Computer Hacking Forensic Investigator (CHFI v10) — Question 377

What does the bytes 0x0B-0x53 represent in the boot sector of NTFS volume on Windows 2000?

Answer options

• A. Jump instruction and the OEM ID
• B. BIOS Parameter Block (BPB) and the OEM ID
• C. BIOS Parameter Block (BPB) and the extended BPB
• D. Bootstrap code and the end of the sector marker

Correct answer: C

Explanation

The correct answer is C because the bytes from 0x0B to 0x53 in the NTFS boot sector contain the BIOS Parameter Block (BPB) which includes critical information about the file system structure, along with the extended BPB. The other options do not accurately describe the contents of these specific bytes in the NTFS boot sector.