312-49 · Question #210
When carrying out a forensics investigation, why should you never delete a partition on a dynamic disk?
The correct answer is C. This action can corrupt the disk. Dynamic disks in Windows store their volume and partition configuration in a central database located at the end of the disk (the LDM - Logical Disk Manager database). Unlike basic disks where partition metadata is self-contained, dynamic disk volumes are interdependent and…
Question
When carrying out a forensics investigation, why should you never delete a partition on a dynamic disk?
Options
- AAll virtual memory will be deleted
- BThe wrong partition may be set to active
- CThis action can corrupt the disk
- DThe computer will be set in a constant reboot state
How the community answered
(39 responses)- B3% (1)
- C92% (36)
- D5% (2)
Explanation
Dynamic disks in Windows store their volume and partition configuration in a central database located at the end of the disk (the LDM - Logical Disk Manager database). Unlike basic disks where partition metadata is self-contained, dynamic disk volumes are interdependent and reference shared metadata. Deleting a partition (volume) on a dynamic disk can corrupt this central LDM database, potentially making all other volumes on the disk inaccessible and destroying forensic evidence. From a forensic standpoint, any action that risks corrupting the disk is unacceptable - investigators must always work on forensic images, not original media, to avoid this risk entirely.
Topics
Community Discussion
No community discussion yet for this question.