Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Digital Fornesics > Chapter 5 > Flashcards

Chapter 5 Flashcards

1
Q

CLI

A

Command line interface

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

COMPTIA

A

Computer Technology Industry Association

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

A _____ gives an OS a road map to data on a disk.

A

file system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

To understand the boot sequence for phones and tablets, it is best to _____

A

review the vendor’s documentation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

CMOS

A

Complementary Metal Oxide Semiconductor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

EFI

A

Extensible Firmware Interface

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

UEFI

A

Unified Extensible Firmware Interface

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

A computer stores system config and date/time info in the ____ when power to the system if off.

A

CMOS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

The system ____ or ____ contains programs that perform input and output at the hardware level.

A

BIOS or EFI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

____ is designed for x86 computers and typically used on disk drives with master boot record (MBR).

A

BIOS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

____ is designed for x64 computers and uses GUID Partition Table (GPT).

A

EFI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

MBR

A

Master Boot Record

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

GPT

A

GUID Partition Table

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

In an effort to reduce the relationship with firmware, Intel developed ____ which defines the interface between a computer’s firmware and the OS.

A

UEFI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

The bootstrap process is contained in ______.

A

ROM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

You can unhook _____ to force the system to tell you what keys to use to access the CMOS in the bootstrap process.

A

the keyboard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

The key you press to access CMOS depends on _____.

A

the computer’s BIOS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are keys and combos that can access the CMOS with?

A
  1. Delete key
  2. Ctrl Alt Insert
  3. Ctrl A
  4. Ctrl S
  5. Ctrl F1
  6. Ctrl F2
  7. Ctrl F10
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

A safe method to verify the BIOS date and time with accidentally accessing a disk drive on boot up.

A

Removing all hard drives from the computer and then power on.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Refers to a disk’s logical structure of platters, tracks, and sectors.

A

Geometry

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

The device that reads and writes data to a drive. There are two per platter that read and write the top and bottom sides.

A

Head

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Concentric circles on a disk platter where data is located.

A

tracks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

A column of tracks on two or more disk platters. Usually each platter has two surfaces: top and bottom. Stacked up.

A

Cylinder

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

A section on a track usually made up of 512 bytes, wedge shaped.

A

Sector

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Typical disk drive storage per sector

A

512 bytes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Advanced format disk drive storage per sector

A

4096 bytes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

CHS

A

cylinder, head, and sector calculation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

CHS calculation

A

A way to determine the total number of addressable bytes on a disk, multiply the number of cylinders by the number of heads (actually the tracks) and by the number of sectors (groups of 512 bytes).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Tracks start with what number?

A

0

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

ZBR

A

Zone bit recording, how most manufacturers deal with a platter’s inner tracks having a smaller circumference and therefore less space to store data than in the outer tracks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

The space between each track

A

Track density

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Refers to the number of bits in one square inch of a disk platter.

A

Areal density

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Used to improve disk performance…

A

head and cylinder skew

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

A feature all flash memory devices have

A

wear-leveling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Wear leveling purpose:

A

to make sure all memory cells on a flash drive wear evenly

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

When data is deleted on a hard drive, only the _____ are removed.

A

reference, which leaves the original/deleted data in unallocated disk space

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

firmware file that contains a list of all the old memory cell addresses in a flash drive

A

garbage collector

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

When dealing with _______ drives, making a full forensic copy as soon as possible is crucial in case data needs to be recovered from unallocated disk space.

A

solid-state drives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Storage allocation units of one or more sectors

A

clusters

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

FAT

A

file allocation table

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

NTFS

A

NT File System

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Cluster size range

A

512 bytes to 32,000 bytes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Clusters start at ____ in NTFS

A

0

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Clusters start at ____ in FAT

A

2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

The first sector of all disks contains 3 things

A
  1. system area
  2. boot record
  3. a file structure database
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

cluster numbers are referred to as

A

logical address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

sector numbers are referred to as

A

physical addresses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

a logical drive

A

partition

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Windows OSs can have ___ primary partitions followed by an extended partition that can contain one or more logical drives.

A

3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

large unused gaps between partitions on a disk drive

A

voids

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

unused space between partitions

A

partition gaps

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Two ways to hide data on a disk

A
  1. create a partition, add data to it, remove references to it.
  2. declare a smaller number of bytes than the actual drive size is (and hide data at the end of it).
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

A way to examine a partition’s physical level

A
  1. use a disk editor
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

WinHex is a ….

A

hexadecimal editor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

FAT

A

File allocation table, the file structure MS designed for floppy disks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

3 current versions of FAT

A
  1. FAT16
  2. FAT32
  3. exFAT (used by Xbox)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

3 older versions of FAT

A
  1. FATX
  2. virtual FAT (VFAT)
  3. FAT12
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

limitations of MS DOS 6.22 FAT version

A
  1. 8 characters for filenames

2. 3 characters for extensions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

drive slack

A

composed of the unused space in a cluster between the end of an active file’s content and the end of the cluster

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

The partition table is in the ______

A

MBR (master boot record)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

The partition table is located at sector ____ of the disk drive.

