Question 1

Explain the relation between allocation blocks and logical block on a Mac OS file system.

Accepted Answer

Volumes have allocation blocks and logical blocks.A logical block is a collection of data that cannot exceed 512 bytes.When you save a file, File Manager assigns the file to an allocation block, which is a group of consecutive logical blocks.On a floppy disk, an allocation block is usually one logical block.As the volumes increase in size, one allocation block might be composed of three or more logical blocks.

Question 2

Match each item with a statement below:
-older Linux boot manager utility

Accepted Answer

A) File Manager 
B) Inode blocks 
C) ISO 9660 
D) LILO 
E) Clumps
F)Volume
G)ls
H)Catalog
I)Finder 
A) File Manager 
B) Inode blocks 
C) ISO 9660 
D) LILO 
E) Clumps
F)Volume
G)ls
H)Catalog
I)Finder D

Question 3

The Macintosh file system has ____________________ descriptors for the end of file (EOF).

Accepted Answer

two
2

Question 4

What problems can hidden partitions on IDE devices cause to forensic investigators?

Accepted Answer

One trick suspects use to conceal eviden

Question 5

On Mac OSs, File Manager uses the ____ to store any information not in the MDB or Volume Control Block (VCB).

Accepted Answer

A)  volume information block 
B)  extents overflow file 
C)  catalog 
D)  master directory block 
A)  volume information block 
B)  extents overflow file 
C)  catalog 
D)  master directory block

Question 6

Explain the use of forensic tools for Macintosh systems.

Accepted Answer

Recently, several computer forensics sof

Question 7

LILO uses a configuration file named ____ located in the /Etc directory.

Accepted Answer

A)  Lilo.conf 
B)  Boot.conf 
C)  Lilo.config 
D)  Boot.config 
A)  Lilo.conf 
B)  Boot.conf 
C)  Lilo.config 
D)  Boot.config

Question 8

The maximum number of allocation blocks per volume that File Manager can access on a Mac OS system is ____.

Accepted Answer

A)  32,768 
B)  45,353 
C)  58,745 
D)  65,535 
A)  32,768 
B)  45,353 
C)  58,745 
D)  65,535

Question 9

When you turn on the power to a UNIX workstation, instruction code located in firmware on the system's CPU loads into RAM. This firmware is called ____________________ code because it's located in ROM.

Accepted Answer

The answer of When you turn on the power to...

Question 10

Older Macintosh computers use the same type of BIOS firmware commonly found in PC-based systems.

Accepted Answer

A) True 
 B)False

Question 11

Match each item with a statement below:
-groups of contiguous allocation blocks

Accepted Answer

A) File Manager 
B) Inode blocks 
C) ISO 9660 
D) LILO 
E) Clumps
F)Volume
G)ls
H)Catalog
I)Finder 
A) File Manager 
B) Inode blocks 
C) ISO 9660 
D) LILO 
E) Clumps
F)Volume
G)ls
H)Catalog
I)Finder

Question 12

The ____ provides several software drivers that allow communication between the OS and the SCSI component.

Accepted Answer

A)  International Organization of Standardization (ISO) 
B)  Advanced SCSI Programming Interface (ASPI) 
C)  CLV 
D)  EIDE 
A)  International Organization of Standardization (ISO) 
B)  Advanced SCSI Programming Interface (ASPI) 
C)  CLV 
D)  EIDE

Question 13

Write a brief history of SCSI.

Accepted Answer

Small computer system interface (SCSI) i

Question 14

Explain the use of B*-trees on Mac OS 9 file system.

Accepted Answer

Mac OS 9 uses the B*-tree file system to

Question 15

Match each item with a statement below:
-maintains relationships between files and directories on a volume on a Mac OS

Accepted Answer

A) File Manager 
B) Inode blocks 
C) ISO 9660 
D) LILO 
E) Clumps
F)Volume
G)ls
H)Catalog
I)Finder 
A) File Manager 
B) Inode blocks 
C) ISO 9660 
D) LILO 
E) Clumps
F)Volume
G)ls
H)Catalog
I)Finder

Question 16

Match each item with a statement below:
-Macintosh tool that works with the OS to keep track of files and maintain users' desktops

Accepted Answer

A) File Manager 
B) Inode blocks 
C) ISO 9660 
D) LILO 
E) Clumps
F)Volume
G)ls
H)Catalog
I)Finder 
A) File Manager 
B) Inode blocks 
C) ISO 9660 
D) LILO 
E) Clumps
F)Volume
G)ls
H)Catalog
I)Finder

Question 17

If a file contains information, it always occupies at least one allocation block.

Accepted Answer

A) True 
 B)False

Question 18

Match each item with a statement below:
-the first data after the superblock on a UNIX or Linux file system

Accepted Answer

A) File Manager 
B) Inode blocks 
C) ISO 9660 
D) LILO 
E) Clumps
F)Volume
G)ls
H)Catalog
I)Finder 
A) File Manager 
B) Inode blocks 
C) ISO 9660 
D) LILO 
E) Clumps
F)Volume
G)ls
H)Catalog
I)Finder

Question 19

Before OS X, Macintosh uses the ____________________, in which files are stored in directories, or folders, that can be nested in other folders.

