Computer Hacking Forensic Investigator (CHFI v10) — Question 1

When examining a file with a Hex Editor, what space does the file header occupy?

Answer options

• A. the last several bytes of the file
• B. the first several bytes of the file
• C. none, file headers are contained in the FAT
• D. one byte at the beginning of the file

Correct answer: B

Explanation

The correct answer is B, as file headers are typically located in the initial bytes of the file, providing essential metadata about the file's structure. Option A is incorrect because the header is not found at the end of the file, while option C is wrong since file headers are part of the file itself, not the File Allocation Table (FAT). Option D is also incorrect because the header usually occupies more than just one byte.