Forensics

The space between the end of a file and the end of the cluster (if there is any such space) is called what? A. Empty space B. Slack space C. Delete space D. Nothing; files occupy the entire cluster.

B

What file system does OS X use? A. HPFS B. HFS+ C. NTFS D. EXT3

B

Which of the following is the Linux equivalent of a shortcut? A. Hardlink B. Symbolic link C. Partial link D. Faux link

B

Jason is performing an investigation of a Linux computer. The computer is part of an investigation into allegations of identity theft. The suspect who owns the computer is skilled with computers, and Jason is concerned that she may have deleted files from the system. In the Linux operating system, when is a file deleted? A. When the Recycle Bin is emptied B. When the Trashcan is emptied C. When the iNode count reaches 0 D. When the MFT removes the file reference

C

What file system does Windows 7 use? A. FAT B. FAT32 C. NTFS D. HPFS

C

In Linux, what is the data structure in the file system that stores all the information about a file except its name and its actual data? A. MFT B. FAT C. Cluster D. iNode

D

In Windows, the Recycle Bin is a holding place for deleted files until the user decides to confirm deletion by emptying the Recycle Bin. Once the file is moved to the Recycle Bin, a record is added to the log file that exists in the Recycle Bin. Which of the following files contains records that correspond to each deleted file in the Recycle Bin? A. INFO2 file B. INFO1 file C. LOGINFO2 file D. LOGINFO1 file

A

Why can you undelete files in Windows 7? A. Nothing is deleted; it is just removed from MFT. B. Nothing is deleted; it is just removed from FAT. C. Fragments might exist, even though the file is deleted. D.You cannot.

A