Exam 17: Digital Evidence on Windows Systems

EnCase can recover deleted files but does not have the capability of recovering deleted directories.

Internet traces may be found in which of the following categories?

With the correct CMOS setting, it is possible to mount a hard drive as Read-Only in the Windows environment.

Before evidentiary media is "acquired," forensic examiners often______________ the media to make sure it contains data relevant to the investigation.

Log files are used by the forensic examiner to_________ .

When examining the "news.rc," you find the following entry: $\text { alt.binaries.hacking.utilities! } 1 - 8905,8912,8921,8924,8926,8929,8930,8932$ What does the "!" mean?

NTFS time represents time as the number of 100-nanosecond intervals since January 1, 1601 00:00:00 UTC.

In NTFS, when a file is deleted from a directory, the last modified and accessed date-time stamps of the parent directory listing are updated.

In FAT32 file systems both the directory and FAT entries are updated when a file is deleted.

The standard Windows environment supports all of the following file systems EXCEPT____________ .

"File carving" is an examination technique where the beginning and end of a file are located, and the block of data spanning the two locations is copied to a new file, with the appropriate extension.

When a file is moved within a volume, the Last Accessed Date Time:

In the Windows environment, simply opening a file to read, without writing it back to disk, can change the date-time stamp.

The Windows environment is invasive and poses a challenge to forensic examiners.

Forensically acceptable alternatives to using a Windows Evidence Acquisition Boot Disk include all but which of the following?

Usenet readers store all the URLs that have been accessed, but do not record which Usenet newsgroups have been accessed and joined.

6 . Which of the following software tools is NOT used for data recovery?

Media can be accessed for examination either ________or____________ . (Choose two)

Windows evidentiary media must be acquired and examined with Windows-based examination software.

Given their widespread use and simple structure, FAT file systems are a good starting point for forensic analysts to understand file systems and recovery of deleted data.