Chapter 3 — Quiz

14 questions: 10 multiple choice, 2 true/false, 2 short answer. Work them closed-book first, then check the answer key at the bottom. These are the device facts a working tech or examiner recalls on sight, because the wrong call at intake can cost a client their data.

Multiple choice

Q1. The hidden service area (System Area) on a hard drive's reserved tracks stores the firmware modules, the translator, and the defect tables. If it becomes corrupted, the most likely result is: - A) Every user file is permanently destroyed - B) The drive may report a garbage model string or zero capacity, even though the user's data is still intact on the platters - C) The partition table is erased but the data is fine - D) Only the SMART log is lost, with no other effect

Q2. A drive spins up and produces a rhythmic click… click… click. This "click of death" most directly indicates: - A) A corrupted file system (a logical problem) - B) The heads failing to read the servo data they need to position, so the firmware retracts and retries - C) A TRIM command erasing flash blocks - D) The drive is simply full

Q3. You have a drive with a burned PCB and an identical donor drive. Why will simply swapping the donor's circuit board onto the patient usually fail on a modern drive? - A) PCBs are permanently glued in place - B) The original board's ROM/NVRAM holds drive-specific adaptive parameters that must be transferred to the donor board - C) Donor boards always run at a different voltage - D) The platters are physically keyed to their original board

Q4. Among the four NAND cell types, which stores the most bits per cell and has the lowest endurance (fewest program/erase cycles)? - A) SLC - B) MLC - C) TLC - D) QLC

Q5. Because of NAND flash's defining asymmetry, you can read or program a __, but you can only erase a ____: - A) block; page - B) page; block - C) cell; page - D) sector; cluster

Q6. Losing or corrupting the Flash Translation Layer's mapping table is catastrophic because: - A) The FTL is where the user's files are physically stored - B) The FTL holds the logical-to-physical map; without it the raw NAND pages cannot be reassembled into the host's view of the drive - C) The FTL stores the operating system's login password - D) The FTL is the only copy of the master boot record

Q7. Which RAID level stripes data across all members with no redundancy whatsoever, so the failure of any single disk destroys the entire array? - A) RAID 0 - B) RAID 1 - C) RAID 5 - D) RAID 6

Q8. When a RAID 5 array loses one disk, it reconstructs that disk's data on the fly using: - A) A complete spare copy kept on another member - B) The XOR of the surviving data blocks and the parity block in each stripe - C) The Reed-Solomon "Q" syndrome only - D) The information recorded in each disk's SMART log

Q9. Network storage divides cleanly by what it serves: a NAS serves __ over the network, while a SAN serves ____: - A) blocks; files - B) files; blocks - C) files; files - D) blocks; blocks

Q10. The cardinal rule when recovering or examining a RAID array is: - A) Rebuild it on the original controller before doing anything else - B) Image each member disk individually, then reconstruct the array virtually, read-only - C) Image only the disk that failed - D) Let the controller restore parity, then copy the volume off

True / False

Q11. When a RAID 5 array degrades, the safest first step is to insert a replacement disk and let the hardware controller rebuild onto it. (True / False)

Q12. On a TRIM-enabled SSD, a deleted file can be physically erased by the controller's garbage collection within minutes and with no host involvement — so the mere absence of a deleted file on such a drive is not, by itself, proof that someone deliberately wiped it. (True / False)

Short answer

Q13. Explain why a SMART overall-health result of "PASSED" can be dangerously misleading on an aging hard drive, and name two raw attributes you would read instead to judge a hard drive's true health.

Q14. A microSD card's controller has failed. Explain why recovery is so much harder than for an older standard-construction USB stick with the same failure, using the terms monolithic, test points, and FTL.

---

Answer key

Q1 — B. The service area is the drive's own "operating system," invisible to the host. When it corrupts, the drive cannot present your data — wrong model string, 0 LBA, or a hung busy state — but the user data on the platters is untouched. Repair means service-area work with specialized hardware (the PC-3000), not data loss.

Q2 — B. Clicking is a mechanical/positioning failure: the heads cannot read the servo information needed to settle on track, so the actuator retracts and retries, click after click. Each retry drags damaged heads across the platters, so a clicking drive is powered down immediately and sent to a clean-room lab. (A is wrong — clicking is physical, not logical.)

