Computer Hacking Forensic Investigator (CHFI v10) — Question 438

A digital forensics investigator is examining a suspect's hard disk drive. The hard disk is known to have 16,384 cylinders, 16 heads, and 63 sectors per track, with a sector size of 512 bytes. During the investigation, the forensic analyst identifies a particular file that resides in two sectors. Considering that each sector contains data plus overhead information such as ID, synchronization fields. ECC, and gaps, what is the maximum potential size of this particular file stored on the disk?

Answer options

• A. More than 512 bytes but less than 1024 bytes
• B. Equal to or more than 1024 bytes
• C. Equal to 512 bytes
• D. Less than 512 bytes

Correct answer: A

Explanation

The maximum size of the file that occupies two sectors is 1024 bytes; however, due to the overhead in each sector, the actual usable data will be less than that. Thus, the file must be more than 512 bytes but cannot reach 1024 bytes, making option A the correct choice. Options B, C, and D are incorrect because they do not accurately reflect the file size constraints given the overhead.