Computer Hacking Forensic Investigator (CHFI v10) — Question 465

What will the following command accomplish?
dd if=/dev/xxx of=mbr.backup bs=512 count=1

Answer options

• A. Back up the master boot record
• B. Restore the master boot record
• C. Mount the master boot record on the first partition of the hard drive
• D. Restore the first 512 bytes of the first partition of the hard drive

Correct answer: A

Explanation

The command 'dd if=/dev/xxx of=mbr.backup bs=512 count=1' is used to create a backup of the master boot record by copying the first 512 bytes from the specified input file to the output file 'mbr.backup'. The other options do not accurately describe the action taken by this command, as it does not restore or mount any records.