Quiz 5

Question 1

“Deleting” a file only tells the computer that the space occupied by that file is available if the computer needs it. True or False?

Answer 1

True

Question 2

Unallocated space refers to the data that the computer is using and keeping tab on. These are all the files that we can see and open in Windows. True or False?

Answer 2

False

Question 3

When a computer is in sleep mode and power is reduced, all the data remains in RAM but when a computer hibernates, all of the data in RAM are written to the hard drive. True or False?

Answer 3

True

Question 4

The basic structure of the Windows registry is broken into hives, directories, folders, keys, and files. True or False?

Answer 4

False

Question 5

Each account on a Windows machine is assigned a unique number called a System Information Directory (SID) and many actions on the computer are associated with, and tracked by this. True or False?

Answer 5

False

Question 6

During the print spooling procedure, Windows creates a pair of complimentary files. One is the Enhanced Meta File (EMF) which contains information about the print job. True or False?

Answer 6

False

Question 7

When a Windows user deletes a file, the file is picked up and moved to the recycle bin. This can be done in several ways. Files can be put in the recycle bin via choosing that option from a menu item, dragging/dropping, or a right click on the item and choosing delete. True or False?

Answer 7

False

Question 8

A system can be set to bypass the recycle bin by setting the “Nuke on Delete” value in the registry to “1.” True or False?

Answer 8

True

Question 9

The thumbnails created by Windows to make it easier for a user to browse their pictures remain, even after the original images have been deleted. True or False?

Answer 9

True

Question 10

Restore points and shadow files are the same thing and therefore the same forensic artifact. True or False?

Answer 10

False