Title: Module 6 Quiz
Course: CAP 2140 Digital Forensics > Section: Working with Windows and DOS Systems

Q: Have you read the syllabus completely and thoroughly?
- Yes
- No
A: Yes

Q: Do you accept all the items in the syllabus?
- Yes
- No
A: Yes

Q: When Microsoft introduced Windows 2000, it added built-in encryption to NTFS called ____.
- EFS
- VFAT
- LZH
- RAR
A: EFS

Q: The file or folder’s MFT record provides cluster addresses where the file is stored on the drive’s partition. These cluster addresses are referred to as ____.
- virtual runs
- metada
- metaruns
- data runs
A: data runs

Q: A ____ allows you to create a representation of another computer on an existing physical computer.
- virtual file
- logic drive
- logic machine
- virtual machine
A: virtual machine

Q: ____ is a batch file containing customized settings for MS-DOS that runs automatically.
- Autoexec.bat
- Config.sys
- Io.sys
- Command.com
A: Autoexec.bat

Q: In the NTFS MFT, all files and folders are stored in separate records of ____ bytes each.
- 1024
- 1512
- 2048
- 2512
A: 1024

Q: ____ is a text file containing commands that typically run only at system startup to enhance the computer’s DOS configuration.
- Autoexec.bat
- Config.sys
- BootSect.dos
- Io.sys
A: Config.sys

Q: Records in the MFT are referred to as ____.
- hyperdata
- metadata
- inodes
- infodata
A: metadata

Q: The ____ file provides a command prompt when booting to MS-DOS mode (DPMI).
- Io.sys
- Autoexec.bat
- Config.sys
- Command.com
A: Command.com

Q: ____ is a 16-bit real-mode program that queries the system for device and configuration data, and then passes its findings to NTLDR.
- Hal.dll
- Boot.ini
- NTDetect.com
- BootSect.dos
A: NTDetect.com

Q: ____ is a hidden text file containing startup options for Windows 9x.
- Pagefile.sys
- Hal.dll
- Msdos.sys
- Ntoskrnl.exe
A: Msdos.sys

Q: ____, located in the root folder of the system partition, specifies the Windows XP path installation and contains options for selecting the Windows version.
- Boot.ini
- BootSec.dos
- NTDetect.com
- NTBootdd.sys
A: Boot.ini

Q: ____ contain instructions for the OS for hardware devices, such as the keyboard, mouse, and video card, and are stored in the %system-root%\Windows\System32\Drivers folder.
- Hal.dll
- Pagefile.sys
- Ntoskrnl.exe
- Device drivers
A: Device drivers

Q: ____________________ refers to a disk’s structure of platters, tracks, and sectors.
A: Geometry

Q: One way to examine a partition’s physical level is to use a disk editor, such as Norton DiskEdit, WinHex, or Hex Workshop.
- true
- false
A: true

Q: As data is added, the MFT can expand to take up 75% of the NTFS disk.
- true
- false
A: false

Q: The type of file system an OS uses determines how data is stored on the disk.
- true
- false
A: true

Q: Describe some of the open source whole disk encryption tools.

Q: What are some of the features offered by current whole disk encryption tools?