Final Exam Flashcards
List 4 File Systems
a. FAT32
b. NTFS
c. HFS
d. EXT4
List 4 requirement of all file systems
a. Object Name
b. Starting cluster
c. Allocation
d. Fragmentation
What is a MBR and where is it found (assume a windows system) and what does it do?
Master Boot Record. It’s found at Sector 0. It contains partition table which consist of 4 sixteen Byte records
What is a sector?
A smallest physical storage.
What is Plist
The preferred way to store property lists on OS X and and IOS. They are in the format XML.
What is a cluster or block?
A combination of one or more sectors allocated to store data
Value of Volume boot record:
The number of sector per clusters
Volume shadow copy:
Allows to recover disk or volume at some point. Hacker likely to turn off this for ransom.
Volatile data :
Data that is lost when a computer is turned off. Volatile storage is a form of temporary memory. It contains the most update activities of the user, it also help determine if an external drive had been used
Volatile data provides useful information during network intrusion investigation.
Differentiate between a physical file and a logical file
Logical : The actual size of the file
Physical : The size of the cluster reserved for the file.
What is the difference between a physical disk image and a logical disk image?
Logical disk is the volume
Physical Disk: Has the volume
- What is file slack, why does a data persist there and how long it stay?
Unused space of a cluster. It persist there because not all sectors allocated hold the file. It will stay there until a new file larger than the original file is written on that cluster.
- Define Allocated vs unallocated disk space?
Allocated is the space contained data. Unallocated is the free space
What is a bit stream image? Can I bit stream the acquisition of a logical drive?
Copy-by-copy, byte-by-byte of the hard drive without altering the original drive. Yes I can bit stream a logical drive.
What is the difference between a “partition” and a “volume”?
When a partition is formatted, it’s becomes a volume.
What is fragmentation and why should we care?
Involves splitting data into smaller fragment and distributing them across a larger number of machine. Fragmentation can hold slack file.
What is hash collision:
When the content of data is altered, but its hash is still the same as the original.
When imaging an iPhone,
we get a recent database which may have some emails. MAC is always changing. MAC is moving away from PList to SQLite data base.
SQLite data base
SQLite data base use for SMS, address book in phones, internet history in phones and in computer, setting been stored
What is Plist
The preferred way to store property lists on OS X and and IOS. They are in the format XML.
What is a VBR and where is it found (assume a windows system) and what does it do?
Volume Boot Record. It’s found at the First sector of a volume. In windows, it’s found at sector 63 or 2048 for the first volume.
VBR contains the sector per cluster as well as volume serial number. It’s used to identify the file system of the volume.
