Professional Documents
Culture Documents
PDF Test Bank For Guide To Computer Forensics and Investigations 5Th Edition Online Ebook Full Chapter
PDF Test Bank For Guide To Computer Forensics and Investigations 5Th Edition Online Ebook Full Chapter
http://testbankbell.com/product/solution-manual-for-guide-to-
computer-forensics-and-investigations-5th-edition/
http://testbankbell.com/product/test-bank-for-computer-forensics-
and-cyber-crime-an-introduction-3rd-edition-marjie-t-britz-
download/
http://testbankbell.com/product/test-bank-for-computer-literacy-
basics-a-comprehensive-guide-to-ic3-2nd-edition/
http://testbankbell.com/product/test-bank-for-biology-concepts-
and-investigations-5th-edition-marielle-hoefnagels/
Test Bank for Guide to Oracle 10g, 5th Edition:
Morrison
http://testbankbell.com/product/test-bank-for-guide-to-
oracle-10g-5th-edition-morrison/
http://testbankbell.com/product/a-guide-to-crisis-
intervention-5th-edition-kanel-test-bank/
http://testbankbell.com/product/test-bank-for-linux-and-
lpic-1-guide-to-linux-certification-5th-edition-jason-eckert/
http://testbankbell.com/product/solution-manual-for-linux-and-
lpic-1-guide-to-linux-certification-5th-edition-jason-eckert/
http://testbankbell.com/product/test-bank-for-guide-to-firewalls-
and-vpns-3rd-edition/
Test Bank for Guide to Computer Forensics and Investigations, 5th Edition
TRUE/FALSE
1. The type of file system an OS uses determines how data is stored on the disk.
2. One way to examine a partition’s physical level is to use a disk editor, such as Norton DiskEdit,
WinHex, or Hex Workshop.
3. As data is added, the MFT can expand to take up 75% of the NTFS disk.
4. The first 5 bytes (characters) for all MFT records are MFTR0.
MULTIPLE CHOICE
2. ____ is how most manufacturers deal with a platter’s inner tracks being shorter than its outer tracks.
a. Head skew c. ZBR
b. Cylinder skew d. Areal density
ANS: C PTS: 1 REF: 210|211
3. ____ refers to the number of bits in one square inch of a disk platter.
a. Head skew c. Cylinder skew
b. Areal density d. ZBR
ANS: B PTS: 1 REF: 212
4. ____ is the file structure database that Microsoft originally designed for floppy disks.
a. NTFS c. VFAT
b. FAT32 d. FAT
ANS: D PTS: 1 REF: 216
5. ____ was introduced when Microsoft created Windows NT and is the primary file system for
Windows Vista.
a. FAT32 c. NTFS
b. VFAT d. HPFS
ANS: C PTS: 1 REF: 220
6. On an NTFS disk, immediately after the Partition Boot Sector is the ____.
a. FAT c. MBR
b. HPFS d. MFT
ANS: D PTS: 1 REF: 220
8. In the NTFS MFT, all files and folders are stored in separate records of ____ bytes each.
a. 1024 c. 2048
b. 1512 d. 2512
ANS: A PTS: 1 REF: 222
9. The file or folder’s MFT record provides cluster addresses where the file is stored on the drive’s
partition. These cluster addresses are referred to as ____.
a. virtual runs c. metaruns
b. metada d. data runs
ANS: D PTS: 1 REF: 222
10. When Microsoft introduced Windows 2000, it added built-in encryption to NTFS called ____.
a. EFS c. LZH
b. VFAT d. RAR
ANS: A PTS: 1 REF: 228
11. The purpose of the ____ is to provide a mechanism for recovering encrypted files under EFS if there’s
a problem with the user’s original private key.
a. certificate escrow c. administrator certificate
b. recovery certificate d. root certificate
ANS: B PTS: 1 REF: 228
12. When Microsoft created Windows 95, it consolidated initialization (.ini) files into the ____.
a. IniRecord c. Registry
b. Inidata d. Metadata
ANS: C PTS: 1 REF: 232
13. ____, located in the root folder of the system partition, specifies the Windows XP path installation and
contains options for selecting the Windows version.
