One way to identify the presence of hidden partitions on a suspect's hard drive is to:

The correct answer is A. Add up the total size of all known partitions and compare it to the total size of the hard drive. Summing the sizes of all visible partitions and comparing the total against the drive's reported physical size is an effective way to detect hidden or unaccounted-for space. If the sum is less than the total capacity, the discrepancy may indicate a hidden partition…

Submitted by ngozi_ng· Apr 18, 2026Disk Forensics

Question

One way to identify the presence of hidden partitions on a suspect’s hard drive is to:

Options

AAdd up the total size of all known partitions and compare it to the total size of the hard drive
BExamine the FAT and identify hidden partitions by noting an H in the partition Type field
CExamine the LILO and note an H in the partition Type field
DIt is not possible to have hidden partitions on a hard drive

How the community answered

(55 responses)

A
95% (52)
C
4% (2)
D
2% (1)

Explanation

Summing the sizes of all visible partitions and comparing the total against the drive's reported physical size is an effective way to detect hidden or unaccounted-for space. If the sum is less than the total capacity, the discrepancy may indicate a hidden partition, unpartitioned space used for steganographic storage, or a Host Protected Area (HPA). Option B is incorrect because the FAT does not have an 'H' flag for hidden partitions in the partition type field - that field is in the Master Boot Record partition table. Option D is false; hidden partitions absolutely can and do exist.

Topics

#Hidden partitions#Disk analysis#Forensic techniques#Partition identification

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice