Computer Hacking Forensic Investigator (CHFI v10) — Question 487

To understand the impact of a malicious program after the booting process and to collect recent information from the disk partition, an investigator should evaluate the content of the:

Answer options

• A. GRUB
• B. UEFI
• C. MBR
• D. BIOS

Correct answer: C

Explanation

The correct answer is C, MBR, as it is responsible for the boot process and contains information about disk partitions, making it crucial for understanding the impact of a malicious program. GRUB, UEFI, and BIOS serve different roles in the boot process and do not provide the same level of insight into the disk partition's recent state.