3601 Chapter 5 review
In NTFS, files smaller than 512 bytes are stored in the MFT
True
What is the space on a drive called when a file is deleted?
Unallocated or Free space
List two features NTFS has that FAT does not
Unicode characters, security, journaling.
Describe the limitations of running a virtual machine on a host computer
Virtual machines are limited to the host computer's peripheral configurations, such as mouse, keyboard, CD/DVD drives, and other devices.
List three items stored in the FAT database
File and directory names, starting cluster numbers, file attributes, date and time stamps.
What can EFS encrypt?
Files stored in Windows 2000, Windows XP Professional, Windows Server 2003 computers
Device drivers contain what kind of information?
Instructions for the OS on how to interface with hardware devices.
What does MFT stand for?
Master File Table
Areal density refers to...?
Number of bits per square inch in a disk platter
What does the file Ntuser.dat contain?
The file contains the registry settings for an individual user's account.
An image of a suspect drive can be loaded on a virtual machine
True
Clusters in Windows always begin numbering at what number?
2
In FAT32, a 123 KB file uses how many sectors?
246 sectors
On a Windows system, sectors typically contain how many bytes?
512
What does CHS stand for?
Cylinder, Head, Sector
Of particular interest when you're examining NTFS disks are ____, which are ways data can be appended to existing files.
Data Streams
What are the functions of a data run's field components in an MFT record?
first declares how many bytes are required in the attribute field to store the number of bytes needed for the second and third components. The second component stores the number of clusters assigned to the data run, and the third component contains the starting cluster address value the LCN or the VCN.
The purpose of the ____ is to provide a mechanism for recovering encrypted files under EFS if there's a problem with the user's original private key.
recovery certificate
