Which of the following is not true of file carving?
You can perform file carving on the NTFS and FAT32 file system but not Ext4
A(n) __________ is a data structure in the Linux file system that stores all the
information about a file except its name and actual data.
inode
In FAT and NTFS file systems, a __________ is used to map files to specific
clusters where they are stored on the disk.
table
Paige is attempting to recover data from a failed hard disk. She removed the
failed drive from the system on which it was installed and then connected it to a
test system. She made the connection by simply connecting the data and power
cables but did not actually install the failed drive. What step should she perform
next?
Boot the test system from its own internal drive
You are attempting to recover deleted files from a storage device. The device's
operating system uses the FAT32 file system. What is the most important
advantage you have when attempting to recover specific deleted files?
Time; files that were deleted relatively recently are more likely to be recovered
,Which operating system commonly uses the Ext file system?
Linux
________ is the preferred file system of Windows 2000 and later operating
systems.
NTFS
In Windows, what does the file allocation table (FAT) store?
The mapping between files and their cluster location on the hard drive
______ is the basic repair tool in Windows.
Chkdsk
If a hard disk is damaged and the data is deemed "lost," what is the
recommended next step?
Attempt a local repair
A symbolic link is ________ another file.
A pointer to
, Darien is performing analysis on an image of a seized machine. A power outage
causes the computer to power off and back on again. When he attempts to boot
up the machine to continue his work, the Windows operating system begins to
initialize. However, it does not proceed past the loading screen. What type of
damage is likely to have occurred?
Logical damage
______ is the basic repair tool in Mac OS.
Disk Utility
The ________ and the ________ are the two NTFS files of most interest to
forensics efforts.
Master File Table (MFT), cluster bitmap
You are a forensic examiner. The logical structure of a hard disk that you are
analyzing appears almost destroyed. You are not able to get the system to boot
up despite your best efforts. You choose to perform a zero-knowledge analysis.
Is this an appropriate choice for the next step?
Yes. Using this technique, the file system is rebuilt from scratch using knowledge
of an undamaged file system structure. It should allow for data retrieval.
Devaki is a new forensic investigator. She is examining a recently seized hard
drive. She was told by the individuals who collected the device that the owner
indicated that it did not work. Devaki notices some damage on the case of the
hard drive, agrees that it likely does not work, and processes the disk as if it is
"lost" or inaccessible. What mistake did Devaki make?
The benefits of buying summaries with Stuvia:
Guaranteed quality through customer reviews
Stuvia customers have reviewed more than 700,000 summaries. This how you know that you are buying the best documents.
Quick and easy check-out
You can quickly pay through credit card or Stuvia-credit for the summaries. There is no membership needed.
Focus on what matters
Your fellow students write the study notes themselves, which is why the documents are always reliable and up-to-date. This ensures you quickly get to the core!
Frequently asked questions
What do I get when I buy this document?
You get a PDF, available immediately after your purchase. The purchased document is accessible anytime, anywhere and indefinitely through your profile.
Satisfaction guarantee: how does it work?
Our satisfaction guarantee ensures that you always find a study document that suits you well. You fill out a form, and our customer service team takes care of the rest.
Who am I buying these notes from?
Stuvia is a marketplace, so you are not buying this document from us, but from seller TUTORSON. Stuvia facilitates payment to the seller.
Will I be stuck with a subscription?
No, you only buy these notes for $12.99. You're not tied to anything after your purchase.
