Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

C702 Forensics and Network Intrusion > Hard Disks & File Systems > Flashcards

Hard Disks & File Systems Flashcards

1
Q

Track Numbering

A

Begins from 0 at outer edge and moves towards the center, typically reaching a value of 1023

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Sectors

A

The smallest allocation unit of a disk platter.

Normally holds 512 bytes of data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Clusters

A

The smallest allocation unit of a hard disk. A set of tracks and sectors from 2-32

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Slack Space

A
  1. The free space on the cluster after writing data on that cluster
  2. If the size of the stored data is less than the cluster’s size, the unused area remains reserved for the file, resulting in slack space
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Bit

A

a single binary digit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Byte

A

consists of 8 bits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Nibble

A

half a byte/consists of 4 bits/known as a tetrade

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Hard Disk Data Addressing

A
  1. CHS

2. LBA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Disk Partitioning

A

Primary

Extended

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Primary Disk Partition

A

holds the information regarding the operating

system, system area, and other information required for booting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Extended Disk Partition

A

holds the information regarding the

data and files that are stored in the disk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

BIOS Parameter Block (BPB)

A

The BPB is a data structure situated at sector 1 in the

volume boot record of a hard disk and explains the physical layout of a disk volume.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Master Boot Record (MBR)

A

A master boot record (MBR) is the first sector (“sector zero”) of a data storage device such as a hard disk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Backup the MBR on a UNIX/LINUX System

A

dd if=/dev/xxx of=mbr.backup bs=512 count=1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Restore the MBR on a UNIX/LINUX System

A

dd if=mbr.backup of=/dev/xxx bs=512 count=1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the GUID?

A

The Globally Unique Identifier is a 128-bit unique number, generated by the Windows OS for identifying a specific device, document, a database entry, and/or the user.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is GPT?

A

GPT - Part of the Unified Extensible Firmware Interface (UEFI), which replaces legacy BIOS firmware interfaces.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What Partition scheme does MBR use?

A

32 bits for storing LBA and the size information on a 512-byte sector.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What Partition scheme does GPT use?

A

In GPT, each logical block is 512 bytes and each partition entry is 128 bytes, and the negative addressing of the logical blocks starts from the end of the volume with -1 as the last addressable block.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is GPTs LBA layout look like?

A

LBA 0 stores the Protective MBR
LBA 1 contains the GPTheader, and the GPT header comprises a pointer to the partition table or
Partition Entry Array at LBA 2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

How many bytes does UEFI assign for the Partition entry array?

A

16,384 bytes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Why is LBA 34 the first usable sector?

A

Since the disk has 512-byte sectors with a partition entry array of 16,384 bytes and the minimum size of 128 bytes for each partition entry,

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Protective MBR

A

Helps legacy tools solve compatibility issues when they fail to understand the GPT format.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What are essential Windows System Files?

A 
Ntoskrnl.exe
Ntkrnlpa.exe
Hal.dll
Win32k.sys
Ntdll.dll
Kernel32.dll
Advapi32.dll
User32.dll
Gdi32.dll
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What are the Five phases of UEFI Boot?

A 
SEC - Security
PEI - Pre-EFI Initialization
DXE - Driver Execution Environment
BDS - Boot Device Selection
RT - Run-Time
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Security (SEC) Phase

A

initialization code that the system executes

after powering the EFI system on.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Pre-EFI Initialization (PEI) Phase

A

initializes the CPU, temporary memory,

and boot firmware volume (BFV). Finally, it creates a Hand-Off Block List

28
Q

Driver Execution Environment (DXE) Phase

A

Most of the initialization
happens in this phase. Using the Hand-Off Block List (HOBL), it initializes the entire system physical memory, I/O, and MIMO (Memory Mapped Input Output) resources and finally begins dispatching DXE Drivers present in the system Firmware Volumes (given in the HOBL

29
Q

Boot Device Selection (BDS) Phase

A

interprets the boot configuration data
and selects the Boot Policy for later implementation. In this phase, the system loads MBR boot code into memory for Legacy BIOS Boot or loads the Bootloader program from the EFI partition for UEFI Boot.

30
Q

Run-Time (RT) Phase

A

the system clears the UEFI program from memory

and transfers it to the OS.

31
Q

Get-GPT Command

A

analyze the GUID Partition Table data structure of the hard disk.

32
Q

Get-BootSector Command

A

analyzes the first sector of hard drive and determines the formatting type used and then parses the hard drive GPT.

33
Q

Get-PartitionTable Command

A

analyzes the GUID partition table to find the exact type of boot sector (MBR or GPT) and displays the partition object.

34
Q

MACs that are PowerPC-Based

A

Use firmware to initialize

35
Q

MACs that are Intel Based

A

Use EFI to initialize

36
Q

What are three Stages with the LInux Boot Process?

