Computer Hacking Forensic Investigator (CHFI v10) — Question 430

A computer forensics investigator is analyzing a hard disk drive (HDD) that is suspected to contain evidence of criminal activity. The HDD has 20,000 cylinders, 16 heads, and 63 sectors per track, with each sector having 512 bytes. During the analysis, the investigator discovered a file of 1.5KB in size on the disk. How many sectors are allocated for the file, and what could be the consequences of such allocation for the investigation?

Answer options

• A. 2 sectors; the file might be fragmented, making it harder to retrieve
• B. 4 sectors; it may cause inefficiency in space utilization on the disk
• C. 3 sectors; it may increase the retrieval time due to increased sector overhead
• D. 3 sectors; the file might be fragmented, making it harder to retrieve

Correct answer: D

Explanation

The correct answer is D because a 1.5KB file requires 3 sectors (1.5KB = 1536 bytes, and 3 sectors = 1536 bytes). Fragmentation can occur if the file does not occupy contiguous sectors, complicating the retrieval process. Options A, B, and C are incorrect as they miscalculate the required sectors or the impact of fragmentation on the investigation.