Chapters 6-13 Windows File Systems and Disk Management

Chapter 6-13 multiple choice Question Data streams can obscure valuable evidentiary data, intentionally or by coincidence A ____ is a column of tracks on two or more disk platters. ____ is how most manufacturers deal with a platter’s inner tracks being shorter than its outer tracks. ____ is the file structure database that Microsoft originally designed for floppy disks. ____ was introduced when Microsoft created Windows NT and is the primary file system for Windows Vista On an NTFS disk, immediately after the Partition Boot Sector is the ____. Records in the MFT are referred to as ____. In the NTFS MFT, all files and folders are stored in separate records of ____ bytes each The file or folder’s MFT record provides cluster addresses where the file is stored on the drive’s partition. These cluster addresses are referred to as ____. When Microsoft introduced Windows 2000, it added built-in encryption to NTFS called ____. The purpose of the ____ is to provide a mechanism for recovering encrypted files under EFS if there’s a problem with the user’s original private key. When Microsoft created Windows 95, it consolidated initialization (.ini) files into the ____. ____ is a 16-bit real-mode program that queries the system for device and configuration data, and then passes its findings to NTLDR. ____, located in the root folder of the system partition, is the device driver that allows the OS to communicate with SCSI or ATA drives that aren’t related to the BIOS. ____ contain instructions for the OS for hardware devices, such as the keyboard, mouse, and video card, and are stored in the %systemroot%\Windows\System32\Drivers folder. ____ is a hidden text file containing startup options for Windows 9x. The ____ file provides a command prompt when booting to MS-DOS mode (DPMI). ____ is a text file containing commands that typically run only at system startup to enhance the computer’s DOS configuration. ____ is a batch file containing customized settings for MS-DOS that runs automatically. A ____ allows you to create a representation of another computer on an existing physical computer. In software acquisition, there are three types of data-copying methods. To help determine what computer forensics tool to purchase, a comparison table of functions, subfunctions, and vendor products is useful. The Windows platforms have long been the primary command-line interface OSs. After retrieving and examining evidence data with one tool, you should verify your results by performing the same tasks with other similar forensics tools. Computer forensics tools are divided into ____ major categories. Software forensics tools are commonly used to copy data from a suspect’s disk drive to a(n) ____. To make a disk acquisition with En.exe requires only a PC running ____ with a 12-volt power connector and an IDE, a SATA, or a SCSI connector cable. Raw data is a direct copy of a disk drive. An example of a Raw image is output from the UNIX/Linux ____ command. ____ of data involves sorting and searching through all investigation data. Many password recovery tools have a feature that allows generating potential lists for a ____ attack. The simplest method of duplicating a disk drive is using a tool that does a direct ____ copy from the original disk to the target disk. To complete a forensic disk analysis and examination, you need to create a ____. Answer true cylinder ZBR FAT NTFS MFT metadata 1024 data runs EFS recovery certificate Registry NTDetect.com NTBootdd.sys Device drivers Msdos.sys Command.com Config.sys Autoexec.bat virtual machine false true false true 2 image file ms-dos dd Discrimination password dictionary disk-to-disk report The first tools that analyzed and extracted data from floppy disks and hard disks were MS-DOS tools for ____ PC file systems. In Windows 2000 and XP, the ____ command shows you the owner of a file if you have multiple users on the system or network. In general, forensics workstations can be divided into ____ categories. A forensics workstation consisting of a laptop computer with a built-in LCD monitor and almost as many bays and peripherals as a stationary workstation is also known as a ____. ____ is a simple drive-imaging station. ____ can be software or hardware and are used to protect evidence disks by preventing you from writing any data to the evidence disk. Many vendors have developed write-blocking devices that connect to a computer through FireWire,____ 2.0,and SCSI controllers. The ____ publishes articles, provides tools, and creates procedures for testing and validating computer forensics software. The standards document, ____, demands accuracy for all aspects of the testing process, meaning that the results must be repeatable and reproducible. The NIST project that has as a goal to collect all known hash values for commercial software applications and OS files is ____. The primary hash algorithm used by the NSRL project is ____. One way to compare your results and verify your new forensic tool is by using a ____, such as HexWorkshop, or WinHex. Although a disk editor gives you the most flexibility in ____, it might not be capable of examining a ____ file’s contents Macintosh OS X is built on a core called ____. In older Mac OSs, a file consists of two parts: a data fork, where data is stored, and a ____ fork, where file metadata and application information are stored. The maximum number of allocation blocks per volume that File Manager can access on a Mac OS system