Guide to Computer Forensics and Investigations 5th edition Bill Test Bank instant download
Guide to Computer Forensics and Investigations 5th edition Bill Test Bank instant download
https://testbankdeal.com/product/guide-to-computer-forensics-and-
investigations-5th-edition-bill-test-bank/
https://testbankdeal.com/product/guide-to-computer-forensics-and-
investigations-5th-edition-nelson-solutions-manual/
https://testbankdeal.com/product/guide-to-computer-forensics-and-
investigations-4th-edition-nelson-solutions-manual/
https://testbankdeal.com/product/computer-forensics-principles-and-
practices-1st-edition-volonino-test-bank/
https://testbankdeal.com/product/industrial-relations-in-canada-2nd-
edition-hebdon-test-bank/
Mosbys Essentials for Nursing Assistants 4th Edition
Sorrentino Test Bank
https://testbankdeal.com/product/mosbys-essentials-for-nursing-
assistants-4th-edition-sorrentino-test-bank/
https://testbankdeal.com/product/juvenile-delinquency-in-a-diverse-
society-2nd-edition-bates-test-bank/
https://testbankdeal.com/product/excel-modeling-in-corporate-
finance-5th-edition-holden-solutions-manual/
https://testbankdeal.com/product/infants-children-and-adolescents-8th-
edition-berk-test-bank/
https://testbankdeal.com/product/cost-accounting-a-managerial-
emphasis-canadian-7th-edition-horngren-solutions-manual/
Sociology and Your Life With POWER Learning 1st Edition
Schaefer Test Bank
https://testbankdeal.com/product/sociology-and-your-life-with-power-
learning-1st-edition-schaefer-test-bank/
Name: Class: Date:
chapter 7
1. Capitalization, or lack thereof, makes no difference with UNIX and Linux commands.
a. True
b. False
3. The term "kernel" is often used when discussing Linux because technically, Linus is only the core of the OS.
a. True
b. False
5. The only pieces of metadata not in an inode are the filename and path.
a. True
b. False
Indicate the answer choice that best completes the statement or answers the question.
7. What file under the /etc folder contains the hashed passwords for a local system?
a. passwd
b. hashes
c. shadow
d. users
8. What type of block does a UNIX/Linux computer only have one of?
a. boot block
b. data block
c. inode block
d. superblock
9. What file is used to store any file information that is not in the MDB or a VCB?
a. page file
b. metadata database file
Copyright Cengage Learning. Powered by Cognero. Page 1
Name: Class: Date:
chapter 7
c. slack file
d. extents overflow file
10. Adding the _____________ flag to the ls -l command has the effect of of showing all files beginning with the "."
character in addition to other files.
a. -s
b. -d
c. -l
d. -a
12. Select below the command that can be used to display bad block information on a Linux file system, but also has the
capability to destroy valuable information.
a. dd
b. fdisk
c. badblocks
d. mke2fs
14. As part of a forensics investigation, you need to recover the logon and logoff history information on a Linux based
OS. Where can this information be found?
a. /var/log/utmp
b. /var/log/wtmp
c. /var/log/userlog
d. /var/log/system.log
15. In a B*-tree file system, what node stores link information to previous and next nodes?
a. inode
b. header node
c. index node
d. map node
chapter 7
c. ln -l
d. ls -h
19. On Mac OS X systems, what utility can be used to encrypt / decrypt a user's home directory?
a. Disk Utility
b. BitLocker
c. FileVault
d. iCrypt
20. ________________ is a specialized carving tool that can read many image file formats, such as RAW and Expert
Witness.
a. AccessData FTK
b. X-Ways Forensics
c. Guidance Software EnCase
d. Foremost
21. ________________ contain file and directory metadata and provide a mechanism for linking data stored in data
blocks.
a. Blocks
b. Clusters
c. Inodes
d. Plist files
22. A hash that begins with "$6" in the shadow file indicates that it is a hash from what hashing algorithm?
a. MD5
b. Blowfish
c. SHA-1
d. SHA-512
23. Where is the root user's home directory located on a Mac OS X file system?
a. /root
b. /private/var/root
c. /private/spool/root
Copyright Cengage Learning. Powered by Cognero. Page 3
Name: Class: Date:
chapter 7
d. /home/root
24. Within the /etc/shadow file, what field contains the password hash for a user account if one exists?
a. 1st field
b. 2nd field
c. 3rd field
d. 4th field
26. An assigned inode has _____ pointers that link to data blocks and other pointers where files are stored.
27. Since Mac OS 8.6, _______________ have been available for use in managing passwords for applications, web sites,
and other system files.
28. ________ links are simply pointers to other files and aren't included in the link count.
29. With Linux commands, arguments consisting of multiple letters must be preceded by two ___________ characters
instead of one and can't be grouped together.
