EC - 3 (C/E)

Which of the following statements pertaining to GPT-partitioned disks is true?

• GUIDs possess unique identifying information for disks as a whole but not for individual partitions

• It is not possible for intruders to hide data on GPT-partitioned disks as they do it on traditional MBR-partitioned disks

• Investigators cannot recover any deleted data from a disk that has been converted to an MBR partition style from the GPT partition style

• Locations on GPT disks where data may be hidden are inter-partition gaps, unpartitioned space toward the end of the disk, GPT header, and reserved areas

Andrew, a system administrator, is performing a UEFI boot process. The current phase of UEFI boot process consists of initialization code that the system executes after powering on the EFI system. This phase also manages platform reset events and sets the system so that it can find, validate, install, and run the PEI.

Identify the UEFI boot process phase Andrew is currently in.

• Pre-EFI initialization (PEI) phase

• Driver execution environment (DXE) phase

• Boot device selection (BDS) phase

• Security (SEC) phase

Which of the following tools can investigators use to decode various versions of GUID/UUID?

• Autopsy

• Istat

• mmls

• uuid

Given below are the different phases involved in the UEFI boot process:

1 Security phase

2 Boot device selection phase

3 Driver execution environment phase

4 Pre-EFI initialization phase

5 Runtime phase

What is the correct sequence of phases involved in the UEFI boot process?

• 1 ->4 ->3 ->2 ->5

• 1 ->2 ->3 ->4 ->5

• 2 -> 3 ->4 ->1 ->5

• 2 ->5 ->4 ->3 ->1

The UEFI-GPT method of booting is available on which of the following versions of Windows Operating Systems? 

• Windows XP through Windows 7

• Windows Vista

• Windows 7

• Windows 8 and above

Which of the following phases in the UEFI-GPT method of booting on Windows systems is responsible for initializing hardware such as CPU, permanent memory, and boot firmware volume (BFV)? 

• Security phase (SEC phase)

• Driver execution environment phase (DXE phase)

• Runtime phase

• Pre-EFI initialization phase (PEI phase)

Which of the following phases in the UEFI-GPT method of booting on Windows systems is responsible for loading and executing the EFI drivers?         

• Security phase (SEC phase)

• Pre-EFI initialization phase (PEI phase)

• Runtime phase

• Driver execution environment phase (DXE phase)

Which of the following is the final phase in the UEFI-GPT method of booting on Windows systems?      

• Boot device selection phase (BDS phase)

• Driver execution environment phase (DXE phase)

• Pre-EFI initialization phase (PEI phase)

• Runtime phase

Which of the following statements is true?          

• The booting process loads the OS to the ROM (read-only memory)

• Warm boot/soft boot is the process of starting a computer from a powered-down or off state

• Cold boot/hard boot is the process of restarting a computer that is already turned on

• The booting process loads the OS (stored in the hard disk) to the RAM (working memory)

Which of the following cmdlets allows an investigator to analyze the GPT data structure of a hard disk?  

• Get-GPT

• Get-BootSector

• Get-PartitionTable

• Get-MBR