University:
Eastern Kentucky University
Course:
CSC 189 | Computing Concepts and Programming
Academic year:

2023
Views:

320

Pages:

2
Author:

grosikesf4

Guide to Computer Forensics and Investigations Ch. 7 Solutions-1 Chapter 7 Solutions Review Questions 1. Explain the differences in resource and data forks used in macOS. Both contain a file’s resource map and header information, window locations, and icons. The data fork stores a file’s actual data, however, and the resource fork contains file metadata and application information. 2. Which of the following is the main challenge in acquiring an image of a system running macOS? (Choose all that apply.) b. Vendor training is needed. d. You need special tools to remove drives from a system running macOS or open its case. 3. To recover a password in macOS, which tool do you use? c. Keychain Access 4. What are the major improvements in the Linux Ext4 file system? It added support for partitions larger than 16 TB, improved management of large files, and offered a more flexible approach to adding file system features. 5. How does macOS reduce file fragmentation? By using clumps, which are groups of contiguous allocation blocks 6. Linux is the only OS that has a kernel. True or False? False 7. Hard links work in only one partition or volume. True or False? True 8. Which of the following Linux system files contains hashed passwords for the local system? d. /etc/shadow 9. Which of the following describes the superblock’s function in the Linux file system? (Choose all that apply.) b. Specifies the disk geometry and available space c. Manages the file system, including configuration information 10. What’s the Disk Arbitration feature used for in macOS? It’s used to disable and enable automatic mounting when a drive is connected via a USB or FireWire device. 11. In Linux, which of the following is the home directory for the superuser? b. root 12. Which of the following certifies when an OS meets UNIX requirements? c. The Open Group 13. On most Linux systems, current user login information is in which of the following locations? Guide to Computer Forensics and Investigations Ch. 7 Solutions-2 d. /var/log/utmp 14. Hard links are associated with which of the following? b. A specific inode 15. Which of the following describes plist files? (Choose all that apply.) a. You must have a special editor to view them. c. They’re preference files for applications. 16. Data blocks contain actual files and directories and are linked directly to inodes. True or False? True 17. Which of the following is a new file added in macOS? (Choose all that apply.) c. /var/db/diagnostics d. /var/db/uuid.text