a. Boot.ini c. NTDetect.com
b. BootSec.dos d. NTBootdd.sys
ANS: A PTS: 1 REF: 241
14. ____ is a 16-bit real-mode program that queries the system for device and configuration data, and then
passes its findings to NTLDR.
a. Hal.dll c. NTDetect.com
b. Boot.ini d. BootSect.dos
ANS: C PTS: 1 REF: 241
15. ____, located in the root folder of the system partition, is the device driver that allows the OS to
communicate with SCSI or ATA drives that aren’t related to the BIOS.
a. Hal.dll c. Boot.ini
b. NTBootdd.sys d. Ntoskrnl.exe
ANS: B PTS: 1 REF: 242
16. ____ contain instructions for the OS for hardware devices, such as the keyboard, mouse, and video
card, and are stored in the %system-root%\Windows\System32\Drivers folder.
a. Hal.dll c. Ntoskrnl.exe
b. Pagefile.sys d. Device drivers
ANS: D PTS: 1 REF: 242
17. ____ is a hidden text file containing startup options for Windows 9x.
a. Pagefile.sys c. Msdos.sys
b. Hal.dll d. Ntoskrnl.exe
ANS: C PTS: 1 REF: 244
18. The ____ file provides a command prompt when booting to MS-DOS mode (DPMI).
a. Io.sys c. Config.sys
b. Autoexec.bat d. Command.com
ANS: D PTS: 1 REF: 244
19. ____ is a text file containing commands that typically run only at system startup to enhance the
computer’s DOS configuration.
a. Autoexec.bat c. BootSect.dos
b. Config.sys d. Io.sys
ANS: B PTS: 1 REF: 245
20. ____ is a batch file containing customized settings for MS-DOS that runs automatically.
a. Autoexec.bat c. Io.sys
b. Config.sys d. Command.com
ANS: A PTS: 1 REF: 245
21. A ____ allows you to create a representation of another computer on an existing physical computer.
a. virtual file c. logic machine
b. logic drive d. virtual machine
ANS: D PTS: 1 REF: 246
COMPLETION
2. In Microsoft file structures, sectors are grouped to form ____________________, which are storage
allocation units of one or more sectors.
ANS: clusters
3. On Windows and DOS computer systems, the ____________________ stores information about
partitions on a disk and their locations, size, and other important items.
ANS:
Master Boot Record (MBR)
Master Boot Record
MBR
MBR (Master Boot Record)
4. Drive slack includes RAM slack (found primarily in older Microsoft OSs) and
____________________ slack.
ANS: file
5. On an NTFS disk, the first data set is the ____________________, which starts at sector [0] of the
disk.
MATCHING
SHORT ANSWER
1. How can you make sure a subject’s computer boots to a forensic floppy disk or CD?
ANS:
When a subject’s computer starts, you must make sure it boots to a forensic floppy disk or CD,
because booting to the hard disk overwrites and changes evidentiary data. To do this, you access the
CMOS setup by monitoring the subject’s computer during the initial bootstrap process to identify the
correct key or keys to use. The bootstrap process is contained in ROM and tells the computer how to
proceed. As the computer starts, the screen usually displays the key or keys, such as the Delete key,
you press to open the CMOS setup screen. You can also try unhooking the keyboard to force the
system to tell you what keys to use. The key you press to access CMOS depends on the computer’s
BIOS.
If necessary, you can change the boot sequence so that the OS accesses the CD/DVD drive or a floppy
drive (if available) before any other boot device. Each BIOS vendor’s screen is different, but you can
refer to the vendor’s documentation or Web site for instructions on changing the boot sequence.
ANS:
Following is a list of disk drive components:
* Geometry—Geometry refers to a disk’s structure of platters, tracks, and sectors.
* Head—The head is the device that reads and writes data to a drive. There’s one head per platter.
* Tracks—Tracks are concentric circles on a disk platter where data is located.
* Cylinders—A cylinder is a column of tracks on two or more disk platters. Typically, each platter has
two surfaces: top and bottom.
* Sectors—A sector is a section on a track, usually made up of 512 bytes.
