic in exercises.md Groups A and E. 6 or below — work the chapter again from the top before moving on; everything later stands on this foundation.