Cengage Chapter 5 - Working with Windows and CLI Systems Flashcards

1
Q

Ways in which data can be appended to a file (intentionally or not) and potentially obscure evidentiary data. In NTFS, _______________________ become an additional file attribute.

A

alternate data streams

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

An 8-bit coding scheme that assigns numeric values to up to 256 characters, including letters, numerals, punctuation marks, control characters, and other symbols.

A

American Standard Code for Information Interchange (ASCII)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

The number of bits per square inch of a disk platter.

A

areal density

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

In NTFS, an MFT record field containing metadata about the file or folder and the file’s data or links to the file’s data.

A

attribute ID

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

A file that specifies the Windows path installation and a variety of other startup options.

A

Boot.ini

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

If a machine has multiple booting OSs, NTLDR reads this hidden file to determine the address (boot sector location) of each OS. See also NT Loader (Ntldr).

A

BootSect.dos

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Information stored in ROM that a computer accesses during startup; this information tells the computer how to access the OS and hard drive.

A

bootstrap process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Storage allocation units composed of groups of sectors. __________ are 512, 1024, 2048, or 4096 bytes each.

A

clusters

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

A column of tracks on two or more disk platters.

A

cylinder

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Cluster addresses where files are stored on a drive’s partition outside the MFT record. __________ are used for nonresident MFT file records. A ___________ record field consists of three components; the first component defines the size in bytes needed to store the second and third components’ content.

A

data runs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Files containing instructions for the OS for hardware devices, such as the keyboard, mouse, and video card.

A

device drivers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Unused space in a cluster between the end of an active file and the end of the cluster. It can contain deleted files, deleted e-mail, or file fragments. Drive slack is made up of both file slack and RAM slack. See also file slack and RAM slack.

A

drive slack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

A public/ private key encryption first used in Windows 2000 on NTFS-formatted disks. The file is encrypted with a symmetric key, and then a public/private key is used to encrypt the symmetric key.

A

Encrypting File System (EFS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

The original Microsoft file structure database. It’s written to the outermost track of a disk and contains information about each file stored on the drive. PCs use the FAT to organize files on a disk so that the OS can find the files it needs. The variations are FAT12, FAT16, FAT32, VFAT, and FATX.

A

File Allocation Table (FAT)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

The unused space created when a file is saved. If the allocated space is larger than the file, the remaining space is slack space and can contain passwords, logon IDs, file fragments, and deleted e-mails.

A

file slack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

The way files are stored on a disk; gives an OS a road map to data on a disk.

A

file system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

A disk drive’s internal organization of platters, tracks, and sectors.

A

geometry

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

The Hardware Abstraction Layer dynamic link library allows the OS kernel to communicate with hardware.

A

Hal.dll

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

The device that reads and writes data to a disk drive.

A

head

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

A method manufacturers use to minimize lag time. The starting sectors of tracks are slightly offset from each other to move the read-write head.

A

head and cylinder skew

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

The file system IBM uses for its OS/2 operating system.

A

High Performance File System (HPFS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

In Windows NT through Vista, the control file for the Recycle Bin. It contains ASCII data, Unicode data, and date and time of deletion.

A

Info2 file

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

A bootable file that can be copied to CD or DVD; typically used for installing operating systems. It can also be read by virtualization software when creating a virtual boot disk.

A

ISO image

24
Q

When files are saved, they are assigned to clusters, which the OS numbers sequentially starting at 2. ______________ point to relative cluster positions, using these assigned cluster numbers.

A

logical addresses

25
Q

The numbers sequentially assigned to each cluster when an NTFS disk partition is created and formatted. The first cluster on an NTFS partition starts at count 0. _____ become the addresses that allow the MFT to read and write data to the disk’s nonresident attribute area. See also data runs and virtual cluster number (VCN).

A

logical cluster numbers (LCNs)

26
Q

On Windows and DOS computers, this boot disk file contains information about partitions on a disk and their locations, size, and other important items.

A

Master Boot Record (MBR)

27
Q

NTFS uses this database to store and link to files. It contains information about access rights, date and time stamps, system attributes, and other information about files.

A

Master File Table (MFT)

28
Q

In NTFS, this term refers to information stored in the MFT. See also Master File Table (MFT).

