Computer Hacking Forensic Investigator (CHFI v10) — Question 296

A company is investigating an issue with one of their Windows servers that fails to boot up. The IT forensics team is called upon to determine the cause of the issue. According to the standard Windows Boot Process (BIOS-MBR method), what is the likely issue if the system fails right after the BIOS completes the power-on self-test (POST) and before the master boot record (MBR) is loaded?

Answer options

• A. Failure in loading the OS kernel ntoskrnl.exe
• B. The system boot disk is not detected
• C. Failure of the Boot Configuration Data (BCD)
• D. Failure of the Bootmgr.exe

Correct answer: B

Explanation

The correct answer is B, as the system cannot proceed to load the MBR if the boot disk is not detected. If the boot disk is missing or disconnected, the BIOS completes POST but cannot locate the MBR to continue the boot process. The other options relate to issues that occur after the MBR has been loaded.