components

Question 1

types of digital devices

Answer 1

desktop computers
laptop computers
mobile phones
tablet devices
data storage
-	USB
-	Hard disk drives
-	Solid state drives
-	RAM sticks
-	Cloud storage

Question 2

inside a computer

Answer 2

Motherboard
Graphics card
CPU
RAM
PSU
HDD/SSD
CD/DVD ROM drive

Question 3

outside a computer

Answer 3

Screen
Workstation/base unit
Keyboard
Mouse
Printer
External storage device

Question 4

name 3 mobile operating systems

Answer 4

iOS
android
windows

Question 5

SIM cards

Answer 5

Subscriber identification module

Come in 4 sizes: full size SIM, mini SIM, micro SIM, nano SIM

Question 6

HHD - disk geometry

Answer 6

Hard drive disk

Made up of 1 or more platters coated with a magnetic material

Question 7

geometry - disk geometry

Answer 7

a disks logical structure of platters, tracks and sectors

Question 8

head - disk geometry

Answer 8

Device that reads and writes the data to a platter, there are 2 heads per platter, 1 reads the top side and the other the bottom side

Question 9

track - disk geometry

Answer 9

Concentric circles on a platter where data is located

Question 10

cylinders - disk geometry

Answer 10

a column of tracks on 2 or more platters

Question 11

sectors - disk geometry

Answer 11

section on a track made up of 512 bytes

Question 12

cylinder, head, sector maths

Answer 12

To work out the size of a hard drive from the CHS values:
•	C x H x S = tS
•	tS x BpS = total bytes
•	C = cylinders
•	H = heads
•	S = sectors
•	tS = total sectors
•	BpS = bytes per second

Question 13

sectors

Answer 13

A sector contains 571 bytes however only 512 of those bytes are for data, the rest make up the header of the sector

The header contains information about the sector, such as its ID, the CHS information and some cylindric redundancy check digits to ensure the integrity of the data

Question 14

solid state drives

Answer 14

Used in USB drives, laptops, tablets, and mobile phones and can cause digital forensic investigators issues when trying to recover data from them due to a feature called “wear-levelling”

Question 15

wear-levelling

Answer 15

Wear-levelling moves the data on the drive from one memory cell to another, so all memory cells have equal use as each memory cell is only designed to perform between 10,000 to 100,000 reads/writes depending on their design

Question 16

why is deleted data an issue

Answer 16

Deleted data is there for an issue because when something is deleted, the actual data is initially not deleted from the drive, just the references to it are removed, so with an SSD, the data will still be there but during the wear-levelling process other data could just be moved to the memory cells it was occupying.

Question 17

garbage collector

Answer 17

When data is moved around during wear-levelling, the old address to the data is filed in an area of firmware in a file called “garbage collector” and the drive will automatically erase data in these areas by overwriting any data in these listed areas.

Question 18

file systems

Answer 18

FAT – File Allocation Table

NTFS – New Technology File System

HFS/HFS+ - Hierarchical File System/plus

APFS – Apple File System

Ext – Extended File System

Question 19

FAT and NTFS are what based file systems

Answer 19

windows

Question 20

where are HFS and APFS found?

Answer 20

Macs

Question 21

where would a Ext file system be found

Answer 21

linux machine

Question 22

FAT file system

Answer 22

you would use a FAT based file system to use a USB drive to save data across multiple operating systems, but you can’t store files larger than 4GB in a FAT formatted drive.

Question 23

NTFS drive

Answer 23

A Mac can read an NTFS based USB drive but under normal conditions it cannot write to an NTFS drive.

Question 24

what are the two newest file structures

Answer 24

NTFS

APFS

Question 25

slack space

Answer 25

in a 1-2GB FAT16 drive there are 64 sectors in a cluster

therefore a 5,000 byte text document will take up to 10 sectors – and have 120 bytes remaining at the end of the file before the actual end of the 10th sector

120 bytes of data is then pulled from the RAM to fill this gap

In this cluster, there are also another 54 sectors that need filling in order to write the entire cluster, so more data is added to pad out the rest of the 54 sector gap

A computer with a Microsoft operating system allocates data to the hard drive in clusters at a time – depending on the drive size depends how many sectors there are in a cluster; When a file is written to the hard drive, it might not fill a full sector or cluster, but as the computer will need to write a full cluster it needs to find something to add to the rest of the file to fill up the remaining space in the cluster;

The RAM could be filled with passwords, usernames, or any other sort of data, the computer isn’t selective with what it uses, it just grabs some RAM data and chucks it into the rest of the sector or cluster it is writing, this makes the slack space a great place to find passwords, usernames, or any bits of files that have been open on the computer.

Question 26

operating systems

Answer 26

DOS

Windows 9x/XP/ME/Vista/7/8/10

macOS/iOS/watchOS/tvOS

linux

android