Network Forensics - chap5quiz

BIOS boot firmware was developed to provide better protection against malware than EFI does developed?

False

Zone bit recording is how disk manufacturers ensure that a platter's outer tracks store as much data as possible.

False

EFS can encrypt which of the following?

Files, folders, and volumes

List two features NTFS has that FAT does not.

Unicode characters and better security

Virtual machines have which of the following limitations when running on a host computer?

Virtual machines are limited to the host computer's peripheral configurations, such as mouse, keyboard, CD/DVD drives, and other devices.

What is the space on a drive called when a file is deleted?

Unallocated space

Clusters in Windows always begin numbering at what number?

2

In FAT32, a 123-KB file uses how many sectors?

246 sectors

How many sectors are typically in a cluster on a disk drive?

4 or more

On a Windows system, sectors typically contain how many bytes?

512

What does the Ntuser.dat file contain?

MRU files list

In Windows 7 and later, how much data from RAM is loaded into RAM slack on a disk drive?

None

Which of the following Windows 8 files contains user-specific information?

Ntuser.dat

Areal density refers to which of the following?

Number of bits per square inch of a disk platter

What happens when you copy an encrypted file from an EFS-enabled NTFS disk to a non-EFS disk or folder?

The file is unencrypted automatically.

A virtual cluster number represents the assigned clusters of files that are nonresident in the MFT.

True

An image of a suspect drive can be loaded on a virtual machine.

True

CHS stands for cylinders, heads, and sectors

True

Device drivers contain instructions for the OS on how to interface with hardware devices.

True

File and directory names are some of the items stored in the FAT database.

True

In NTFS, files smaller than 512 bytes are stored in the MFT

True

MFT stands for Master File Table.

True