Question

Answer (Detailed Solution Below)

Option 3 : Sector-level examination of the unused bytes between a file's logical end-of-file and the end of its last allocated cluster

Detailed Solution

सही उत्तर Sector-level examination of the unused bytes between a file's logical end-of-file and the end of its last allocated cluster है।

Key Points

Helpful?

prepsnap.in • Part -A

Question:

An investigator wants to recover data from file slack on a 4 KB-cluster NTFS volume. Which technique actually targets slack space? / अन्वेषक 4 KB-क्लस्टर NTFS वॉल्यूम पर फाइल स्लैक से डेटा निकालना चाहता है। कौन-सी तकनीक वास्तव में स्लैक स्पेस को लक्षित करती है?

Reading the $MFTMirr backup copy of the master file table

Parsing the volume's journal to replay deleted transactions

Sector-level examination of the unused bytes between a file's logical end-of-file and the end of its last allocated cluster

Rebuilding the file from the recycle bin's $I metadata files

Correct Answer: Sector-level examination of the unused bytes between a file's logical end-of-file and the end of its last allocated cluster

Slack is precisely the gap between logical EOF and the cluster boundary, and only raw sector reads of that region reveal it; the other options target different structures. / स्लैक EOF और क्लस्टर-सीमा के बीच का अंतर है; इसे सिर्फ रॉ सेक्टर रीडिंग से पढ़ा जा सकता है। Option (b) is the trap — journaling replays metadata transactions, not slack contents.

Downloaded from PrepSnap (prepsnap.in)