A

metadata

29
Q

A device driver that allows the OS to communicate with SCSI or ATA drives that aren’t related to the BIOS.

A

NTBootdd.sys

30
Q

A 16-bit program that identifies hardware components during startup and sends the information to Ntldr.

A

NTDetect.com

31
Q

A program in the root folder of the system partition that loads the OS. See also BootSect.dos.

A

NT File System (NTFS)

32
Q

A program in the root folder of the system partition that loads the OS. See also BootSect.dos.

A

NT Loader (Ntldr)

33
Q

The kernel for the Windows NT family of OSs.

A

Ntoskrnl.exe

34
Q

A password used to access special accounts or programs requiring a high level of security, such as a decryption utility for an encrypted drive. This passphrase can be used only once, and then it expires.

A

one-time passphrase

35
Q

At startup, data and instruction code are moved in and out of this file to optimize the amount of physical RAM available during startup.

A

Pagefile.sys

36
Q

A logical drive on a disk. It can be the entire disk or part of the disk.

A

partition

37
Q

The first data set of an NTFS disk. It starts at sector [0] of the disk drive and can expand up to 16 sectors.

A

Partition Boot Sector

38
Q

Unused space or void between the primary partition and the first logical partition.

A

partition gap

39
Q

Any information that can be used to create bank or credit card accounts, such as name, home address, Social Security number, and driver’s license number.

A

personal identity information (PII)

40
Q

The actual sectors in which files are located. Sectors reside at the hardware and firmware level.

A

physical addresses

41
Q

In encryption, the key used to decrypt the file. The file owner keeps the private key.

A

private key

42
Q

In encryption, the key used to encrypt a file; it’s held by a certificate authority, such as a global registry, network server, or company such as VeriSign.

A

public key

43
Q

The unused space between the end of the file (EOF) and the end of the last sector used by the active file in the cluster. Any data residing in RAM at the time the file is saved, such as logon IDs and passwords, can appear in this area, whether the information was saved or not. RAM slack is found mainly in older Microsoft OSs.

A

RAM slack

44
Q

A method NTFS uses so that a network administrator can recover encrypted files if the file’s user/creator loses the private key encryption code.

A

recovery certificate

45
Q

A Windows database containing information about hardware and software configurations, network connections, user preferences, setup information, and other critical information.

A

Registry

46
Q

A file system developed for Windows Server 2012. It allows increased scalability for disk storage and has improved features for data recovery and error checking.

A

Resilient File System (ReFS)

47
Q

A section on a track, typically made up of 512 bytes.

A

sector

48
Q

The space between tracks on a disk. The smaller the space between tracks, the more tracks on a disk. Older drives with wider track densities allowed the heads to wander.

A

track density

49
Q

Concentric circles on a disk platter where data is stored.

A

tracks

50
Q

Partition disk space that isn’t allocated to a file. This space might contain data from files that have been deleted previously.

A

unallocated disk space

51
Q

A character code representation that’s replacing ASCII. It’s capable of representing more than 64,000 characters and non-European-based languages.

A

Unicode

52
Q

One of three formats Unicode uses to translate languages for digital representation.

A

UTF-8 (Unicode Transformation Format)

53
Q

When a large file is saved in NTFS, it’s assigned a logical cluster number specifying a location on the partition. Large files are referred to as nonresident files. If the disk is highly fragmented, _____ are assigned and list the additional space needed to store the file. The LCN is a physical location on the NTFS partition; _____ are the offset from the previous LCN data run. See also data runs and logical cluster numbers (LCNs).

A

virtual cluster number (VCN)

54
Q

A file representing a system’s hard drive that can be booted in a virtualization application and allows running a suspect’s computer in a virtual environment.

A

virtual hard disk (VHD)

55
Q

Emulated computer environments that simulate hardware and can be used for running OSs separate from the physical (host) computer. For example, a computer running Windows Vista could have a virtual Windows 98 OS, allowing the user to switch between OSs.

A

virtual machines

56
Q

An internal firmware feature used in solid-state drives that ensures even wear of read/writes for all memory cells.

A

wear-leveling

57
Q

The method most manufacturers use to deal with a platter’s inner tracks being shorter than the outer tracks. Grouping tracks by zones ensures that all tracks hold the same amount of data.

A

zone bit recording (ZBR)