Title: Final Exam
Course: CAP 2140 Digital Forensics > Section: Macintosh and Linux Boot Processes and File Systems

Q: When Microsoft introduced Windows 2000, it added built-in encryption to NTFS called ____.
- EFS
- VFAT
- LZH
- RAR
A: EFS

Q: The file or folder’s MFT record provides cluster addresses where the file is stored on the drive’s partition. These cluster addresses are referred to as ____.
- virtual runs
- metada
- metaruns
- data runs
A: data runs

Q: In the NTFS MFT, all files and folders are stored in separate records of ____ bytes each.
- 1024
- 1512
- 2048
- 2512
A: 1024

Q: Records in the MFT are referred to as ____.
- hyperdata
- metadata
- inodes
- infodata
A: metadata

Q: ____ is a 16-bit real-mode program that queries the system for device and configuration data, and then passes its findings to NTLDR.
- Hal.dll
- Boot.ini
- NTDetect.com
- BootSect.dos
A: NTDetect.com

Q: ____, located in the root folder of the system partition, specifies the Windows XP path installation and contains options for selecting the Windows version.
- Boot.ini
- BootSec.dos
- NTDetect.com
- NTBootdd.sys
A: Boot.ini

Q: When Microsoft created Windows 95, it consolidated initialization (.ini) files into the ____.
- IniRecord
- Inidata
- Registry
- Metadata
A: Registry

Q: The purpose of the ____ is to provide a mechanism for recovering encrypted files under EFS if there’s a problem with the user’s original private key.
- certificate escrow
- recovery certificate
- administrator certificate
- root certificate
A: recovery certificate

Q: ____ is how most manufacturers deal with a platter’s inner tracks being shorter than its outer tracks.
- Head skew
- Cylinder skew
- ZBR
- Areal density
A: ZBR

Q: A ____ is a column of tracks on two or more disk platters.
- cylinder
- sector
- track
- head
A: cylinder

Q: On an NTFS disk, immediately after the Partition Boot Sector is the ____.
- FAT
- HPFS
- MBR
- MFT
A: MFT

Q: ____ was introduced when Microsoft created Windows NT and is the primary file system for Windows Vista.
- FAT32
- VFAT
- NTFS
- HPFS
A: NTFS

Q: ____ is the file structure database that Microsoft originally designed for floppy disks.
- NTFS
- FAT32
- VFAT
- FAT
A: FAT

Q: ____ refers to the number of bits in one square inch of a disk platter.
- Head skew
- Areal density
- Cylinder skew
- ZBR
A: Areal density

Q: ____ records are data the system maintains, such as system log files and proxy server logs.
- Computer-generated
- Business
- Computer-stored
- Hearsay
A: Computer-generated

Q: The FOIA was originally enacted in the ____.
- 1940s
- 1950s
- 1960s
- 1970s
A: 1960s

Q: Investigating and controlling computer incident scenes in the corporate environment is ____ in the criminal environment.
- much easier than
- as easy as
- as difficult as
- more difficult than
A: much easier than

Q: Every business or organization must have a well defined process that describes when an investigation can be initiated. At a minimum, most corporate policies require that employers have a ____ that a law or policy is being violated.
- confirmed suspicion
- proof
- court order stating
- reasonable suspicion
A: reasonable suspicion

Q: Confidential business data included with the criminal evidence are referred to as ____ data.
- commingled
- exposed
- public
- revealed
A: commingled

Q: ____ is facts or circumstances that would lead a reasonable person to believe a crime has been committed or is about to be committed.
- Reasonable cause
- Probable cause
- A subpoena
- A warrant
A: Probable cause

Q: Law enforcement investigators need a(n) ____ to remove computers from a crime scene and transport them to a lab.
- evidence custody form
- FOIA form
- affidavit
- warrant
A: warrant

Q: Environmental and ____ issues are your primary concerns when you’re working at the scene to gather information about an incident or a crime.
- legal
- safety
- corporate
- physical
A: safety

Q: Most federal courts have interpreted computer records as ____ evidence.
- conclusive
- regular
- hearsay
- direct
A: hearsay

Q: Generally, computer records are considered admissible if they qualify as a ____ record.
- hearsay
- business
- computer-generated
- computer-stored
A: business

Q: Real-time surveillance requires ____ data transmissions between a suspect’s computer and a network server.
- poisoning
- sniffing
- blocking
- preventing
A: sniffing

Q: One technique for extracting evidence from large systems is called ____.
- RAID copy
- RAID imaging
- large evidence file recovery
- sparse acquisition
A: sparse acquisition

Q: The most common computer-related crime is ____.
- homicide
- check fraud
- car stealing
- sniffing
A: check fraud

Q: With a(n) ____ you can arrive at a scene, acquire the data you need, and return to the lab as quickly as possible.
- bit-stream copy utility
- extensive-response field kit
- initial-response field kit
- seizing order
A: initial-response field kit

Q: When recovering evidence from a contaminated crime scene, if the temperature in the contaminated room is higher than ____ degrees, you should take measures to prevent a hard disk from overheating to prevent damage.
- 80
- 90
- 95
- 105
A: 80

Q: Courts consider evidence data in a computer as ____ evidence.
- physical
- invalid
- virtual
- logical
A: physical

Q: A(n) ____ should include all the tools you can afford to take to the field.
- initial-response field kit
- extensive-response field kit
- forensic lab
- forensic workstation
A: extensive-response field kit

Q: When seizing computer evidence in criminal investigations, follow the ____ standards for seizing digital data.
- Homeland Security Department
- Patriot Act
- U.S. DoJ
- U.S. DoD
A: U.S. DoJ