ANS:
Clusters are numbered sequentially starting at 2 because the first sector of all disks contains a system
area, the boot record, and a file structure database. The OS assigns these cluster numbers, which are
referred to as logical addresses. These addresses point to relative cluster positions; for example, cluster
address 100 is 98 clusters from cluster address 2. Sector numbers,however, are referred to as physical
addresses because they reside at the hardware or firmware level and go from address 0 to the last
sector on the disk. Clusters and their addresses are specific to a logical disk drive, which is a disk
partition.
ANS:
The following list summarizes the evolution of FAT versions:
* FAT12—This version is used specifically for floppy disks, so it has a limited amount of storage
space. It was originally designed for MS-DOS 1.0, the first Microsoft OS, used for floppy disk drives
and drives up to 16 MB.
* FAT16—To handle large disks, Microsoft developed FAT16, which is still used on older Microsoft
OSs, such as MS-DOS 3.0 through 6.22, Windows 95 (first release), and Windows NT 3.5 and 4.0.
FAT16 supports disk partitions with a maximum storage capacity of 2 GB.
* FAT32—When disk technology improved and disks larger than 2 GB were created, Microsoft
developed FAT32, which is used on Microsoft OSs such as Windows 95 (second release), 98,Me,
2000, and XP. FAT32 can access up to 2TB of disk storage.One disk can have multiple partitions in
FAT16, FAT32, or NTFS.
ANS:
When a file is deleted in Windows Explorer or with the MS-DOS Delete command,the OS inserts a
HEX E5 (0xE5), which many hex-editing programs reflect as the lowercase Greek letter sigma () in
the filename’s first letter position in the FAT database. The sigma symbol tells the OS that the file is
no longer available and a new file can be written to the same cluster location.
In Microsoft OSs, when a file is deleted, the only modifications made are that the directory entry is
marked as a deleted file, with the HEX E5 character replacing the first letter of the filename, and the
FAT chain for that file is set to 0. The data in the file remains on the disk drive. The area of the disk
where the deleted file resides becomes unallocated disk space (also called “free disk space”). The
unallocated disk space is now available to receive new data from newly created files or other files
needing more space as they grow. Most forensics tools recover any data still residing in this area.
ANS:
To understand how data runs are assigned for nonresident MFT records, you should know that when a
disk is created as an NTFS file structure, the OS assigns logical clusters to the entire disk partition.
These assigned clusters are called logical cluster numbers (LCNs). LCNs become the addresses that
allow the MFT to link to nonresident files (files outside the MFT) on the disk’s partition.
ANS:
To improve data storage on disk drives, NTFS provides compression similar to FAT DriveSpace 3, a
Windows 98 compression utility. Under NTFS, files, folders, or entire volumes can be
compressed.With FAT16, you can compress only a volume.On a Windows Vista, XP, 2000, or NT
system, compressed data is displayed normally when you view it in Windows Explorer or applications
such as Microsoft Word.
During an investigation, typically you work from an image of a compressed disk, folder, or file. Most
computer forensics tools can uncompress and analyze compressed Windows data, including data
compressed with the Lempel-Ziv-Huffman (LZH) algorithm and in formats such as PKZip,WinZip,
and GNU gzip. Forensics tools might have difficulty with third-party compression utilities, such as the
RAR format. If you identify third-party compressed data, you need to uncompress it with the utility
that created it.
8. What are some of the features offered by current whole disk encryption tools?
ANS:
Current whole disk encryption tools offer the following features that computer forensics examiners
should be aware of:
* Preboot authentication, such as a single sign-on password, fingerprint scan, or token (USB thumb
drive device)
* Full or partial disk encryption with secure hibernation, such as activating a password-protected
screen saver
* Advanced encryption algorithms, such as AES and IDEA
* Key management function that uses a challenge-and-response method to reset passwords or
passphrases
* A Trusted Platform Module (TPM) microchip to generate encryption keys and authenticate logins
ANS:
BitLocker’s current hardware and software requirements are as follows:
* A computer capable of running Windows Vista
* The TPM microchip, version 1.2 or newer
* A computer BIOS compliant with Trusted Computing Group (TCG)
* Two NTFS partitions for the OS and an active system volume with 1.5 GB of available space
* The BIOS configured so that the hard drive boots first before checking the CD/DVD drive or other
bootable peripherals
10. Describe some of the open source whole disk encryption tools.
ANS:
The following list describes some available open-source encryption tools:
* TrueCrypt (www.truecrypt.org) creates a virtual encrypted volume—a file mounted as though it were
a disk drive. Data is encrypted automatically and in real time.
