File Systems Analysis Quiz 3 Review

According to the author the chunks of data that are transferred during the acquisition process are typically a multiple of: 400 bytes 500 bytes 1024 512

512

The Linux dd tool accesses the storage drive via the BIOS. True False

False

The author reports three types of image file formats raw, embedded, and hash. True False

False

The rule of thumb is to acquire data at the highest layer where evidence is found. True False

False

The dd tool comes with UNIX, Linux, and is available for Windows. True False

True

The output from dd can be either another file or another device. True False

True

Which of the following represents the flag "bs" used with the UNIX dd tool? byte size black size bold size block size

block size

The dd tool reads data from the source in ___ chunks, and the ___ size is ___ bytes. byte-size, default, 512 byte-size, usual, 512 block-size, default, 512 block-size, usual, 1024

block-size, default, 512

The dd tool reads data specified with the flag: fo of fi if

if

Which of the following represents a SATA or SCSI device in UNIX, and/or LInux? edb hda tdb sda

sda