Question 1

Match each term with the correct definition below:
-?Concentric circles on a disk platter where data is stored.

Accepted Answer

A) Boot.ini 
B) bootstrap process 
C) Encryption File System 
D) File Allocation Table (FAT) 
E) tracks
F)head
G)NTBootdd.sys
H)NTDetect.com
I)NT File System
J)Resilient File System 
A) Boot.ini 
B) bootstrap process 
C) Encryption File System 
D) File Allocation Table (FAT) 
E) tracks
F)head
G)NTBootdd.sys
H)NTDetect.com
I)NT File System
J)Resilient File System E

Question 2

​What does the $Secure metadata file contain?

Accepted Answer

It contains unique security descriptors for the volume. Access Control List (ACL) information for all files and folders on the NTFS volume is stored here.​

Question 3

When Microsoft introduced Windows 2000, it added optional built-in encryption to NTFS called ​Encrypting File System (EFS)​. Explain how EFS works.​

Accepted Answer

Encrypting File System (EFS) uses public key and private key methods of encrypting filed, folders, or disk volumes (partitions). Only the owner or user who encrypted the data can access encrypted files. The owner holds the private key, and the public key is held by a certification authority, such as global registry, network server, or company such as VeriSign.​

Question 4

Describe the three current versions of FAT.

Accepted Answer

There are three current versions of FAT-

Question 5

Match each term with the correct definition below:
-?The device that reads and writes data to a disk drive.

Accepted Answer

A) Boot.ini 
B) bootstrap process 
C) Encryption File System 
D) File Allocation Table (FAT) 
E) tracks
F)head
G)NTBootdd.sys
H)NTDetect.com
I)NT File System
J)Resilient File System 
A) Boot.ini 
B) bootstrap process 
C) Encryption File System 
D) File Allocation Table (FAT) 
E) tracks
F)head
G)NTBootdd.sys
H)NTDetect.com
I)NT File System
J)Resilient File System

Question 6

What does the MFT header field at offset 0x00 contain?

Accepted Answer

A) ​The MFT record identifier FILE 
B) ​The size of the MFT record 
C) The length of the header 
D) The update sequence array 
A) ​The MFT record identifier FILE 
B) ​The size of the MFT record 
C) The length of the header 
D) The update sequence array

Question 7

With the release of Windows Server 2012, Microsoft created a new file system: ​Resilient File System (ReFS)​. State the features that are incorporated into ReFS's design.​

Accepted Answer

The following features are inc

Question 8

Which of the following commands ​creates an alternate data stream?

Accepted Answer

A) echo text > myfile.txt:stream_name B) ads create myfile.txt{stream_name} "text" C) cat text myfile.txt=stream_name D) echo text < myfile.txt?stream_name A) echo text > myfile.txt:stream_name B) ads create myfile.txt{stream_name} "text" C) cat text myfile.txt=stream_name D) echo text < myfile.txt?stream_name

Question 9

Describe both ways in which file or folder information is typically stored in an MFT record.​

Accepted Answer

File or folder information is typically

Question 10

What hexadecimal code below identifies an NTFS file system in the partition table??

Accepted Answer

A) ?05 
B) ?07 
C) 1B 
D) A5 
A) ?05 
B) ?07 
C) 1B 
D) A5

Question 11

Someone who wants to hide data can create hidden partitions or voids- large unused gaps between partitions on a disk drive. Data that is hidden in partition gaps cannot be retrieved by forensics utilities.

Accepted Answer

A) True 
 B)False

Question 12

​What registry file contains user account management and security settings?

Accepted Answer

A) ​Default.dat 
B) ​Software.dat 
C) SAM.dat 
D) Ntuser.dat 
A) ​Default.dat 
B) ​Software.dat 
C) SAM.dat 
D) Ntuser.dat

Question 13

The purpose of a ______________ is to provide a mechanism for recovering files encrypted with EFS if there's a problem with the user's original private key.​

Accepted Answer

recovery c

Question 14

A computer stores system configuration and date and time information in the BIOS when power to the system is off.​

Accepted Answer

A) True 
 B)False

Question 15

Each MFT record starts with a header identifying it as a resident or nonresident attribute.​

Accepted Answer

A) True 
 B)False

Question 16

FAT32 is used on older Microsoft OSs, such as MS-DOS 3.0 through 6.22, Windows 95 (first release), and Windows NT 3.3 and 4.0.​

Accepted Answer

A) True 
 B)False

Question 17

​The ReFS storage engine uses a __________ sort method for fast access to large data sets.

Accepted Answer

A) ​A+-tree 
B) ​B+-tree 
C) reverse 
D) numerical 
A) ​A+-tree 
B) ​B+-tree 
C) reverse 
D) numerical

Question 18

What is a partition gap, and how might it be used to hide data?​

Accepted Answer

A partition gap is the unused space betw

Question 19

When data is deleted on a hard drive, only references to it are removed, which leaves the original data on unallocated disk space.​

Accepted Answer

A) True 
 B)False

Question 20

The ___________ command inserts a HEX E5 (0xE5) in a filename's first letter position in the associated directory entry.​

Accepted Answer

A) ​delete 
B) ​edit 
C) update 
D) clear 
A) ​delete 
B) ​edit 
C) update 
D) clear

Match each term with the correct definition below: -?Concentric circles on a disk platter where data is stored.

What does the $Secure metadata file contain?

When Microsoft introduced Windows 2000, it added optional built-in encryption to NTFS called Encrypting File System (EFS). Explain how EFS works.

Describe the three current versions of FAT.

