University:
Eastern Kentucky University
Course:
CSC 189 | Computing Concepts and Programming
Academic year:

2023
Views:

367

Pages:

2
Author:

Kristopher Elliott

Guide to Computer Forensics and Investigations Ch. 5 Solutions-1 Chapter 5 Solutions Review Questions 1. On a Windows system, sectors typically contain how many bytes? b. 512 2. What does CHS stand for? cylinders, heads, sectors 3. Zone bit recording is how manufacturers ensure that the outer tracks store as much data as possible. True or False? False 4. Areal density refers to which of the following? c. Number of bits per square inch of a disk platter 5. Clusters in Windows always begin numbering at what number? 2 6. How many sectors are typically in a cluster on a disk drive? c. 4 or more 7. List three items stored in the FAT database. Answers can include file and directory names, starting cluster numbers, file attributes, and date and time stamps. 8. What does the Ntuser.dat file contain? This user-protected storage area contains the MRU files list and desktop configuration settings. 9. In FAT32, a 123 KB file uses how many sectors? The answer is 246 sectors. 123 x 1024 bytes per KB = 125,952 total bytes in the file. 125,952 bytes / 512 sectors per cluster = 246 sectors 10. What is the space on a drive called when a file is deleted? (Choose all that apply.) b. Unallocated space d. Free space 11. List two features NTFS has that FAT does not. Answers can include Unicode characters, security, and journaling. 12. What does MFT stand for? Master File Table 13. In NTFS, files smaller than 512 bytes are stored in the MFT. True or False? True 14. In Windows 7 and later, how much data from RAM is loaded into RAM slack on a disk drive? No data from RAM is copied to RAM slack on a disk drive. 15. What’s a virtual cluster number? Guide to Computer Forensics and Investigations Ch. 5 Solutions-2 It represents the assigned clusters of files that are nonresident in the MFT. If a file has become fragmented, it can have two or more VCNs. The first VCN for a nonresident file is listed as 0. 16. Why was EFI boot firmware developed? To provide better protection against malware than BIOS does 17. Device drivers contain what kind of information? Instructions for the OS on how to interface with hardware devices 18. Which of the following Windows 8 files contains user-specific information? b. Ntuser.dat 19. Virtual machines have which of the following limitations when running on a host computer? c. Virtual machines are limited to the host computer’s peripheral configurations, such as mouse, keyboard, CD/DVD drives, and other devices. 20. An image of a suspect drive can be loaded on a virtual machine. True or False? True 21. EFS can encrypt which of the following? a. Files, folders, and volumes 22. What happens when you copy an encrypted file from an EFS-enabled NTFS disk to a non-EFS disk or folder? c. The file is unencrypted automatically. 23. What are the functions of a data run’s field components in an MFT record? Data runs have three components; the first declares how many bytes are required in the attribute field to store the number of bytes needed for the second and third components. The second component stores the number of clusters assigned to the data run, and the third component contains the starting cluster address value (the LCN or the VCN).