QuestionQ371

Digital Evidence

During a ransomware investigation at a San Francisco law firm, forensic analysts restore encrypted drive images from backups to determine the structure of user data. While reviewing the recovered disk, they observe that the smallest addressable data unit is 512 bytes and that it forms the basis for higher-level organizational units such as clusters and files. Which logical disk-structure component are they examining?

  • A Sector
  • B Cluster
  • C Bit
  • D File system
Explanation

A sector is the disk’s smallest addressable storage unit. A traditional sector holds 512 bytes, while clusters are larger allocation units made up of one or more sectors.

Community Discussion

No comments yet. Be the first to start the discussion!