forensics-chapter 6

A virtual cluster consists of what kind of clusters?

Chained clusters

Windows 2000 can be configured to access which of these file formats? (Choose all that apply.)

FAT12, FAT16, FAT32, NTFS

Zoned bit recording is how manufacturers ensure that the outer tracks store as much data as possible.True or False?

False

Areal density refers to which of the following?

Number of bits per square inch of a disk platter.

Sectors typically contain how many bytes?

512

What is the space on a drive called when a file is deleted? (Choose all that apply.)

Unallocated space, Free space

What feature does NTFS provide that FAT does not?

Unicode characters, security, journaling

What is the ratio of sectors per cluster in a floppy disk?

1:1

Clusters in Windows always begin numbering at what number?

2

In a FAT32 system, a 123 KB file uses how many sectors?

246

What does MFT stand for?

Master file table

Which of the following Windows XP files contains user-specific information?

Ntuser.dat

Device drivers contain what instructions for the OS on how to interface with hardware devices.

True

HPFS is used on OS/2.

True

In DOS and Windows 9.x, Io.sys is the first file loaded after the ROM bootstrap loader finds the disk.

True

In NTFS, files smaller than 512 bytes are stored in the MFT.

True

RAM slack can contain passwords. True or False?

True

The Windows Registry in Windows 9x consists of both System.dat and User.dat files.

True

What does CHS stand for?

cylinders, heads, sectors

Which of these are contained in the FAT?

file and directory names,starting cluster numbers,file attributes