Q3 — B. On drives from roughly the last fifteen years, the ROM/NVRAM on the PCB stores adaptive calibration unique to that drive's heads and platters. A blind board swap leaves the drive unable to initialize, or mis-calibrating in ways that can cause further damage. A correct repair transfers the original ROM (or its contents) to the donor board.

Q4 — D. QLC packs four bits per cell across sixteen voltage states; the razor-thin windows make it the slowest and least durable (often only 100–1,000 P/E cycles), which is why it appears in high-capacity, read-heavy drives and leans hard on LDPC error correction. SLC (1 bit, 2 states) is the opposite extreme.

Q5 — B. You program (write) and read at the page (typically 4–16 KB), but you can only erase at the much larger block (hundreds of pages). There is no overwrite-in-place; this single asymmetry forces the FTL, wear leveling, and garbage collection to exist.

Q6 — B. The FTL maps each host LBA to the physical NAND page currently holding it, and that page moves with every rewrite. Lose the map and the raw NAND is "a jigsaw with no picture on the box" — which is also why chip-off dumps of modern SSDs usually fail: the pages are readable but unassemblable, and often encrypted besides.

Q7 — A. RAID 0 is pure striping for speed and full combined capacity with zero redundancy; every file is fragmented across all members, so losing any one disk destroys the whole array. RAID 1/5/6 all add some form of redundancy.

Q8 — B. RAID 5 parity is the XOR of the data blocks in each stripe. Because P = D1 ⊕ D2 ⊕ D3 ⊕ …, any single missing term equals the XOR of all the others, so the array recomputes a dead disk's blocks from the survivors — which is exactly why it tolerates one failure and no more. (The Reed-Solomon "Q" syndrome in C belongs to RAID 6.)

Q9 — B. A NAS (Synology, QNAP, TrueNAS) serves files via SMB/NFS/AFP; a SAN serves raw blocks as LUNs over iSCSI or Fibre Channel, which the connected servers format with their own file systems. The unit of recovery and evidence on a SAN is the LUN, not the physical disk.

Q10 — B. Always image every member individually (with per-disk hashes), then reconstruct the array virtually. A hardware rebuild writes to your only copies and can stress an aging survivor into a second failure — finishing the job the first failure started. Virtual reassembly lets you try geometries non-destructively and preserves each member as independent evidence.

Q11 — False. This is the classic RAID mistake. A hardware rebuild writes to the array and forces a full read of every surviving disk, frequently triggering a second failure or a URE that aborts the rebuild. Image every member individually first, then reconstruct virtually, read-only.

Q12 — True. TRIM plus background garbage collection physically erases the NAND behind deleted blocks on the drive's own schedule, often within minutes. The resulting field of zeros is the medium's normal behavior; reading it as deliberate anti-forensic wiping is a classic, credibility-destroying error. The absence of data is a finding to document, not proof of intent.

Q13. "PASSED" is only a coarse pass/fail flag, and a drive can report PASSED with normalized values above their thresholds while the raw attributes describe active mechanical decline. For a hard drive, read the raw Reallocated Sector Count (SMART attribute 5) and Current Pending Sector (SMART attribute 197) — and, as supporting context, Offline Uncorrectable (198) and Power-On Hours (9). Thousands of reallocated or hundreds of pending sectors mean "image once, now, gently," whatever the headline says.

Q14. In an older standard USB stick, the NAND is a discrete chip on a PCB, so a lab can desolder it ("chip-off"), read its raw pages on a programmer, and then reverse the FTL to rebuild the file system. A microSD card is monolithic — controller, NAND die, and bond wiring are all sealed in one epoxy package, so there is no chip to lift. Recovery means locating the package's exposed test points, identifying the pinout, and reading the raw NAND through an ISP jig — and only then facing the same FTL reconstruction. It is among the most specialized work in the field, with no guarantee of success.

Scoring: 13–14 correct — you have the device-level fluency this book assumes; proceed to Chapter 4 confidently. 10–12 — solid; re-read the sections behind any miss, especially the FTL (Q5, Q6) and RAID parity/rebuild (Q8, Q10, Q11). 7–9 — re-read the HDD-failure, SSD/NAND, and RAID sections and redo exercises.md Groups B, C, and E. 6 or below — work the chapter again from the top; every recovery chapter in Part II stands on knowing how each medium stores and how each one loses.