Digital Forensics: Computer Hardware and File Systems for First Responders
Published:
Reviewed by Sourabh · 20 May 2026
Questions
30
Duration
30 min
Faculty-reviewed
0
Updated
20 May 2026
About this mock
FACT digital forensics drill on computer hardware and file systems for first responders, covering the motherboard, CPU and chipset, the memory hierarchy (RAM, ROM, cache), magnetic hard disk drives, solid state drives and NAND flash, USB flash drives and optical media, sector and cluster relationships and LBA addressing, MBR and GPT partitioning, the FAT chain, the NTFS Master File Table, the ext inode, MAC timestamps and the NTFS $STANDARD_INFORMATION versus $FILE_NAME contrast, networking components such as the NIC, switch, and router, kernel and user space, the boot process from POST to kernel under BIOS and UEFI, common file systems by operating system (NTFS, APFS, ext4, exFAT), and the purpose of file system journaling. Easy-band questions calibrated for first-pass FACT preparation and quick concept refresh before the entrance.
Pitched at FACT aspirants, NFSU MSc digital forensics entrants, and police personnel preparing to handle seized computers under the IT Act 2000 and BSA 2023. Questions stay at the definition and identification level, treating the responder who arrives at a scene, looks at a desktop or laptop, and has to write a sensible seizure memo and chain-of-custody form.
Topics covered:
- Motherboard, CPU, chipset, and the system bus
- Memory hierarchy: RAM volatility, ROM and firmware, CPU cache
- HDD platters, heads, sectors, and perpendicular magnetic recording
- SSD NAND flash, TRIM, USB pen drives, and optical CD/DVD media
- LBA addressing, sector versus cluster, slack space
- MBR partition limit, GPT header, protective MBR, and GPT capacity
- FAT chain, NTFS MFT, ext inode, MAC timestamps, $STANDARD_INFORMATION versus $FILE_NAME
- Networking components, kernel and user space, boot process, file systems by OS, journaling
Useful for revision and self-testing before the FACT digital forensics paper.
Allow 30 minutes.
Sources & references
Questions in this mock are written and verified against the following sources. Citations are recorded per question and shown in the explanation after submission.
- cited in 7 questions
Carrier, Brian — File System Forensic Analysis, Addison-Wesley, 2005
Chapter 5: PC-Based Partitions, DOS-Style Partitions
- cited in 4 questions
UEFI Forum — Unified Extensible Firmware Interface Specification
UEFI Specification 2.10, Section 5: GUID Partition Table (GPT) Disk Layout
Open source - cited in 4 questions
Nelson, Phillips, Steuart — Guide to Computer Forensics and Investigations, 6th Edition
Chapter on Removable Storage and Flash Media
- cited in 2 questions
Casey, Eoghan — Digital Evidence and Computer Crime, 3rd Edition, Academic Press, 2011
Chapter on File System Timestamps and Timeline Analysis
- cited in 2 questions
T13 Technical Committee — ATA Command Set Standard
INCITS 529 (ACS-4), Section on Hard Disk Drive Physical Recording
- cited in 2 questions
Patterson, David A.; Hennessy, John L. — Computer Organization and Design, 5th Edition
Chapter 5: Large and Fast — Exploiting Memory Hierarchy
- cited in 1 question
Apple Inc. — Apple File System Reference
Apple Developer Documentation, Apple File System Guide
Open source - cited in 1 question
Tanenbaum, Andrew S. — Computer Networks, 5th Edition, Pearson
Chapter on Switching and the Data Link Layer
- cited in 1 question
Intel Corporation — Platform Controller Hub Datasheet
Intel 500 Series Chipset Family Platform Controller Hub Datasheet, Volume 1
Open source - cited in 1 question
International Disk Drive Equipment and Materials Association (IDEMA) — Advanced Format Specification
IDEMA Document AF-005, 4K Sector Implementation Guide
- cited in 1 question
Sammes, Tony; Jenkinson, Brian — Forensic Computing, 2nd Edition, Springer
Chapter on Optical Storage Media
- cited in 1 question
NIST Special Publication 800-86
Guide to Integrating Forensic Techniques into Incident Response, Section on Solid State Storage
Open source - cited in 1 question
Silberschatz, Galvin, Gagne — Operating System Concepts, 10th Edition, Wiley
Chapter 1: Introduction, Dual-Mode Operation
- cited in 1 question
Microsoft Corporation — Windows Internals NTFS Reference
Microsoft Docs, How NTFS Works, Master File Table
Open source - cited in 1 question
IEEE Standards Association — IEEE 802.3 Ethernet Standard
IEEE Std 802.3, Section on Frame Format and MAC Addressing
Open source
How our mocks are built
Questions are written and edited by the ForensicSpot team and cited from peer-reviewed forensic textbooks, official syllabi and primary case law. Each one is verified before publishing. Detailed explanations show after you submit, so the test stays a real test. See a mistake? Tell us.
Common questions
What does the Digital Forensics: Computer Hardware and File Systems for First Responders mock cover?+
FACT digital forensics drill on computer hardware and file systems for first responders, covering the motherboard, CPU and chipset, the memory hierarchy (RAM, ROM, cache), magnetic hard disk drives, solid state drives and NAND flash, USB flash drives and optical media, sector and cluster relationships and LBA addressing, MBR and GPT partitioning, the FAT chain, the NTFS Master File Table, the ext inode, MAC timestamps and the NTFS $STANDARD_INFORMATION versus $FILE_NAME contrast, networking comp
How many questions and how long is the test?+
30 multiple-choice questions, 30 minutes total. Difficulty: easy. Tier: Premium.
Who is this mock for?+
Forensic science students and aspirants who want timed, exam-style practice with explanations and verified source citations on Digital Forensics, FACT. Useful for postgraduate entrance preparation and for BSc / MSc forensic students testing their recall under time.
Are the questions reviewed?+
Each question carries a verified source citation. Faculty review for individual questions is in progress.
Do I need an account to take this mock?+
Yes, a free ForensicSpot account is required to start a timed attempt — this lets you save progress, see per-question explanations after submission, and track your topic-level performance over time.