CHFI Storage Forensics and File System Analysis Practice Question
An analyst recovers a hard drive from a suspect's computer. The drive has a partition table that uses a 32-bit identifier and a maximum partition size of 2 TB. Which partition table type is present?
⚠ Common exam trap
A common misconception in CHFI exams is that GPT is the only partition table supporting large drives, but the question's specific mention of a '32-bit identifier' and '2 TB maximum' directly points to MBR, not GPT.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
MBR
The Master Boot Record (MBR) partition table uses a 32-bit identifier for partition entries and, with traditional 512-byte sectors, supports a maximum partition size of 2 TB. This matches the description exactly, making MBR the correct answer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
HFS+
Why it's wrong here
HFS+ (Hierarchical File System Plus) is a file system developed by Apple for managing files and directories, not a partition table. A partition table (like MBR or GPT) resides in the first sector(s) of a disk and defines how the disk is divided into partitions. HFS+ operates within a partition to store files, so it cannot be the correct answer to a question about partition-table size limits.
- ✗
GPT
Why it's wrong here
GPT (GUID Partition Table) is a modern partition-table standard that uses 64-bit logical block addresses and supports disks far larger than 2 TB, with a maximum partition size of 8 ZiB in theory. Because the question specifically identifies a maximum partition size of 2 TB—a characteristic of the legacy MBR scheme—GPT is incorrect here. Unlike MBR, GPT also stores multiple protective headers and checksums for redundancy.
- ✗
APFS
Why it's wrong here
APFS (Apple File System) is the current default file system for macOS and iOS, designed for SSDs with features like snapshots, encryption, and copy-on-write. It is not a partition table; it is a file system that lives inside partitions. Thus, APFS cannot be the correct answer when the distinguishing clue is a 2 TB partition-size cap tied to MBR.
- ✓
MBR
Why this is correct
MBR (Master Boot Record) is a legacy partition table that uses 32-bit entries in its partition table, limiting the maximum addressable partition size to 2 TB (or 2.2 TB with 512-byte sectors). It resides in the first 512 bytes of the disk and contains boot code plus four primary partition entries. This 2 TB ceiling is the exact characteristic indicated in the question, making MBR the correct answer.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CHFI question from scratch — 745 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.