Quiz 5 INSC 170

Réussis tes devoirs et examens dès maintenant avec Quizwiz!

Concentric circles on a disk platter where data is located

tracks

Alternate data streams can obscure valuable evidentiary data, intentionally or by coincidence.

true

In Microsoft file structures, sectors are grouped to form clusters, which are storage allocation units of one or more sectors.

true

It's possible to create a partition, add data to it, and then remove references to the partition so that it can be hidden in Windows.

true

The first 5 bytes (characters) for all MFT records are FILE.

true

The type of file system an OS uses determines how data is stored on the disk.

true

An international data format

unicode

A ____ enables you to run another OS on an existing physical computer (known as the host computer) by emulating a computer's hardware environment.

virtual machine

____ refers to the number of bits in one square inch of a disk platter.

Areal density

When Microsoft created Windows 95, it consolidated initialization (.ini) files into the ____.

Registry

Drive slack includes RAM slack (found mainly in older Microsoft OSs) and file slack.

True

One way to examine a partition's physical level is to use a disk editor, such as WinHex, or Hex Workshop.

True

____ is a core Win32 subsystem DLL file.

User32.sys

The space between each track

Track density

As data is added, the MFT can expand to take up 75% of the NTFS disk.

false

From a network forensics standpoint, there are no potential issues related to using virtual machines.

false

Typically, a virtual machine consists of just one file.

false

Gives an OS a road map to data on a disk

file system

In the NTFS MFT, all files and folders are stored in separate records of ____ bytes each.

1024

chapter 5 The file or folder's MFT record provides cluster addresses where the file is stored on the drive's partition. These cluster addresses are called_____

Data Runs

____ contain instructions for the OS for hardware devices, such as the keyboard, mouse, and video card, and are stored in the systemroot\Windows\System32\Drivers folder.

Device drivers

When Microsoft introduced Windows 2000, it added optional built-in encryption to NTFS called ____.

EFS

____ is the file structure database that Microsoft originally designed for floppy disks.

FAT

On an NTFS disk, immediately after the Partition Boot Sector is the ____.

MFT

____, located in the root folder of the system partition, is the device driver that allows the OS to communicate with SCSI or ATA drives that aren't related to the BIOS.

NTBootdd.sys

____ is a 16-bit real-mode program that queries the system for device and configuration data, and then passes its findings to Ntldr.

NTDetect.com

____ was introduced when Microsoft created Windows NT and is still the main file system in Windows 10.

NTFS

___ is Windows XP system service dispatch stubs to executables functions and internal support functions

Ntdll.dll

____ is the physical address support program for accessing more than 4 GB of physical RAM.

Ntkrnlpa.exe

____ is how most manufacturers deal with a platter's inner tracks having a smaller circumference than its outer tracks.

ZBR

Ways data can be appended to existing files

alternate data streams

Microsoft's utility for protecting drive data

bitlocker

____, located in the root folder of the system partition, specifies the Windows XP path installation and contains options for selecting the Windows version.

boot.ini

A ____ is a column of tracks on two or more disk platters.

cylinder

Unused space in a cluster between the end of an active file's content and the end of the cluster

drive slack

Records in the MFT are called ____.

metadata

Microsoft's move toward a journaling file system

nfts

The first data set on an NTFS disk, which starts at sector[0] of the disk and can expand to 16 sectors

partition boot sector

The unused space between partitions

partition gap

The purpose of the ____ is to provide a mechanism for recovering files encrypted with EFS if there's a problem with the user's original private key.

recovery certificate


Ensembles d'études connexes

diagnosis quiz 2: mood disorders

View Set

ENT Exam 1 & 2 Missed Questions, CH. 11, CH. 12

View Set

Social Security, Medicare, and Other Government Programs

View Set

Chapter 40: Fluid, Electrolyte, and Acid-Base

View Set

TestOut (PC Pro, Security Chapter)

View Set

RMI 2302: Exam 1 Module- Questions

View Set

ap macroeconomics unit 5 quizzes

View Set