Match each term with the correct definition below: -?The device that reads and writes data to a disk drive.

What does the MFT header field at offset 0x00 contain?

With the release of Windows Server 2012, Microsoft created a new file system: Resilient File System (ReFS). State the features that are incorporated into ReFS's design.

Which of the following commands creates an alternate data stream?

Describe both ways in which file or folder information is typically stored in an MFT record.

What hexadecimal code below identifies an NTFS file system in the partition table??

Someone who wants to hide data can create hidden partitions or voids- large unused gaps between partitions on a disk drive. Data that is hidden in partition gaps cannot be retrieved by forensics utilities.

What registry file contains user account management and security settings?

The purpose of a ______________ is to provide a mechanism for recovering files encrypted with EFS if there's a problem with the user's original private key.

A computer stores system configuration and date and time information in the BIOS when power to the system is off.

Each MFT record starts with a header identifying it as a resident or nonresident attribute.

FAT32 is used on older Microsoft OSs, such as MS-DOS 3.0 through 6.22, Windows 95 (first release), and Windows NT 3.3 and 4.0.

The ReFS storage engine uses a __________ sort method for fast access to large data sets.

What is a partition gap, and how might it be used to hide data?

When data is deleted on a hard drive, only references to it are removed, which leaves the original data on unallocated disk space.

The ___________ command inserts a HEX E5 (0xE5) in a filename's first letter position in the associated directory entry.

Understanding the Digital Forensics Profession and Investigations

The Investigators Office and Laboratory

Data Acquisition

Processing Crime and Incident Scenes

Current Computer Forensics Tools

Macintosh and Linux Boot Processes and File Systems

Recovering Graphics Files

Computer Forensics Analysis and Validation

Virtual Machine and Cloud Forensics

Live Acquisitions and Network Forensics

Email Investigations

Cell Phone and Mobile Device Forensics

Report Writing for High Tech Investigations

Expert Testimony in High Tech Investigations

Ethics for the Investigator and Expert Witness

Filters

Exam 5: Working With Windows and Cli Systems

Match each term with the correct definition below: -?Concentric circles on a disk platter where data is stored.

​What does the $Secure metadata file contain?

When Microsoft introduced Windows 2000, it added optional built-in encryption to NTFS called ​Encrypting File System (EFS)​. Explain how EFS works.​

Describe the three current versions of FAT.

Match each term with the correct definition below: -?The device that reads and writes data to a disk drive.

What does the MFT header field at offset 0x00 contain?

With the release of Windows Server 2012, Microsoft created a new file system: ​Resilient File System (ReFS)​. State the features that are incorporated into ReFS's design.​

Which of the following commands ​creates an alternate data stream?

Describe both ways in which file or folder information is typically stored in an MFT record.​

What hexadecimal code below identifies an NTFS file system in the partition table??

Someone who wants to hide data can create hidden partitions or voids- large unused gaps between partitions on a disk drive. Data that is hidden in partition gaps cannot be retrieved by forensics utilities.

​What registry file contains user account management and security settings?

The purpose of a ______________ is to provide a mechanism for recovering files encrypted with EFS if there's a problem with the user's original private key.​

A computer stores system configuration and date and time information in the BIOS when power to the system is off.​

Each MFT record starts with a header identifying it as a resident or nonresident attribute.​

FAT32 is used on older Microsoft OSs, such as MS-DOS 3.0 through 6.22, Windows 95 (first release), and Windows NT 3.3 and 4.0.​

​The ReFS storage engine uses a __________ sort method for fast access to large data sets.

What is a partition gap, and how might it be used to hide data?​

When data is deleted on a hard drive, only references to it are removed, which leaves the original data on unallocated disk space.​

The ___________ command inserts a HEX E5 (0xE5) in a filename's first letter position in the associated directory entry.​

Understanding the Digital Forensics Profession and Investigations

The Investigators Office and Laboratory

Data Acquisition

Processing Crime and Incident Scenes

Current Computer Forensics Tools

Macintosh and Linux Boot Processes and File Systems

Recovering Graphics Files

Computer Forensics Analysis and Validation

Virtual Machine and Cloud Forensics

Live Acquisitions and Network Forensics

Email Investigations

Cell Phone and Mobile Device Forensics

Report Writing for High Tech Investigations

Expert Testimony in High Tech Investigations

Ethics for the Investigator and Expert Witness

Filters

What does the $Secure metadata file contain?

When Microsoft introduced Windows 2000, it added optional built-in encryption to NTFS called Encrypting File System (EFS). Explain how EFS works.

With the release of Windows Server 2012, Microsoft created a new file system: Resilient File System (ReFS). State the features that are incorporated into ReFS's design.

Which of the following commands creates an alternate data stream?

Describe both ways in which file or folder information is typically stored in an MFT record.

What registry file contains user account management and security settings?

The purpose of a ______________ is to provide a mechanism for recovering files encrypted with EFS if there's a problem with the user's original private key.

A computer stores system configuration and date and time information in the BIOS when power to the system is off.

Each MFT record starts with a header identifying it as a resident or nonresident attribute.

FAT32 is used on older Microsoft OSs, such as MS-DOS 3.0 through 6.22, Windows 95 (first release), and Windows NT 3.3 and 4.0.

The ReFS storage engine uses a __________ sort method for fast access to large data sets.

What is a partition gap, and how might it be used to hide data?

When data is deleted on a hard drive, only references to it are removed, which leaves the original data on unallocated disk space.

The ___________ command inserts a HEX E5 (0xE5) in a filename's first letter position in the associated directory entry.