Digital Forensic Certification Practice Exam

What command can Harrison use to view the detailed partition layout for a GPT disk?

1. mmls

2. list disk

3. diskpart

4. show partitions

The correct answer is: mmls

Harrison can use the command `mmls` to view the detailed partition layout for a GPT disk. The `mmls` command is part of The Sleuth Kit, a set of command-line tools that allows forensic analysts to examine the structure of disk images and file systems. Specifically, `mmls` is designed to display the partition layout of a disk, including the start and end of each partition, the size, and the file system type, which is essential for forensic analysis. Understanding disk structures is crucial in digital forensics, and `mmls` provides a clear and concise overview of the partitions, making it a favored choice for such tasks. In comparison, other options like `list disk` and `diskpart` are commands used within Windows Command Prompt and PowerShell for managing disks but do not focus specifically on providing the level of detailed analysis that `mmls` offers for partition layouts. The command `show partitions` is typically associated with a different context and does not exist in common forensic toolkits for displaying GPT partition information. Thus, `mmls` stands out as the most appropriate command for this purpose.