Accepted Answer

Hierarchical File Sy

Question 20

ATA-66,ATA-____, and ATA-133 can use the newer 40-pin/80-wire cable.

Accepted Answer

A)  70 
B)  83 
C)  96 
D)  100 
A)  70 
B)  83 
C)  96 
D)  100

Explain the relation between allocation blocks and logical block on a Mac OS file system.

Match each item with a statement below: -older Linux boot manager utility

The Macintosh file system has ____________________ descriptors for the end of file (EOF).

What problems can hidden partitions on IDE devices cause to forensic investigators?

On Mac OSs, File Manager uses the ____ to store any information not in the MDB or Volume Control Block (VCB).

Explain the use of forensic tools for Macintosh systems.

LILO uses a configuration file named ____ located in the /Etc directory.

The maximum number of allocation blocks per volume that File Manager can access on a Mac OS system is ____.

When you turn on the power to a UNIX workstation, instruction code located in firmware on the system's CPU loads into RAM. This firmware is called ____________________ code because it's located in ROM.

Older Macintosh computers use the same type of BIOS firmware commonly found in PC-based systems.

Match each item with a statement below: -groups of contiguous allocation blocks

The ____ provides several software drivers that allow communication between the OS and the SCSI component.

Write a brief history of SCSI.

Explain the use of B*-trees on Mac OS 9 file system.

Match each item with a statement below: -maintains relationships between files and directories on a volume on a Mac OS

Match each item with a statement below: -Macintosh tool that works with the OS to keep track of files and maintain users' desktops

If a file contains information, it always occupies at least one allocation block.

Match each item with a statement below: -the first data after the superblock on a UNIX or Linux file system

Before OS X, Macintosh uses the ____________________, in which files are stored in directories, or folders, that can be nested in other folders.

ATA-66,ATA-____, and ATA-133 can use the newer 40-pin/80-wire cable.

Computer Forensics and Investigations As a Profession

Understanding Computer Investigations

The Investigators Office and Laboratory

Data Acquisition

Processing Crime and Incident Scenes

Working With Windows and Dos Systems

Current Computer Forensics Tools

Computer Forensics Analysis and Validation

Recovering Graphics Files

Virtual Machines, Network Forensics, and Live Acquisitions

E-Mail Investigations

Cell Phone and Mobile Device Forensics

Report Writing for High-Tech Investigations

Expert Testimony in High-Tech Investigations

Ethics for the Expert Witness

Filters

Exam 8: Macintosh and Linux Boot Processes and File Systems

Explain the relation between allocation blocks and logical block on a Mac OS file system.

Match each item with a statement below: -older Linux boot manager utility

The Macintosh file system has ____________________ descriptors for the end of file (EOF).

What problems can hidden partitions on IDE devices cause to forensic investigators?

On Mac OSs, File Manager uses the ____ to store any information not in the MDB or Volume Control Block (VCB).

Explain the use of forensic tools for Macintosh systems.

LILO uses a configuration file named ____ located in the /Etc directory.

The maximum number of allocation blocks per volume that File Manager can access on a Mac OS system is ____.

When you turn on the power to a UNIX workstation, instruction code located in firmware on the system's CPU loads into RAM. This firmware is called ____________________ code because it's located in ROM.

Older Macintosh computers use the same type of BIOS firmware commonly found in PC-based systems.

Match each item with a statement below: -groups of contiguous allocation blocks

The ____ provides several software drivers that allow communication between the OS and the SCSI component.

Write a brief history of SCSI.

Explain the use of B*-trees on Mac OS 9 file system.

Match each item with a statement below: -maintains relationships between files and directories on a volume on a Mac OS

Match each item with a statement below: -Macintosh tool that works with the OS to keep track of files and maintain users' desktops

If a file contains information, it always occupies at least one allocation block.

Match each item with a statement below: -the first data after the superblock on a UNIX or Linux file system

Before OS X, Macintosh uses the ____________________, in which files are stored in directories, or folders, that can be nested in other folders.

ATA-66,ATA-____, and ATA-133 can use the newer 40-pin/80-wire cable.

Computer Forensics and Investigations As a Profession

Understanding Computer Investigations

The Investigators Office and Laboratory

Data Acquisition

Processing Crime and Incident Scenes

Working With Windows and Dos Systems

Current Computer Forensics Tools

Computer Forensics Analysis and Validation

Recovering Graphics Files

Virtual Machines, Network Forensics, and Live Acquisitions

E-Mail Investigations

Cell Phone and Mobile Device Forensics

Report Writing for High-Tech Investigations

Expert Testimony in High-Tech Investigations

Ethics for the Expert Witness

Filters