Multiple Choice
The most common approach to salvaging deleted data on Macintosh systems is to:
A) Use EnCase to recover the files.
B) Use the Catalog utility.
C) Use file carving techniques.
D) There is currently no solution to recovering deleted files from a Macintosh.
Correct Answer:
Verified
Correct Answer:
Verified
Q19: Macintosh stores its partition table in:<br>A) The
Q20: On Mac OS X, when a file
Q21: The boot sector and additional details about
Q22: HFS supports a maximum of_ clusters.<br>A) 2<sup>8</sup><br>B)
Q23: Due to the design of the Macintosh
Q24: All ".plist" files are in plaintext.
Q25: There is a wide selection of forensic
Q26: Digital evidence examiners can use The Sleuth
Q27: Mac OS X has logging capabilities, but
Q28: The folder ~/Library/Mail Downloads contains:<br>A) Internet downloads<br>B)