Question 1

What can you do to determine the number of sectors on a hard drive larger than 8GB?

Accepted Answer

A)  Use a UNIX tool like hdparm 
B)  Use a Windows tools like EnCase 
C)  Check the drive manufacturer's website for the specific drive 
D)  All of the above 
A)  Use a UNIX tool like hdparm 
B)  Use a Windows tools like EnCase 
C)  Check the drive manufacturer's website for the specific drive 
D)  All of the above

Question 2

Unicode can represent more characters than ASCII.

Accepted Answer

A) True 
 B)False

Question 3

The boot sector in a FAT volume contains all of the following information EXCEPT:

Accepted Answer

A)  Partition table 
B)  The number of file allocation tables available 
C)  Cluster size 
D)  Volume label 
A)  Partition table 
B)  The number of file allocation tables available 
C)  Cluster size 
D)  Volume label

Question 4

The first sector of a volume contains a:

Accepted Answer

A)  Boot sector 
B)  Master boot record 
C)  Root Directory 
D)  Partition 
A)  Boot sector 
B)  Master boot record 
C)  Root Directory 
D)  Partition

Question 5

The Macintosh Open Firmware can be instructed to boot from a CD-ROM by holding down the "b" key.

Accepted Answer

A) True 
 B)False

Question 6

In NTFS, an example of a file system feature that can be used to conceal data is:

Accepted Answer

A)  Setting the Read/Only attribute on the folder you want to protect 
B)  Storing data in a hidden partition 
C)  Using alternate data streams 
D)  None of the above 
A)  Setting the Read/Only attribute on the folder you want to protect 
B)  Storing data in a hidden partition 
C)  Using alternate data streams 
D)  None of the above

Question 7

Hard drive settings stored in a computer's CMOS RAM chip are always correct and accurate.

Accepted Answer

A) True 
 B)False

Question 8

The ENIAC was the first digital computer.

Accepted Answer

A) True 
 B)False

Question 9

File slack space is:

Accepted Answer

A)  The space between the end of a volume and the end of a partition 
B)  The sectors in a cluster that are not occupied by the file in that cluster 
C)  The space on a disk that is not allocated to files 
D)  The space left on a disk after a file is deleted 
A)  The space between the end of a volume and the end of a partition 
B)  The sectors in a cluster that are not occupied by the file in that cluster 
C)  The space on a disk that is not allocated to files 
D)  The space left on a disk after a file is deleted

Question 10

What is the ASCII representation of this hexadecimal data: "54686520737573706563742773206E616D65206973204D69636861656C"?

Accepted Answer

Determine the ASCII value asso

Question 11

Where is the partition table located on a hard drive, and what does it contain?

Accepted Answer

The partition table is located

Question 12

A sector is composed of multiple clusters.

Accepted Answer

A) True 
 B)False

Question 13

Which of the following are limitations to salvaging data through data carving?

Accepted Answer

A)  File name and date-time stamps that were associated with the file are not salvaged. 
B)  The size of the original file may not be known, making it necessary to guess how much data to carve out. 
C)  Simple carving assumes all portions of the file were stored contiguously, and not fragmented. 
D)  All of the above. 
A)  File name and date-time stamps that were associated with the file are not salvaged. 
B)  The size of the original file may not be known, making it necessary to guess how much data to carve out. 
C)  Simple carving assumes all portions of the file were stored contiguously, and not fragmented. 
D)  All of the above.

Question 14

The POST verifies that all of the computer's components are functioning properly.

Accepted Answer

A) True 
 B)False

What can you do to determine the number of sectors on a hard drive larger than 8GB?

Unicode can represent more characters than ASCII.

The boot sector in a FAT volume contains all of the following information EXCEPT:

The first sector of a volume contains a:

The Macintosh Open Firmware can be instructed to boot from a CD-ROM by holding down the "b" key.

In NTFS, an example of a file system feature that can be used to conceal data is:

Hard drive settings stored in a computer's CMOS RAM chip are always correct and accurate.

The ENIAC was the first digital computer.

File slack space is:

What is the ASCII representation of this hexadecimal data: "54686520737573706563742773206E616D65206973204D69636861656C"?

Where is the partition table located on a hard drive, and what does it contain?

A sector is composed of multiple clusters.

Which of the following are limitations to salvaging data through data carving?

The POST verifies that all of the computer's components are functioning properly.

Foundations of Digital Forensics

Language of Computer Crime Investigation

Digital Evidence in the Courtroom

Cybercrime Law: a United States Perspective

Cybercrime Law: a European Perspective

Conducting Digital Investigations

Handling a Digital Crime Scene

Investigative Reconstruction With Digital Evidence

Modus Operandi, Motive, and Technology

Violent Crime and Digital Evidence

Digital Evidence As Alibi

Sex Offenders on the Internet

Computer Intrusions

Cyberstalking

Applying Forensic Science to Computers

Digital Evidence on Windows Systems

Digital Evidence on Unix Systems

Digital Evidence on Macintosh Systems

Digital Evidence on Mobile Devices

Network Basics for Digital Investigators

Applying Forensic Science to Networks

Digital Evidence on the Internet

Digital Evidence at the Physical and Data-Link Layers

Digital Evidence at the Network and Transport Layers

Filters

Exam 15: Computer Basics for Digital Investigators

What can you do to determine the number of sectors on a hard drive larger than 8GB?

Unicode can represent more characters than ASCII.

The boot sector in a FAT volume contains all of the following information EXCEPT:

The first sector of a volume contains a:

The Macintosh Open Firmware can be instructed to boot from a CD-ROM by holding down the "b" key.

In NTFS, an example of a file system feature that can be used to conceal data is:

Hard drive settings stored in a computer's CMOS RAM chip are always correct and accurate.

The ENIAC was the first digital computer.

File slack space is:

What is the ASCII representation of this hexadecimal data: "54686520737573706563742773206E616D65206973204D69636861656C"?

Where is the partition table located on a hard drive, and what does it contain?

A sector is composed of multiple clusters.

Which of the following are limitations to salvaging data through data carving?

The POST verifies that all of the computer's components are functioning properly.

Foundations of Digital Forensics

Language of Computer Crime Investigation

Digital Evidence in the Courtroom

Cybercrime Law: a United States Perspective

Cybercrime Law: a European Perspective

Conducting Digital Investigations

Handling a Digital Crime Scene

Investigative Reconstruction With Digital Evidence

Modus Operandi, Motive, and Technology

Violent Crime and Digital Evidence

Digital Evidence As Alibi

Sex Offenders on the Internet

Computer Intrusions

Cyberstalking

Applying Forensic Science to Computers

Digital Evidence on Windows Systems

Digital Evidence on Unix Systems

Digital Evidence on Macintosh Systems

Digital Evidence on Mobile Devices

Network Basics for Digital Investigators

Applying Forensic Science to Networks

Digital Evidence on the Internet

Digital Evidence at the Physical and Data-Link Layers

Digital Evidence at the Network and Transport Layers

Filters