Computer Hacking Forensic Investigator (CHFI v10) — Question 443

You are using DriveSpy, a forensic tool and want to copy 150 sectors where the starting sector is 1709 on the primary hard drive. Which of the following formats correctly specifies these sectors?

Answer options

• A. 0:1000, 150
• B. 0:1709, 150
• C. 1:1709, 150
• D. 0:1709-1858

Correct answer: B

Explanation

The correct answer is B, which specifies the starting sector as 1709 and the number of sectors to copy as 150. Option A incorrectly starts at sector 1000, C uses an incorrect drive number, and D provides a range instead of specifying the number of sectors to copy, which does not match the format required.