is ____. IBM Dir 3 portable workstation FIRE IDE Write-blockers USB NIST ISO 5725 NSRL SHA-1 disk editor testing, compressed Darwin resource 65,535 On older Macintosh OSs all information about the volume is stored in the ____. Master Directory Block (MDB) With Mac OSs, a system application called ____ tracks each block on a volume to determine which blocks are in use and which ones are available to receive data. On Mac OSs, File Manager uses the ____ to store any information not in the MDB or Volume Control Block (VCB). Linux is probably the most consistent UNIX-like OS because the Linux kernel is regulated under the ____ agreement. The standard Linux file system is ____. Ext2fs can support disks as large as ____ TB and files as large as 2 GB. Linux is unique in that it uses ____, or information nodes, that contain descriptive information about each file or directory. To find deleted files during a forensic investigation on a Linux computer, you search for inodes that contain some data and have a link count of ____. ____ components define the file system on UNIX. The final component in the UNIX and Linux file system is a(n) ____, which is where directories and files are stored on a disk drive. LILO uses a configuration file named ____ located in the /Etc directory. Erich Boleyn created GRUB in ____ to deal with multiboot processes and a variety of OSs. On a Linux computer, ____ is the path for the first partition on the primary master IDE disk drive. There are ____ tracks available for the program area on a CD. Volume Bitmap extents overflow file GPL Ext2fs 4 inodes 0 4 data block Lilo.conf 1995 /dev/hda1 99 SCSI The ____ provides several software drivers that allow communication between the OS Advanced Programming Interface and the SCSI component. (ASPI) All Advanced Technology Attachment (ATA) drives from ATA-33 through ATA-133 IDE 40-pin and EIDE disk drives use the standard ____ ribbon or shielded cable. ATA-66,ATA-____, and ATA-133 can use the newer 40-pin/80-wire cable. 100 IDE ATA controller on an old 486 PC doesn’t recognize disk drives larger than 8.4 ____. GB FTK cannot analyze data from image files from other vendors. A nonsteganographic graphics file has a different size than an identical steganographic graphics file. ____ increases the time and resources needed to extract,analyze,and present evidence. You begin any computer forensics case by creating a(n) ____. In civil and criminal cases, the scope is often defined by search warrants or ____, which specify what data you can recover. There are ____ searching options for keywords which FTK offers. ____ search can locate items such as text hidden in unallocated space that might not turn up in an indexed search. The ____ search feature allows you to look for words with extensions such as “ing,”“ed,” and so forth. In FTK ____ search mode, you can also look for files that were accessed or changed during a certain time period. FTK and other computer forensics programs use ____ to tag and document digital evidence. false Getting a hash value with a ____ is much faster and easier than with a(n) ____. hexadecimal editor, computer forensics tool AccessData ____ compares known file hash values to files on your evidence drive or image files to see whether they contain suspicious data. Data ____ involves changing or manipulating a file to conceal information. One way to hide partitions is to create a partition on a disk, and then use a disk editor such as ____ to manually delete any reference to it. Marking bad clusters data-hiding technique is more common with ____ file systems. The term ____ comes from the Greek word for“hidden writing.” ____ is defined as the art and science of hiding messages in such a way that only the intended recipient knows the message is there. Many commercial encryption programs use a technology called ____, which is designed to recover encrypted data if users forget their passphrases or if the user key is corrupted after a system data failure. People who want to hide data can also use advanced encryption programs, such as PGP or ____. ____ recovery is a fairly easy task in computer forensic analysis. ____ attacks use every possible letter, number, and character found on a keyboard when cracking a password. ____ are handy when you need to image the drive of a computer far away from your location or when you don’t want a suspect to be aware of an ongoing investigation. ____ is a remote access program for communication between two computers. The connection is established by using the DiskExplorer program (FAT or NTFS) corresponding to the suspect (remote) computer’s file system. With many computer forensics tools, you can open files with external viewers. Steganography cannot be used with file formats other than image files. ____ are based on mathematical instructions that define lines, curves, text, ovals, and other geometric shapes. You use ____ to create, modify, and save bitmap, vector, and metafile graphics files. ____ images store graphics information as grids of individual pixels. The process of converting raw picture data to another format is referred to as ____. The majority of digital cameras use the ____ format to store digital pictures ____ compression compresses data by permanently discarding bits of information in the file. Recovering pieces of a file is called ____. A(n) ____ file has a hexadecimal header value of FF D8 FF E0 00 10. If you can’t open an image file in an image viewer, the next step is to examine the file’s ____. The uppercase letter ____ has a hexadecimal value of 41. The image format XIF is derived from the more common ____ file format. The simplest way to access a file header is to use a(n) ____ editor false scope creep investigation plan subpoenas 2 Live stemming indexed bookmarks KFF hiding Norton DiskEdit FAT steganography Steganography key escrow BestCrypt Password Brute-force Remote acquisitions HDHOST true false Vector graphics graphics editors Bitmap demosaicing EXIF Lossy carving JPEG header data "A" TIFF hexadecimal The ____ header starts with hexadecimal 49 49 2A and has an offset of four bytes of 5C01 0000 2065 5874 656E 6465 6420 03. ____ is the art of hiding information inside image files. ____ steganography places data from the secret file into the host file without displaying the secret data when you view the host file in its associated program. ____ steganography replaces bits of the host file with other bits of data. In the following list, ____ is the only steg tool. ____ has also been used to protect copyrighted material by inserting digital watermarks into a file. When working with image files, computer investigators also need to be aware of ____ laws to guard against copyright violations. Under copyright laws, computer programs may be registered as ____. Under copyright laws, maps and architectural plans may be registered as ____. A graphics program creates and saves one of three types of image files: bitmap, vector, or ____________________. ____________________ is the process of coding of data from a larger form to a smaller form. The ____________________ is the best source for learning more about file formats and their associated extensions. All ____________________ files start at position zero (offset 0 is the first byte of a file) with hexadecimal 49 49 2A. The two major forms of steganography are ____________________ and substitution. ____ can help you determine whether a network is truly under attack or a user has inadvertently installed an untested patch or custom program. ____ forensics is the systematic tracking of incoming and outgoing traffic on your network. A common way of examining network traffic is by running the ____ program. ____ is a popular network intrusion detection system that performs packet capture and analysis in real time. ____ is the U.S. DoD computer forensics lab’s version of the dd command that comes with Knoppix-STD. ____ are devices and/or software placed on a network to monitor traffic. Most packet sniffers operate on layer 2 or ____ of the OSI model. ____ is the text version of Ethereal, a packet sniffer tool. The ____ Project was developed to make information widely available in an attempt to thwart Internet and network hackers. Machines used on a DDoS are known as ____ simply because they have unwittingly become part of the attack. E-mail messages are distributed from one central server to many connected client computers, a configuration called ____. With many ____ e-mail programs, you can copy an e-mail message by dragging the message to a storage medium, such as a folder or disk. When working on a Windows environment you can press ____ to copy the selected text to the clipboard. To retrieve an Outlook Express e-mail header right-click the message, and then click ____ to open a dialog box showing general information about the message. In Microsoft Outlook, you can save sent, drafted, deleted, and received e-mails in a file with a file extension of ____. ____ is a comprehensive Web site that has options for searching for a suspect, including by e-mail address, phone numbers, and names. ____ contains configuration information for Sendmail, allowing the investigator to determine where the log files reside. Typically, UNIX installations are set to store logs such as maillog in the ____ directory. In Exchange, to prevent loss of data from the last backup, a ____ file or marker is inserted in the transaction log to mark the last point at which the database was written to disk. The Novell e-mail server software is called ____. Developed during WWII, this technology,____, was patented by Qualcomm after the war. XIF Steganography Insertion Substitution Outguess Steganography copyright literary works pictorial, graphic, and sculptural works metafile Data compression internet TIFF insertion Network forensics Network Tcpdump Snort dcfldd Packet sniffers 3 Tethereal Honeynet zombies client/server architecture GUI Ctrl+C Properties .pst www.freeality.com /etc/sendmail.cf /var/log checkpoint GroupWise CDMA The ____ digital network divides a radio frequency into time slots. TDMA refers to the ____ standard, which introduced sleep mode to enhance battery life. Typically, phones store system data in ____, which enables service providers to reprogram phones without having to physically access memory chips. ____ cards are found most commonly in GSM devices and consist of a microprocessor and from 16 KB to 4 MB of EEPROM. ____ can still be found as separate devices from mobile phones. Most users carry them instead of a laptop to keep track of appointments, deadlines, address books, and so forth. The file system for a SIM card is a ____ structure. The SIM file structure begins with the root of the system (____). Paraben Software is a leader in mobile forensics software and offers several tools, including ____, which can be used to acquire data from a variety of phone models. In a Windows environment, BitPim stores files in ____ by default. TDMA IS-136 EEPROM SIM PDAs hierarchical MF Device Seizure My Documents\BitPim