Chapter 3 Handling Computer Hardware

Question 1

What is the importance of recognizing different types of computer hardware in digital forensics?

Answer 1

It is crucial for understanding compatibility with software, operating systems, and file systems.

Question 2

What utility allows Intel-based Macs to run Windows operating systems?

Answer 2

Boot Camp

Question 3

What does SCSI stand for?

Answer 3

Small Computer System Interface

Question 4

What is one key advantage of SCSI?

Answer 4

Facilitates high rates of data transfer

Question 5

True or False: SCSI devices can be daisy-chained together.

Answer 5

True

Question 6

What does IDE stand for in computer hardware?

Answer 6

Integrated Drive Electronics

Question 7

What is the primary limitation of IDE compared to SATA?

Answer 7

Uses a parallel data transfer method, which is slower than SATA’s serial method.

Question 8

What does SATA stand for?

Answer 8

Serial ATA

Question 9

List three key advantages of SATA over IDE.

Answer 9

• Faster data transfer
• Improved cable design
• Dedicated bandwidth

Question 10

What is the difference between a disk clone and a disk image?

Answer 10

A disk clone is a bootable exact copy, while a disk image is a non-bootable file containing bit-for-bit copies.

Question 11

What is the purpose of the Host Protected Area (HPA) in hard disks?

Answer 11

Contains code associated with the BIOS for booting and recovery purposes.

Question 12

What is the main function of garbage collection in solid state drives (SSDs)?

Answer 12

Removes unused files to make more memory available.

Question 13

Fill in the blank: RAM is _______ memory used for processes currently running on a computer.

Answer 13

volatile

Question 14

What is RAID an acronym for?

Answer 14

Redundant Array of Independent Disks

Question 15

What is FireWire used for?

Answer 15

High-speed data transfer

Question 16

True or False: USB flash drives typically use the NTFS file system.

Answer 16

False (they typically use FAT file system)

Question 17

What is the maximum number of devices that can be connected to an IDE controller?

Answer 17

Four devices

Question 18

What is the standard size of a MultiMediaCard (MMC)?

Answer 18

24mm × 32mm × 1.4mm

Question 19

What is the function of the File Translation Layer (FTL) in SSDs?

Answer 19

Maps a logical block address to a physical block address.

Question 20

What should always be carried as a backup imaging tool during forensic investigations?

Answer 20

A write-blocker

Question 21

What type of cable design does SATA use compared to IDE?

Answer 21

Thinner, more flexible cable

Question 22

What is the primary use of the Disk Jockey PRO Forensic Edition?

Answer 22

Cloning hard disk drives

Question 23

List two types of external hard drives.

Answer 23

• USB-powered
• Adapter-powered

Question 24

What is TRIM in the context of SSDs?

Answer 24

An OS function that informs an SSD of blocks no longer in use.

Question 25

What is a key challenge in recovering deleted files on SSDs?

Answer 25

Garbage collection

Question 26

What is the purpose of Digital Intelligence’s UltraBlock Forensic Card Reader and Writer?

Answer 26

To securely view the contents of flash memory cards ## Footnote It connects to a computer via the USB port and supports various media types.

Question 27

List the types of media that the UltraBlock Forensic Card Reader and Writer can read.

Answer 27

* CompactFlash * MicroDrive * Memory Stick * Memory Stick PRO * Smart Media Card * xD Picture Card * Secure Digital Card (SD and SDHC) * MultiMedia Card ## Footnote These media types are commonly used in digital devices.

Question 28

What is the function of a USB write-blocker?

Answer 28

To prevent writing to a device while reading data ## Footnote This ensures that the integrity of the data is maintained during forensic analysis.

Question 29

How can an investigator view or acquire the contents of a media card?

Answer 29

By connecting a media card reader to a USB write-blocker ## Footnote This setup allows safe data acquisition without altering the original data.

Question 30

What is an example of a write-blocker that can be used with a media card reader?

Answer 30

Digital Intelligence's UltraBlock USB Write Blocker ## Footnote This device is specifically designed for forensic investigations.

Question 31

Name three types of additional storage media mentioned.

Answer 31

* Compact Disk (CD) * Digital Video Disc (DVD) * Magnetic Tape ## Footnote These storage media are used for data storage and transfer.

Question 32

What is the significance of recognizing different types of computer hardware in forensics?

Answer 32

It is crucial for effectively extracting and analyzing data from various storage devices ## Footnote Understanding hardware helps investigators handle evidence properly.

Question 33

What is the importance of disk drive interfaces in computer forensics?

Answer 33

They determine how an investigator can access and extract data from storage devices ## Footnote Different interfaces may require specific tools and methods.

Question 34

Fill in the blank: The summary of Chapter 3 reviewed the importance of recognizing different types of _______.

Answer 34

computer hardware

Question 35

What types of devices are used to forensically extract data?

Answer 35

Various tools and hardware designed for data acquisition ## Footnote This includes card readers, write-blockers, and forensic software.

Question 36

True or False: A floppy disk is considered a modern storage medium.

Answer 36

False ## Footnote Floppy disks are outdated and not commonly used in contemporary data storage.

Question 37

What is one key takeaway from Chapter 3 regarding evidence handling?

Answer 37

How storage media should be handled and analyzed ## Footnote Proper handling is essential for maintaining the integrity of forensic evidence.