Chapter 6 — Quiz

14 questions: 10 multiple choice, 2 true/false, 2 short answer. Answers and a scoring band are at the bottom. No peeking until you have committed to an answer.

Multiple choice

Q1. When an operating system "deletes" a file, what actually happens first? - A) The data clusters are immediately overwritten with zeros - B) The file-system pointer/metadata entry is changed to "free," while the data persists until something overwrites it - C) The entire partition table is rewritten - D) The drive's magnetic domains are degaussed

Q2. On NTFS, which single field tells you from a raw record that a file has been deleted? - A) The $DATA attribute has been removed from the record - B) The record signature has changed from FILE to BAAD - C) The in-use bit in the record flags at offset 0x16 has been cleared (0x0001 → 0x0000) - D) The filename's first byte has become 0xE5

Q3. What does FAT do to the filename when a file is deleted? - A) It zeroes the entire 8.3 name - B) It replaces the first byte of the name with 0xE5, permanently losing the first character - C) Nothing — the full name is preserved - D) It removes only the extension

Q4. Why is deleted-file recovery on ext4 harder than on NTFS? - A) ext4 overwrites the data area instantly on delete - B) ext4 keeps no timestamps to work from - C) On deletion ext4 zeroes the inode's extent tree, destroying the map from inode to data blocks - D) ext4 encrypts every file by default

Q5. What does a quick format do? - A) Overwrites every sector of the volume with zeros - B) Writes a fresh, empty set of file-system structures over the metadata regions but leaves the data area untouched - C) Physically scrubs the platters - D) It is identical in effect to a Windows Vista+ full format

Q6. On Windows Vista and later, a completed full format: - A) Only scans for bad sectors, leaving the data intact - B) Performs a full write pass over the entire volume (typically writing zeros), so the data is genuinely gone - C) Is trivially reversible with TestDisk - D) Only rewrites the partition table

Q7. Interpreting the data run 32 00 03 00 20 00 00 on a volume with 4 KiB clusters, the file occupies: - A) 3 clusters starting at cluster 32 - B) 768 clusters starting at cluster 8192 (about 3 MB) - C) 8192 clusters starting at cluster 768 - D) 2 clusters starting at cluster 0x32

Q8. Which tool ignores the file system entirely and recovers files by their signatures (headers and footers)? - A) TestDisk - B) fls - C) PhotoRec - D) extundelete

Q9. Where does NTFS keep a backup boot sector that can help relocate the old $MFT after a format? - A) At LBA 0 - B) In MFT record 0 - C) At the very last sector of the volume - D) Inside the $LogFile

Q10. In The Sleuth Kit, how does fls mark a deleted entry in its output? - A) With a trailing "X" - B) With a leading 0xE5 byte - C) With an asterisk (*) - D) By printing the line in red

True / False

Q11. On a TRIM-enabled SSD, deleted-file recovery is just as reliable as on a spinning hard disk. (True / False)

Q12. You should image a drive before recovery even when the job is purely "get my photos back" and no court will ever see the work. (True / False)

Short answer

Q13. In one or two sentences, explain why a FAT file that was stored contiguously recovers perfectly while a fragmented one often does not.

Q14. Name the single practice that protects both a recovery job and a forensic case, and give one reason it matters for each discipline.

---

Answer key

Q1 — B. Deletion edits bookkeeping to mark space free; the bytes persist until overwritten. Deleted is not destroyed — the foundation of the whole discipline.

Q2 — C. The decisive field is the record flags at offset 0x16; the in-use bit clears from 0x0001 to 0x0000. The signature stays FILE, and $DATA and the name survive — which is why NTFS undelete works.

Q3 — B. FAT stamps the first name byte with 0xE5 (the universal "deleted" marker) and zeroes the cluster chain. The lost first character is why recovered FAT files appear as _ACATION.JPG.

Q4 — C. The extent tree (the inode-to-data map) is zeroed on deletion; the data blocks survive but the index to them is gone. Recovery then leans on the journal (extundelete) or carving.

Q5 — B. A quick format lays down fresh empty structures over the small metadata regions and declares the volume empty; the data area is untouched, so files persist in their old clusters.

Q6 — B. Since Vista, a completed full format writes over the entire volume (plus a bad-sector scan), so logical recovery fails. (Windows XP's "full format" only read-scanned and was recoverable; an interrupted Vista+ full format may leave the un-reached tail intact.)

Q7 — B. Header 0x32: low nibble 2 = two length bytes (00 03 → 768 clusters); high nibble 3 = three offset bytes (00 20 00 → cluster 8192). 768 × 4096 = 3,145,728 bytes ≈ 3 MB.

Q8 — C. PhotoRec carves by signature, ignoring the file system — the right tool exactly when metadata is gone. TestDisk does partition/FS-aware work; fls and extundelete use file-system metadata.

Q9 — C. NTFS writes a backup boot sector at the last sector of the volume and an $MFTMirr (record 1) mirroring the first four MFT records — redundancy that survives many formats.

Q10 — C. fls prefixes deleted entries with an asterisk (e.g., r/r * 5132-128-1: …). The red coloring in option D is TestDisk's GUI convention, not fls.

Q11 — False. TRIM tells the SSD controller the deleted blocks are free; the controller erases them in the background, often within seconds. Deleted-file recovery on a TRIM-enabled SSD frequently returns zeros. (Chapter 9.)

Q12 — True. The original is irreplaceable, recovery and repair tools write, a weak drive can fail mid-job, and recovery is iterative — all of which demand an image you can re-derive a clean copy from. The paperwork differs for court; the imaging step does not.

Q13 — Model answer. Deletion zeroes the cluster chain but keeps the start cluster and size, so a contiguous file is read by streaming ceil(size/cluster_size) consecutive clusters from the start. A fragmented file lost the chain that recorded where it jumped next, so reading forward optimistically yields a file that is correct until the first fragment boundary and garbage after — which is why fragmented FAT files usually fall back to carving.

Q14 — Model answer. Image first and work only on the copy. For recovery: the original is irreplaceable and recovery tools write, so any mistake must be made on a discardable copy. For forensics: the verified image plus its hash is what makes findings admissible and lets another examiner reproduce them — chain of custody. Same action, two purposes.

Scoring: 13–14 correct — you have the mechanics and the discipline; proceed to file carving. 10–12 — solid; revisit the file-system-specific deletion behavior (Q2–Q4, Q7) and the format/TRIM limits (Q6, Q11). 7–9 — re-read "What 'delete' actually does" and "Limitations: knowing when to stop," then re-take. Below 7 — work the chapter's worked example end to end with a practice image before moving on; the bytes will teach what the prose alone did not.