312-49 · Question #210
312-49 Question #210: Real Exam Question with Answer & Explanation
The correct answer is C: This action can corrupt the disk. Dynamic disks in Windows store their volume and partition configuration in a central database located at the end of the disk (the LDM — Logical Disk Manager database). Unlike basic disks where partition metadata is self-contained, dynamic disk volumes are interdependent and ref
Question
When carrying out a forensics investigation, why should you never delete a partition on a dynamic disk?
Options
- AAll virtual memory will be deleted
- BThe wrong partition may be set to active
- CThis action can corrupt the disk
- DThe computer will be set in a constant reboot state
Explanation
Dynamic disks in Windows store their volume and partition configuration in a central database located at the end of the disk (the LDM — Logical Disk Manager database). Unlike basic disks where partition metadata is self-contained, dynamic disk volumes are interdependent and reference shared metadata. Deleting a partition (volume) on a dynamic disk can corrupt this central LDM database, potentially making all other volumes on the disk inaccessible and destroying forensic evidence. From a forensic standpoint, any action that risks corrupting the disk is unacceptable — investigators must always work on forensic images, not original media, to avoid this risk entirely.
Topics
Community Discussion
No community discussion yet for this question.