Q: Evidence is commonly lost or corrupted through ____, which involves police officers and other professionals who aren’t part of the crime scene processing team.
- onlookers
- HAZMAT teams
- FOIA laws
- professional curiosity
A: professional curiosity

Q: Certain files, such as the ____ and Security log in Windows XP, might lose essential network activity records if the power is terminated without a proper shutdown.
- Password log
- Word log
- Io.sys
- Event log
A: Event log

Q: During an investigation involving a live computer, do not cut electrical power to the running system unless it’s an older ____ or MS-DOS system.
- Windows XP
- Windows 9x
- Windows NT
- Windows Me
A: Windows 9x

Q: ____ has developed the Rapid Action Imaging Device (RAID) to make forensically sound disk copies.
- DIBS USA
- EnCase
- ProDiscover
- ILook
A: DIBS USA

Q: ____ is the only automated disk-to-disk tool that allows you to copy data to a slightly smaller target drive than the original suspect’s drive.
- SafeBack
- EnCase
- SnapCopy
- SMART
A: SnapCopy

Q: SafeBack performs a(n) ____ calculation for each sector copied to ensure data integrity
- SHA-1
- MC5
- SHA-256
- MC4
A: SHA-256

Q: SnapBack DatArrest runs from a true ____ boot floppy.
- UNIX
- Linux
- Mac OS X
- MS-DOS
A: MS-DOS

Q: SnapBack DatArrest can perform a data copy of an evidence drive in ____ ways.
- two
- three
- four
- five
A: three

Q: The ____ DOS program En.exe requires using a forensic MS-DOS boot floppy or CD and a network crossover cable.
- ProDiscover
- ILook
- DIBS USA
- EnCase
A: EnCase

Q: EnCase Enterprise is set up with an Examiner workstation and a Secure Authentication for EnCase (____) workstation
- ILook
- SAFE
- Incident Response
- Investigator
A: SAFE

Q: The ____ command, works similarly to the dd command but has many features designed for computer forensics acquisitions.
- raw
- bitcopy
- dcfldd
- man
A: dcfldd

Q: Current distributions of Linux include two hashing algorithm utilities: md5sum and ____.
- rcsum
- shasum
- hashsum
- sha1sum
A: sha1sum

Q: The ____ command displays pages from the online help manual for information on Linux commands and their options.
- cmd
- hlp
- inst
- man
A: man

Q: The ____ command creates a raw format file that most computer forensics analysis tools can read, which makes it useful for data acquisitions.
- fdisk
- dd
- man
- raw
A: dd

Q: Microsoft has recently added ____ in its Vista Ultimate and Enterprise editions, which makes performing static acquisitions more difficult.
- whole disk encryption
- backup utilities
- recovery wizards
- NTFS
A: whole disk encryption

Q: Linux ISO images are referred to as ____.
- ISO CDs
- Live CDs
- Forensic Linux
- Linux in a Box
A: Live CDs

Q: If your time is limited, consider using a logical acquisition or ____ acquisition data copy method.
- lossless
- disk-to-disk
- sparse
- disk-to-image
A: sparse

Q: Image files can be reduced by as much as ____% of the original.
- 15
- 25
- 30
- 50
A: 50

Q: One way to examine a partition’s physical level is to use a disk editor, such as Norton DiskEdit, WinHex, or Hex Workshop.
- true
- false
A: true

Q: As data is added, the MFT can expand to take up 75% of the NTFS disk.
- true
- false
A: false

Q: The type of file system an OS uses determines how data is stored on the disk.
- true
- false
A: true

Q: If damage occurs to the floor, walls, ceilings, or furniture on your computer forensics lab, it does not need to be repaired immediately.
- true
- false
A: false

Q: Requirements for taking the EnCE certification exam depend on taking the Guidance Software EnCase training courses.
- true
- false
A: false

Q: Performing a forensic analysis of a disk 200 GB or larger can take several days and often involves running imaging software overnight and on weekends.
- true
- false
A: true

Q: Computing systems in a forensics lab should be able to process typical cases in a timely manner.
- true
- false
A: true

Q: A good working practice is to use less powerful workstations for mundane tasks and multipurpose workstations for the higher-end analysis tasks.
- true
- false
A: true

Q: ____________________ is a journaling version of Ext2fs that reduces file recovery time after a crash.
A: Ext3fs

Q: The Macintosh file system has ____________________ descriptors for the end of file (EOF).
A: two / 2

Q: CD players that are 12X or faster read discs by using a(n) _____________________ system.
A: constant angular velocity (CAV) / constant angular velocity / CAV / CAV (constant angular velocity)

Q: When you turn on the power to a UNIX workstation, instruction code located in firmware on the system’s CPU loads into RAM. This firmware is called ____________________ code because it’s located in ROM.
A: memory-resident

Q: Data streams can obscure valuable evidentiary data, intentionally or by coincidence.
- true
- false
A: true

Q: The first 5 bytes (characters) for all MFT records are MFTR0.
- true
- false
A: false

Q: A bit-stream copy is a bit-by-bit duplicate of the original disk. You should use the original disk whenever possible.
- true
- false
A: false

Q: What additional items are useful when setting up a forensic workstation?

Q: What should you do when working on an Internet investigation and the suspect’s computer is on?

Q: What are the items you need when setting up your workstation for computer forensics?

Q: Describe some of the technologies used with hardware write-blocker devices. Identify some of the more commonly used vendors and their products.

Q: Give some guidelines on how to video record a computer incident or crime scene.