A

0

62
Q

What kind of editor is WinHex?

A

a hexadecimal editor

63
Q

Where would you find the first partition starting at in WinHex?

A

0x1BE

64
Q

Where would you find the second partition starting at in WinHex?

A

0x1CE

65
Q

Where would find the third partition starting at in WinHex?

A

0x1DE

66
Q

If the c drive displays .R.NTFS in the file system field if the partition is formatted as a _____ drive.

A

NTFS

67
Q

The c drive displays MSDOS5.0 or MSWIN4.1 in the file system field if the partition is formatted as a ___ drive.

A

FAT

68
Q

What file format are these extensions for in WinHex? BM6, BM, or BMF?

A

bitmap file images

69
Q

What does WinHex show for a BM file signature for bitmap image files?

A

42 4D

70
Q

PK or OOXML first two characters in hex for MS Office 2007 or later…

A

a compressed file

71
Q

Depending on the hexadecimal editor, hex values can be grouped in sets of two or four digits. True of False?

A

True

72
Q

FAT

A

File allocation table which is the file structure database that MS desgined for floppy disks.

73
Q

Other OSs like Linux and Macintosh can format, read and write to FAT storage devices such as USB devices and SD cards. True or False?

A

True

74
Q

EOF

A

end of file

75
Q

With FAT___, users discovered they had a lot of extra free disk space because files wasted less space than FAT16 did.

A

FAT32

76
Q

Which tool can allow you to view cluster-chaining sequence and see how FAT addresses linking clusters to one another?

A

ProDiscover

77
Q

What does the OS insert in the filenames first letter position when a file is deleted?

A

HEX E5

78
Q

How does a FAT file system mark a file as deleted?

A

The HEX E5 character replaces the first letter of the file name and the FAT chain for the file is set to 0

79
Q

unallocated disk space

A

also called free disk space

80
Q

The main file system for Windows 8

A

NTFS, MS’s move towards a journaling file system

81
Q

HPFS

A

High Performance File System, the file system for OS.2 operating system MS worked on for IBM. MS provided backwards compatibilty for this system until Windows 2000 was released.

82
Q

Why is the journaling feature helpful?

A

It records a transaction before the system carries it out, which can be helpful in a power failure or other interruption.

83
Q

On an NTFS disk, the first data set is the ____

A

Partition Boot Sector

84
Q

What comes immediately after the Partition Boot Sector on an NTFS disk

A

the Master File Table

85
Q

The first file on an NTFS disk

A

MFT

86
Q

Important advantage of NTFS over FAT

A

NTFS results in much less file slack space

87
Q

records in the MFT

A

metadata

88
Q

international data format

A

Unicode

89
Q

ASCII

A

American Standard Code for Information Interchange

90
Q

For Western language alphabet characters, UTF-8 is identical to ASCII. True or False?

A

True

91
Q

In the MFT the first ___ records are reserved for system files.

A

15

92
Q

In the NTFS MFT, all files and folders are stored in separate records of ___ bytes.

A

1024

93
Q

A record field is referred to as an _____

A

Attribute ID

94
Q

File or folder info is typically stored in two ways in an MFT record:

A
  1. resident

2. non-resident

95
Q

Resident MFT files metadata characteristics

A
  1. very small, 512 bytes or less

2. all file metadata and data stored in the MFT record

96
Q

non-resident MFT files characteristics

A
  1. stored outside of the MFT if over 512 bytes

2. MFT records provides cluster addresses where the file is stored on the drive’s partition

97
Q

cluster addresses of larger non-resident files

A

data runs

98
Q

The first 4 bytes for all MFT records are ____

A

FILE

99
Q

where first attribute ID starts

A

typically at offset 0x14 from beginning of the record

100
Q

Attribute ID 0x10

A

$Standard Information (creation dates, read, alternations, DOS file permissions)

101
Q

Attribute ID 0x20

A

$Attribute List (attributes that don’t fit in the MFT, or non-resident attributes)

102
Q

Attribute ID 0x30

A

$File.Name (long and short names)

103
Q

Attribute ID 0x40

A

$Object.ID (ownership and rights/permissions)

104
Q

Attribute ID 0x50

A

$Security Descriptors (Access control list for the file)

105
Q

Attribute ID 0x60

A

$Volume Name, not all files need.

