Question 1

Match the following to their definitions.
-Application-level files

Accepted Answer

A) Internet history files 
B) Installed applications 
C) Though used only briefly, they are not deleted 
D) Data created by a user 
A) Internet history files 
B) Installed applications 
C) Though used only briefly, they are not deleted 
D) Data created by a user

Question 2

Match the following to their definitions.
-Program files

Accepted Answer

A) Internet history files 
B) Installed applications 
C) Though used only briefly, they are not deleted 
D) Data created by a user 
A) Internet history files 
B) Installed applications 
C) Though used only briefly, they are not deleted 
D) Data created by a user

Question 3

Match the type of directory to its definition.
-/tmp

Accepted Answer

A) Where files with no names are placed 
B) Contains information on printers, log files, and transient data 
C) Could be a rich source of evidence if not recently cleaned 
D) Library files 
E) Contains shadow password files 
A) Where files with no names are placed 
B) Contains information on printers, log files, and transient data 
C) Could be a rich source of evidence if not recently cleaned 
D) Library files 
E) Contains shadow password files

Question 4

When you send a job to the printer,Windows creates a(n)

Accepted Answer

A) Enhanced metafile (EMF) 
B) Enhanced image file (IMF) 
C) Temporary print file (TPF) 
D) Tagged image format file (TIFF) 
A) Enhanced metafile (EMF) 
B) Enhanced image file (IMF) 
C) Temporary print file (TPF) 
D) Tagged image format file (TIFF)

Question 5

Windows NT and higher changed the registry to a mixture of several files referred to as ________.

Accepted Answer

The answer of Windows NT and higher changed the registry...

Question 6

Match the following GREP tokens with their related functions.
-\xHH

Accepted Answer

A) Used to match the ASCII hexadecimal representation of a single character 
B) Implements an OR situation 
C) When placed after a character, matches any number of occurrences of that character 
D) Matches a single character 
A) Used to match the ASCII hexadecimal representation of a single character 
B) Implements an OR situation 
C) When placed after a character, matches any number of occurrences of that character 
D) Matches a single character

Question 7

Match the following to their data structures.
-Inodes

Accepted Answer

A) Contain metadata for each file 
B) Unit of allocation for storage 
C) Created for every file system mounted 
D) Contains information about the directory structure 
A) Contain metadata for each file 
B) Unit of allocation for storage 
C) Created for every file system mounted 
D) Contains information about the directory structure

Question 8

A(n)________ is created by the computer for each user.

Accepted Answer

The answer of A(n)________ is created by the computer for...

Question 9

Match the type of directory to its definition.
-/lib

Accepted Answer

A) Where files with no names are placed 
B) Contains information on printers, log files, and transient data 
C) Could be a rich source of evidence if not recently cleaned 
D) Library files 
E) Contains shadow password files 
A) Where files with no names are placed 
B) Contains information on printers, log files, and transient data 
C) Could be a rich source of evidence if not recently cleaned 
D) Library files 
E) Contains shadow password files

Question 10

Match the following GREP tokens with their related functions.
-.

Accepted Answer

A) Used to match the ASCII hexadecimal representation of a single character 
B) Implements an OR situation 
C) When placed after a character, matches any number of occurrences of that character 
D) Matches a single character 
A) Used to match the ASCII hexadecimal representation of a single character 
B) Implements an OR situation 
C) When placed after a character, matches any number of occurrences of that character 
D) Matches a single character

Question 11

Match the type of directory to its definition.
-/etc

Accepted Answer

A) Where files with no names are placed 
B) Contains information on printers, log files, and transient data 
C) Could be a rich source of evidence if not recently cleaned 
D) Library files 
E) Contains shadow password files 
A) Where files with no names are placed 
B) Contains information on printers, log files, and transient data 
C) Could be a rich source of evidence if not recently cleaned 
D) Library files 
E) Contains shadow password files

Question 12

The user root folder may contain all of the following EXCEPT

Accepted Answer

A) Internet data 
B) Application parameters 
C) Wallpaper 
D) Registry settings 
A) Internet data 
B) Application parameters 
C) Wallpaper 
D) Registry settings

Question 13

Match the following keys to their hive file.
-HKEY_LOCAL_MACHINEISAM

Accepted Answer

A) Default 
B) System 
C) SAM 
D) Software 
A) Default 
B) System 
C) SAM 
D) Software

