312-49 · Question #371
Using Linux to carry out a forensics investigation, what would the following command accomplish? dd if=/usr/home/partition.image of=/dev/sdb2 bs=4096 conv=notrunc,noerror
The correct answer is D. Restore a disk from an image file. In the dd command, 'if' (input file) specifies the source and 'of' (output file) specifies the destination. Here, the source is a stored image file (/usr/home/partition.image) and the destination is a physical partition (/dev/sdb2). This means data is flowing FROM the image…
Question
Using Linux to carry out a forensics investigation, what would the following command accomplish? dd if=/usr/home/partition.image of=/dev/sdb2 bs=4096 conv=notrunc,noerror
Options
- ASearch for disk errors within an image file
- BBackup a disk to an image file
- CCopy a partition to an image file
- DRestore a disk from an image file
How the community answered
(34 responses)- A3% (1)
- B3% (1)
- C12% (4)
- D82% (28)
Explanation
In the dd command, 'if' (input file) specifies the source and 'of' (output file) specifies the destination. Here, the source is a stored image file (/usr/home/partition.image) and the destination is a physical partition (/dev/sdb2). This means data is flowing FROM the image file TO the physical disk - a restore operation. 'bs=4096' sets the block size, 'notrunc' prevents truncation of the output, and 'noerror' continues despite read errors. If the intent were a backup, the if= and of= values would be reversed.
Topics
Community Discussion
No community discussion yet for this question.