Computer Hacking Forensic Investigator (CHFI) — Question 9

When examining a file with a Hex Editor, what space does the file header occupy?

Answer options

• A. the last several bytes of the file
• B. the first several bytes of the file
• C. none, file headers are contained in the FAT
• D. one byte at the beginning of the file

Correct answer: B

Explanation

The correct answer is B because the file header typically occupies the initial bytes of the file, providing essential metadata. Options A and D are incorrect as they misplace the location of the header, and option C is wrong because, while the FAT contains file information, the actual headers are stored within the file itself.