AfterLabQuizzes Forensics Midterm

What NTFS metafile serves as a record of which clusters on a disk are allocated and unallocated?

$BitMap

Which DiskDigger option is preferable for recovering recently deleted files, but is limited to NTFS, FAT, FAT32, and exFAT files systems?

Dig Deep

What is the most commonly used file system for Linux?

Ext4 (Extended File System version 4)

A file is completely removed from the system only once you empty the trash or recycle bin.

False

Which of the following tools can recover files even when a file system is severely damaged?

Photorec

What does a file, beginning with "$R", contain in a Windows 10 Recycle?

The actual deleted file

Which of the following best defines data carving?

The removal of organized information from undifferentiated data

What is the purpose of the dd Linux command?

To write random data to a section of a file system

In E3, what appears next to a filename that is identified as deleted in the file system?

A red X

What should be added to a Linux command lsblk to display the full path of each discovered device?

-p