Test Bank for Guide to Computer Forensics and Investigations, 5th Edition
* CrossCrypt (www.scherrer.cc/crypt/) also creates a virtual encrypted volume and provides filedisk, a
command-line utility with options for creating, mounting, dismounting, and encrypting volumes.
* FreeOTFE (on-the-fly encryption, www.freeotfe.org), like other open-source encryption tools,
creates a virtual disk that can encrypt data with several popular algorithms. FreeOTFE can be used in
Windows 2000 and XP as well as with PDAs.
The Cork Clips Hold the Bromide Print in the Water in a Vertical Position
Shortening a Box by Bending Up the Bottom after Removing the End and
Cutting Down the Sides
Fig. 1
Fig. 2
Fix the Loosened Spring into Place and the Roller Is in Working Order
Many devices have been made for developing and fixing roll films.
There is the simple wholesale method of the professional who
hangs a weight on one end of the film and lets it down in a deep tank
of developing fluid where it hangs submerged from an upper support
until the development is complete. Then the support, the film, and
attached weight are removed, dipped into a similar tank of running
water, then to another tank of fixing solution, and subsequently
washed and dried.
This is the only practical plan where there are many such films to
be handled simultaneously, but the amateur who has only one or two
rolls a week cannot afford the tanks, the space, nor the expense
incident to such a method. The film is usually drawn back and forth
through a developing solution placed in a tray, and after the
development has proceeded far enough, the same process used in
washing, then the hypo solution, and finally through the last washing
for about 20 minutes, all making a tedious process.
Some amateurs and a few professionals who but occasionally
develop roll film use a mechanical device that rolls the film into a
light-proof package which is inserted in a metal tank for development
and subsequent fixation. This is a standard process, the apparatus
being on sale at all supply houses, but it has its drawbacks.
The following method is not only simple but perfect in its operation
and requires no special apparatus, only a tumbler or lemonade
glass, and an ordinary lead pencil for its operation. A glass rod is
preferable to the lead pencil, and it is also convenient to have a deep
tin cup, or similar device, to cover up the lemonade glass and make
it light-proof, should it be desirable to turn on the white light in the
dark room.
Pour enough developing solution into the glass tumbler to cover
completely the roll of film when it is standing on end. In the dark
room open the film roll, remove the backing paper and the paper
ends on the film, run it through clear water until it is thoroughly and
uniformly wetted from end to end, and drop it endwise into the
tumbler of developer. Immediately insert the pencil or glass rod into
the center of the roll, and with a rather quick circular motion, move
the rod around so that it will quickly pass between the several
convolutions of the film and thus distribute the developer all over its
surface. Repeat this operation at once, then again in a few seconds,
then in 15 or 20 seconds, then in 30 seconds, then in 1 minute, and
so on, with greater intervals of time. If a 20-minute developer is
used, it will only be necessary, at the latter part of the development,
to separate the layers every 2 or 3 minutes.
When the development is complete, pour off the solution and rinse
in the same glass by letting water run through it while passing the
pencil or glass rod between the layers several times. The water may
then be drained off, and the glass filled with the fixing solution. While
the film is fixing, the glass rod should be passed between the layers
several times to renew the solution in contact with the film.
It will be seen that at no time after the first washing is it necessary
to handle the film, so that damage to the film and staining the fingers
are entirely eliminated. Further than that, no apparatus is tied up in
the operation, and if a light-proof cup is at hand, the developing
tumbler may be covered between the operations of separating the
layers of film, and the white light of the dark room can be turned on
for further operations.
Swinging Bags on the Arms of a Scarecrow
Scarecrow with Swinging Paper Bags on the Arms in the Place of Hands