Question 1

Summarize the evolution of FAT versions.

Accepted Answer

The following list summarizes the evolut

Question 2

A ____ is a column of tracks on two or more disk platters.

Accepted Answer

A)  cylinder 
B)  sector 
C)  track 
D)  head 
A)  cylinder 
B)  sector 
C)  track 
D)  head

Question 3

A ____ allows you to create a representation of another computer on an existing physical computer.

Accepted Answer

A)  virtual file 
B)  logic drive 
C)  logic machine 
D)  virtual machine 
A)  virtual file 
B)  logic drive 
C)  logic machine 
D)  virtual machine

Question 4

Records in the MFT are referred to as ____.

Accepted Answer

A)  hyperdata 
B)  metadata 
C)  inodes 
D)  infodata 
A)  hyperdata 
B)  metadata 
C)  inodes 
D)  infodata

Question 5

What are some of the features offered by current whole disk encryption tools?

Accepted Answer

Current whole disk encryption tools offe

Question 6

The purpose of the ____ is to provide a mechanism for recovering encrypted files under EFS if there's a problem with the user's original private key.

Accepted Answer

A)  certificate escrow 
B)  recovery certificate 
C)  administrator certificate 
D)  root certificate 
A)  certificate escrow 
B)  recovery certificate 
C)  administrator certificate 
D)  root certificate

Question 7

As data is added, the MFT can expand to take up 75% of the NTFS disk.

Accepted Answer

A) True 
 B)False

Question 8

In the NTFS MFT, all files and folders are stored in separate records of ____ bytes each.

Accepted Answer

A)  1024 
B)  1512 
C)  2048 
D)  2512 
A)  1024 
B)  1512 
C)  2048 
D)  2512

Question 9

On an NTFS disk, immediately after the Partition Boot Sector is the ____.

Accepted Answer

A)  FAT 
B)  HPFS 
C)  MBR 
D)  MFT 
A)  FAT 
B)  HPFS 
C)  MBR 
D)  MFT

Question 10

Match each item with a statement below:
-the unused space between partitions

Accepted Answer

A) File system 
B) Tracks 
C) Track density 
D) Partition gap 
E) Drive slack
F)NTFS
G)Unicode
H)Data streams
I)BitLocker 
A) File system 
B) Tracks 
C) Track density 
D) Partition gap 
E) Drive slack
F)NTFS
G)Unicode
H)Data streams
I)BitLocker

Question 11

____ is a hidden text file containing startup options for Windows 9x.

Accepted Answer

A)  Pagefile.sys 
B)  Hal.dll 
C)  Msdos.sys 
D)  Ntoskrnl.exe 
A)  Pagefile.sys 
B)  Hal.dll 
C)  Msdos.sys 
D)  Ntoskrnl.exe

Question 12

Drive slack includes RAM slack (found primarily in older Microsoft OSs) and ____________________ slack.

Accepted Answer

The answer of Drive slack includes RAM slack (found primarily...

Question 13

One way to examine a partition's physical level is to use a disk editor, such as Norton DiskEdit, WinHex, or Hex Workshop.

Accepted Answer

A) True 
 B)False

Question 14

The first 5 bytes (characters) for all MFT records are MFTR0.

Accepted Answer

A) True 
 B)False

Question 15

What are BitLocker's current hardware and software requirements?

Accepted Answer

BitLocker's current hardware and softwar

Question 16

____ is a 16-bit real-mode program that queries the system for device and configuration data, and then passes its findings to NTLDR.

Accepted Answer

A)  Hal.dll 
B)  Boot.ini 
C)  NTDetect.com 
D)  BootSect.dos 
A)  Hal.dll 
B)  Boot.ini 
C)  NTDetect.com 
D)  BootSect.dos

Question 17

The file or folder's MFT record provides cluster addresses where the file is stored on the drive's partition. These cluster addresses are referred to as ____.

Accepted Answer

A)  virtual runs 
B)  metada 
C)  metaruns 
D)  data runs 
A)  virtual runs 
B)  metada 
C)  metaruns 
D)  data runs

Question 18

What are some of the components of a disk drive?

Accepted Answer

Following is a list of disk drive compon

Question 19

Match each item with a statement below:
-Microsoft's move toward a journaling file system

Accepted Answer

A) File system 
B) Tracks 
C) Track density 
D) Partition gap 
E) Drive slack
F)NTFS
G)Unicode
H)Data streams
I)BitLocker 
A) File system 
B) Tracks 
C) Track density 
D) Partition gap 
E) Drive slack
F)NTFS
G)Unicode
H)Data streams
I)BitLocker

Question 20

The ____ file provides a command prompt when booting to MS-DOS mode (DPMI).

