Computer Forensics ch5

virtual machine

A ____ enables you to run another OS on an existing physical computer (known as the host computer) by emulating a computer's hardware environment

cylinder

A ____ is a column of tracks on two or more disk platters

metadata

Records in the MFT are called_____

registry

When Microsoft created Windows 95, it consolidated initialization (.ini) files into the ____.

EFS

When Microsoft introduced Windows 2000, it added optional built-in encryption to NTFS called

MFT

On an NTFS disk, immediately after the Partition Boot Sector is the

NTFS

____ was introduced when Microsoft created Windows NT and is still the main file system in Windows 10.

1024

In the NTFS MFT, all files and folders are stored in separate records of ____ bytes each.

Areal density

Number of bits per square inch of a disk platter

data runs

The file or folder's MFT record provides cluster addresses where the file is stored on the drive's partition. These cluster addresses are referred to as____

recovery certificate

The purpose of the ____ is to provide a mechanism for recovering files encrypted with EFS if there's a problem with the user's original private key.

Device drivers

____ contain instructions for the OS for hardware devices, such as the keyboard, mouse, and video card, and are stored in the systemroot\Windows\System32\Drivers folder.

Ntdll.dll

____ is Windows XP system service dispatch stubs to executables functions and internal support functions.

NTDETECT.COM

____ is a 16-bit real-mode program that queries the system for device and configuration data, and then passes its findings to Ntldr

ZBR

____ is how most manufacturers deal with a platter's inner tracks having a smaller circumference than its outer tracks.

FAT

____ is the file structure database that Microsoft originally designed for floppy disks

Io.sys

____ is the physical address support program for accessing more than 4 GB of physical RAM.

NTBootdd.sys

____, located in the root folder of the system partition, is the device driver that allows the OS to communicate with SCSI or ATA drives that aren't related to the BIOS.

Boot ini

____, located in the root folder of the system partition, specifies the Windows XP path installation and contains options for selecting the Windows version

Hal.dll

is a core Win32 subsystem DLL file