Question 14

Match the following file types to their description.
-Named pipes

Accepted Answer

A) Unbuffered files used to exchange data 
B) Virtual connections between two processes 
C) Provide a FIFO mechanism 
D) Buffered files used to exchange data 
A) Unbuffered files used to exchange data 
B) Virtual connections between two processes 
C) Provide a FIFO mechanism 
D) Buffered files used to exchange data

Question 15

Match the following file types to their description.
-Character devices

Accepted Answer

A) Unbuffered files used to exchange data 
B) Virtual connections between two processes 
C) Provide a FIFO mechanism 
D) Buffered files used to exchange data 
A) Unbuffered files used to exchange data 
B) Virtual connections between two processes 
C) Provide a FIFO mechanism 
D) Buffered files used to exchange data

Question 16

Files are first loaded into a(n)________ before being printed.

Accepted Answer

The answer of Files are first loaded into a(n)________ before...

Question 17

All configuration information needed by the operating may be located in which of the following?

Accepted Answer

A) System folder 
B) Configuration file 
C) AutoexeC.bat file 
D) Registry hives 
A) System folder 
B) Configuration file 
C) AutoexeC.bat file 
D) Registry hives

Question 18

A(n)________ is designed as a hierarchical listing of folders and files.

Accepted Answer

Match the following to their definitions. -Application-level files

Match the following to their definitions. -Program files

Match the type of directory to its definition. -/tmp

When you send a job to the printer,Windows creates a(n)

Windows NT and higher changed the registry to a mixture of several files referred to as ________.

Match the following GREP tokens with their related functions. -\xHH

Match the following to their data structures. -Inodes

A(n)________ is created by the computer for each user.

Match the type of directory to its definition. -/lib

Match the following GREP tokens with their related functions. -.

Match the type of directory to its definition. -/etc

The user root folder may contain all of the following EXCEPT

Match the following keys to their hive file. -HKEY_LOCAL_MACHINEISAM

Match the following file types to their description. -Named pipes

Match the following file types to their description. -Character devices

Files are first loaded into a(n)________ before being printed.

All configuration information needed by the operating may be located in which of the following?

A(n)________ is designed as a hierarchical listing of folders and files.

Which of the following is the primary default folder in Windows 2000 and XP?

Match the following keys to their hive file. -HKEY_CURRENT_CONFIG

Forensic Evidence and Crime Investigation

Computer Forensics Anddigital Detective Work

Tools, Environments, Equipment, and Certifications

Policies and Procedures

Data, PDA, and Cell Phone Forensics

Operating Systems and Data Transmission Basics for Digital Investigations

E-Mail and Webmail Forensics

Internet and Network Forensics and Intrusion Detection

Tracking Down Those Who Intend to Do Harm on a Large Scale

Fraud and Forensic Accounting Investigation

Federal Rules and Criminal Codes

Ethical and Professional Responsibility in Testimony

Filters

Exam 7: Investigating Windows, linux, and Graphic Files

Match the following to their definitions. -Application-level files

Match the following to their definitions. -Program files

Match the type of directory to its definition. -/tmp

When you send a job to the printer,Windows creates a(n)

Windows NT and higher changed the registry to a mixture of several files referred to as ________.

Match the following GREP tokens with their related functions. -\xHH

Match the following to their data structures. -Inodes

A(n)________ is created by the computer for each user.

Match the type of directory to its definition. -/lib

Match the following GREP tokens with their related functions. -.

Match the type of directory to its definition. -/etc

The user root folder may contain all of the following EXCEPT

Match the following keys to their hive file. -HKEY_LOCAL_MACHINEISAM

Match the following file types to their description. -Named pipes

Match the following file types to their description. -Character devices

Files are first loaded into a(n)________ before being printed.

All configuration information needed by the operating may be located in which of the following?

A(n)________ is designed as a hierarchical listing of folders and files.

Which of the following is the primary default folder in Windows 2000 and XP?

Match the following keys to their hive file. -HKEY_CURRENT_CONFIG

Forensic Evidence and Crime Investigation

Computer Forensics Anddigital Detective Work

Tools, Environments, Equipment, and Certifications

Policies and Procedures

Data, PDA, and Cell Phone Forensics

Operating Systems and Data Transmission Basics for Digital Investigations

E-Mail and Webmail Forensics

Internet and Network Forensics and Intrusion Detection

Tracking Down Those Who Intend to Do Harm on a Large Scale

Fraud and Forensic Accounting Investigation

Federal Rules and Criminal Codes

Ethical and Professional Responsibility in Testimony

Filters