A

The BIOS Stage
The Bootloader Stage
Kernal Stage

37
Q

What are the three structures within a FAT layout?

A
  1. Reserved Area - 1 sector in size
  2. FAT Area - Contains the FAT Structures
  3. Data Area - Contains the clusters allocates to store files and directory data
38
Q

How large is the FAT Partition Boot Sector?

A

512 Bytes

39
Q

NTFS Flie Systems

A

$attrdef - contains definitions of all system & user-defined attributes of the volume
$badclus - all bad clusters
$bitmap - bitmap for the entire volume
$boot - volume bootstrap
$logfile - used for recovery
$mft - a record for every file
$mftmirr - mirror of $mft used for recovery
$quota - disk quota list for all users
$upcase - converts characters into uppercase UNICODE
$volume - volume name & version number

40
Q

NTFS Boot Sector is assigned to how many sectors?

A

first 16 sectors to the boot sectors and to the bootstrap code

41
Q

What is the NTFS Master File Table?

A
  1. A relational database which consists of information related to the files and the file attributes
  2. The rows consist of file records and the columns consist of file attributes
  3. It has information of every file on the NTFS volume including information about itself
  4. It has 16 records reserved for system files
42
Q

Encryption and EFS

A

NTFS sets a flag for the file after encrypting it and creates an EFS attribute where it stores the Data Decryption Field (DDF) and Data Recovery Field (DRF).

43
Q

Sparse Files

A

A type of file that attempts to use file system space more efficiently when blocks allocated to the file are mostly empty.

44
Q

What is the basic building block of EXT2?

A

INODES are the basic building blocks of the EXT2 File System

45
Q

What is the max file size for EXT4?

A

Maximum file size of 16TB and volume size of 1 Exabyte

46
Q

What Files Systems does MAC use?

A

HFS or HFS+ or UFS

47
Q

Host Protected Area (HPA)

A

the reserved area on a HDD, meant to store data in a way that the user, BIOS, or OS cannot modify, change, or access it. Information about HDD utilities, diagnostic tools, boot sector code, etc. is found here.

48
Q

Device Configuration Overlays (DCO)

A

an additional hidden area which enables system vendors to buy HDDs of varying sizes from different manufacturers and configure all of them to have an equal number of sectors. It can also be used to enable/disable features on the HDD.

49
Q

What tools can you use to detect HPA and DCO on a HDD?

A

Use tools such as EnCase, TAFT (an ATA (IDE) forensics tool), or Sleuth Kit to detect and image HPA and/or DCO areas.

50
Q

ASCII

A

a character encoding standard used in computers. The standard has 128 specified characters coded into 7-bit integers. Source code of a program, batch files, macros, scripts, HTML and XML documents are also ASCII files.

51
Q

UNICODE

A

computing standard, developed along with the Universal Coded Character Set (UCS) standard for encoding, representation, and management of texts. It provides a unique number for every character, irrespective of the platform, program, and language. Unicode contains more than 128,000 characters from about 135 modern and historic scripts.

52
Q

OFFSET

A

Refers to either the start of a file or the start of a memory address. Its value is added to a base address to derive the actual address.

53
Q

What is a Hex Editor?

A

It is a program that allows users to modify the binary data of a file. A hex editor has three display areas including an address area, a hexadecimal area, and a character area.

54
Q

File Carving

A

the process of recovering files from their fragments and pieces from unallocated space of the hard disk in the absence of file system metadata. In computer forensics, it helps investigators to extract data from a storage media without any support of the file system used in creation of the file.

55
Q

Joint Photographic Experts Group (JPEG)

A

It is a method of lossy compression for digital images and allows users to adjust the degree of compression. JPEG files allow compression ratio of 90%, which is one-tenth of the size of the data.

56
Q

JPEG Hex editor code

A

ffd8

57
Q

Bitmap (BMP)

A

BMP images can range from black and white (1 bit per pixel) up to 24 bit color (16.7 million colors.

58
Q

BMP Hex editor code

A

42 4D

59
Q

GIF

A

Each color in the GIF color table is described in RGB values, with each value having a range of 0 to 255.

60
Q

Portable Network Graphics (PNG)

A

a lossless image format intended to replace the GIF and TIFF formats.

61
Q

PNG file hex values begin with?

A

89 50 4e (The Same as GIF)

62
Q

PDF Hex Value

A

25 50 44 46

63
Q

fsstat

A

Display general details of a file system

64
Q

istat

A

Display details of a meta-data structure. Displays the uid, gid, mode, size, link number, modified, accessed, changed times, and all the disk units a structure has allocated.

65
Q

fls

A

List file and directory names in a disk image.

C702 Forensics and Network Intrusion (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions