Computer Hacking Forensic Investigator (CHFI v10) — Question 219

An investigator seized a notebook device installed with a Microsoft Windows OS. Which type of files would support an investigation of the data size and structure in the device?

Answer options

• A. APFS and HFS
• B. Ext2 and Ext4
• C. HFS and GNUC
• D. NTFS and FAT

Correct answer: D

Explanation

The correct answer is D, as NTFS and FAT are the file systems used by Microsoft Windows, offering details about data size and structure. Options A, B, and C refer to file systems used by other operating systems, such as macOS and Linux, which would not be relevant for a Windows device.