106
Q

Attribute ID 0x70

A

$Volume.Information (version and state of volume)

107
Q

Attribute ID 0x80

A

$Data (file data for resident files or data runs for nonresident files)

108
Q

Attribute ID 0x90

A

$Index.Root (use of folders and indexes)

109
Q

Attribute ID 0xA0

A

$Index.Allocation (use of folders and indexes also)

110
Q

Attribute ID 0xB0

A

$Bitmap (A bitmap indicating cluster status, such as which are in use and which are available)

111
Q

Attribute ID 0xC0

A

$Reparse.Point (field used for volume mount points and Installable File System filter drivers)

112
Q

Attribute ID 0xD0

A

$EA.Information (For use with OS/2 HPFS

113
Q

Attribute ID 0xE0

A

For use with OS/2 HPFS

114
Q

Attribute ID 0x100

A

$Logged.Utility_Stream (field used by Encrypting File System in Windows 2000 and later)

115
Q

LCNs

A

Logical Cluster Numbers

116
Q

VCN

A

Virtual Cluster Number

117
Q

Hexadecimal value 400 is displayed as

A

00 04 00 00 and the number 0x40000 is displayed as 00 00 04 00

118
Q

The first section of an MFT record

A

the header

119
Q

The header in an MFT record ___

A

defines the size and starting position of the first attribute

120
Q

MFT Header Field at Offset 0x00

A

The MFT record identifier FILE; the letter F is at offset 0

121
Q

MFT Header Field at Offset 0x1C to 0x1F

A

Size of the MFT record; the default is 0x400 (1024) bytes, or two sectors

122
Q

MFT Header Field at Offset 0x14

A

Length of the header, which indicates where the next attribute starts; typically at 0x38 bytes

123
Q

MFT Header Field at Offset 0x32 and 0x33

A

The updates sequence array, which stores the last 2 bytes of the first sector of the MFT record. Used only when MFT data exceeds 512 bytes. Used as a checksum for record integrity validation.

124
Q

Most important offset locations for 0x30 FIle Name attribute:

A
  1. offset 0x20 to 0x27 (file’s create data/time stored in WIn 32 format)
  2. offset 0x28 to 0x2F (last modified date and time for the file.
  3. offset 0x30 to 0x37 (last access date and time)
  4. offset 0x38 to 0x3F (record update date and time)
125
Q

Which attribute depends on the Windows version to be listed in the MFT?

A

0x40 Object_ID

126
Q

ways data can be appended to existing files

A

alternate data streams

127
Q

The only way you can tell whether a file has an alternate data stream attached is by ______

A

examining the file’s MFT record entry

128
Q

With FAT16 you can compress ____

A

only a volume

129
Q

With NTFS you can compress ____

A

files, folders, and entire volumes

130
Q

LZH algorithmn

A

Lempel-Ziv-Huffman algorithm, data compression

131
Q

3 types of zip files

A

PKZip, WinZip, GNUzip

132
Q

3rd party compression format file extension

A

.rar

133
Q

3rd party compressed files need to be ___

A

uncompressed with the utility that created it. most forensics tools will struggle with 3rd party compression files

134
Q

EFS

A

Encryption File System, MS introduced in Windows 2000

135
Q

EFS uses what kind of keys?

A

public and private keys

136
Q

What is the purpose of the recovery certificate?

A

Provides a mechanism for recovering files encrypted with EFS if there’s a problem with the user’s original private key.

137
Q

Where is the EFS recovery certificate stored?

A

In the Windows administrator account

138
Q

What 2 ways can Windows admins recover a key?

A
  1. through Windows

2. thru an MS-DOS command prompt

139
Q

What are the 3 commands available thru the MS-DOS command prompt?

A
  1. cipher
  2. copy (works in FAT and NTFS)
  3. efsrecvr (used to decrypt EFS files)
140
Q

/switch

A

Additional cipher command in Vista Business Edition or later that overwrites all deleted files, making them impossible to recover with data recovery or forensics carving tools.

141
Q

2 methods of deleting a file

A
  1. OS renames it and moves it to the recycle bin

2. del in MS-DOS command (removes it from the MFT listing the same way FAT does)

142
Q

control file for the Recycle Bin

A

Info2 file

143
Q

What does the Info2 file contain?

A
  1. ASCII data
  2. unicode data
  3. date/time of deletion
144
Q

Windows Server 2012 new file system

A

Resilient File System

145
Q

ReFS

A

Resilient File System

146
Q

Purpose of ReFS

A

to handle very large data storage needs, such as the cloud

147
Q

Features of ReFS

A
  1. max data availability
  2. improved data integrity
  3. designed for scalability
  4. not intended for boot drive, for data storage only
148
Q

Sort method used by ReFS

A

B+- tree

“allocate-on-write” that copies updates of data files to new locations (similar to shadow paging)

149
Q

PII

A

personal identity information

150
Q

Any info a company keeps confidential

A

trade secrets

Digital Fornesics (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions