forensics last assighn

What feature of NTFS systems can be used to obscure information that might be used as evidence in an investigation?

ADS

NTFS data encryption is achieved with which of the following technologies?

EFS

Which of the following digital forensics tools require the MOST expertise?

Linux 'dd' command line tool

Which of the following is used to store information about disk partitions?

MBR

Which of the following organisations have a standard for verifying digital forensics tools?

NIST

Which of the following are NOT functions necessary for digital forensics tools?

Obfuscation

A typical forensics lab should include all of the following EXCEPT?

Old computers

Which of the following prevents contamination of evidence?

Write-blockers

Which of the following keeps a record of attached hardware, user preferences, network connections, and installed software?

registry