Accepted Answer

A)  Io.sys 
B)  Autoexec.bat 
C)  Config.sys 
D)  Command.com 
A)  Io.sys 
B)  Autoexec.bat 
C)  Config.sys 
D)  Command.com

Summarize the evolution of FAT versions.

A ____ is a column of tracks on two or more disk platters.

A ____ allows you to create a representation of another computer on an existing physical computer.

Records in the MFT are referred to as ____.

What are some of the features offered by current whole disk encryption tools?

The purpose of the ____ is to provide a mechanism for recovering encrypted files under EFS if there's a problem with the user's original private key.

As data is added, the MFT can expand to take up 75% of the NTFS disk.

In the NTFS MFT, all files and folders are stored in separate records of ____ bytes each.

On an NTFS disk, immediately after the Partition Boot Sector is the ____.

Match each item with a statement below: -the unused space between partitions

____ is a hidden text file containing startup options for Windows 9x.

Drive slack includes RAM slack (found primarily in older Microsoft OSs) and ____________________ slack.

One way to examine a partition's physical level is to use a disk editor, such as Norton DiskEdit, WinHex, or Hex Workshop.

The first 5 bytes (characters) for all MFT records are MFTR0.

What are BitLocker's current hardware and software requirements?

____ is a 16-bit real-mode program that queries the system for device and configuration data, and then passes its findings to NTLDR.

The file or folder's MFT record provides cluster addresses where the file is stored on the drive's partition. These cluster addresses are referred to as ____.

What are some of the components of a disk drive?

Match each item with a statement below: -Microsoft's move toward a journaling file system

The ____ file provides a command prompt when booting to MS-DOS mode (DPMI).

Computer Forensics and Investigations As a Profession

Understanding Computer Investigations

The Investigators Office and Laboratory

Data Acquisition

Processing Crime and Incident Scenes

Current Computer Forensics Tools

Macintosh and Linux Boot Processes and File Systems

Computer Forensics Analysis and Validation

Recovering Graphics Files

Virtual Machines, Network Forensics, and Live Acquisitions

E-Mail Investigations

Cell Phone and Mobile Device Forensics

Report Writing for High-Tech Investigations

Expert Testimony in High-Tech Investigations

Ethics for the Expert Witness

Filters

Exam 6: Working With Windows and Dos Systems

Summarize the evolution of FAT versions.

A ____ is a column of tracks on two or more disk platters.

A ____ allows you to create a representation of another computer on an existing physical computer.

Records in the MFT are referred to as ____.

What are some of the features offered by current whole disk encryption tools?

The purpose of the ____ is to provide a mechanism for recovering encrypted files under EFS if there's a problem with the user's original private key.

As data is added, the MFT can expand to take up 75% of the NTFS disk.

In the NTFS MFT, all files and folders are stored in separate records of ____ bytes each.

On an NTFS disk, immediately after the Partition Boot Sector is the ____.

Match each item with a statement below: -the unused space between partitions

____ is a hidden text file containing startup options for Windows 9x.

Drive slack includes RAM slack (found primarily in older Microsoft OSs) and ____________________ slack.

One way to examine a partition's physical level is to use a disk editor, such as Norton DiskEdit, WinHex, or Hex Workshop.

The first 5 bytes (characters) for all MFT records are MFTR0.

What are BitLocker's current hardware and software requirements?

____ is a 16-bit real-mode program that queries the system for device and configuration data, and then passes its findings to NTLDR.

The file or folder's MFT record provides cluster addresses where the file is stored on the drive's partition. These cluster addresses are referred to as ____.

What are some of the components of a disk drive?

Match each item with a statement below: -Microsoft's move toward a journaling file system

The ____ file provides a command prompt when booting to MS-DOS mode (DPMI).

Computer Forensics and Investigations As a Profession

Understanding Computer Investigations

The Investigators Office and Laboratory

Data Acquisition

Processing Crime and Incident Scenes

Current Computer Forensics Tools

Macintosh and Linux Boot Processes and File Systems

Computer Forensics Analysis and Validation

Recovering Graphics Files

Virtual Machines, Network Forensics, and Live Acquisitions

E-Mail Investigations

Cell Phone and Mobile Device Forensics

Report Writing for High-Tech Investigations

Expert Testimony in High-Tech Investigations

Ethics for the Expert Witness

Filters