Computer Hacking Forensic Investigator (CHFI) — Question 127

You are using DriveSpy, a forensic tool and want to copy 150 sectors where the starting sector is 1709 on the primary hard drive. Which of the following formats correctly specifies these sectors?

Answer options

• A. 0:1000, 150
• B. 0:1709, 150
• C. 1:1709, 150
• D. 0:1709-1858

Correct answer: B

Explanation

The correct format to specify the sectors is '0:1709, 150' because it indicates the starting point and the number of sectors to copy. Options A and C provide incorrect starting sectors, while option D uses a different format that specifies a range rather than the count of sectors.