30. The _____________ is the listing of all files and directories on a volume and is used to maintain relationships between
files and directories on a volume.
31. In the Mac file system, a group of consecutive logical blocks assembled in a volume when a file is saved.
33. A Mac file that organizes the directory hierarchy and file block mapping for File Manager.
34. The part of a Mac file containing file metadata and application information, such as menus, dialog boxes, icons,
executable code, and controls. Also contains resource map and header information, window locations, and icons.
35. The part of a Mac file containing the file's actual data, both user-created data and data written by applications, as well
Copyright Cengage Learning. Powered by Cognero. Page 4
Name: Class: Date:
chapter 7
as a resouce map and header information, window locations, and icons.
36. In the Mac file system, a collection of data that can't exceed 512 bytes. Assembled in allocation blocks to store files in
a volume.
37. A key part of the Linux file system, these informatuin nodes contain descriptive file or directory data, such as UIDS,
GIDs, modification times, access times, creation times, and file locations.
38. A block in the Linux file system that specifies and keep tracks of the disk geometry and available space and manages
the file system.
39. A block in the Linux file system where directories and files are stored on a drive.
40. An area of the Mac file system containing information from the Master Directory Block.
41. Linux supports a wide range of file systems. Distinguish the three Extended File Systems of Linux.
42. What are bad blocks, and how do you find them?
43. UNIX and Linux have four components defining the file system. Identify and give a brief description of each.
44. As you’ve learned, Linux commands use options to create variations of a command. Describe the rules for grouping
letter arguments.
46. Compare and contrast the data fork and resource fork of a Mac file.
47. After making an acquisition on a Mac computer, the next step is examining the image of the file system with a
forensics tool. Explain how to select the proper forensics tool for the task.
48. Explain why one should have Apple factory training before attempting an acquisition on a Mac computer.
49. Explain the differences between a hard link and a symbolic link.
chapter 7
Answer Key
1. False
2. False
3. True
4. False
5. True
6. b
7. c
8. a
9. d
10. d
11. a
12. c
13. c
14. b
15. c
16. a
17. c
18. b
19. c
20. d
21. c
22. a
23. b
24. b
25. d
Copyright Cengage Learning. Powered by Cognero. Page 6
Name: Class: Date:
chapter 7
26. 13
27. keychains
28. Symbolic
29. -
30. catalog
31. f
32. g
33. a
34. j
35. h
36. c
37. d
38. i
39. b
40. e
41. Linux supports a wide range of file systems. The early standard was Second Extended File System (Ext2), and then
Third Extended File System (Ext3) replaced Ext2 in most Linux dis- tributions. Its major difference from Ext2 was being
a journaling file system, which has a built-in file recovery mechanism used after a crash.
A few years later, Fourth Extended File System (Ext4) was introduced. Among other features, it added support for
partitions larger than 16 TB, improved management of large files, and offered a more flexible approach to adding file
system features. Because these changes affected the way the Linux kernel interacts with the file system, adoption of Ext4
was slower in some Linux distributions, but it’s now considered the standard file system for most distri- butions. The
Ubuntu version you used previously, for example, has an Ext4 partition at its core, unless you select another file system
during installation.
42. All disks have more storage capacity than the manufacturer states. For example, a 240 GB disk might actually have
240.5 GB free space because disks always have bad sectors. Windows doesn’t keep track of bad sectors, but Linux does in
an inode called the bad block inode. The root inode is inode 2, and the bad block inode is inode 1. Some forensics tools
ignore inode 1 and fail to recover valuable data for cases. Someone trying to mislead an investigator can access the bad
block inode, list good sectors in it, and then hide information in these supposedly “bad” sectors.
To find bad blocks on your Linux computer, you can use the badblocks command, although you must log in as root to
do so. Linux includes two other commands that supply bad block information: mke2fs and e2fsck. The badblocks
command can destroy valuable data, but the mke2fs and e2fsck commands include safeguards that prevent them from
chapter 7
overwriting important information.
43. UNIX/Linux has four components defining the file system: boot block, superblock, inode block, and data block.
The boot block contains the bootstrap code--instructions for startup.
The superblock contains vital information about the system and is considered part of the metadata.It specifies the disk
geometry and available space and keeps track of all inodes. It also manages the file system, including configuration
information, such as block size for the drive, file system names, blocks reserved for inodesm and volume name.
Inode blocks contain the first data after the superblock. An inode is assigned to every file allocation unit. As files or
directories are created or deleted, inodes are also created or deleted.
The data block is where directories and files are stored on a disk drive. This location is linked directly to inodes. A data
block is equivalent to a cluster of disk sectors on a FAT or NTFS volume.
44. Linux commands use options to create variations of a command. There’s no difference between grouping letter
arguments (such as l and a) after a single - or entering them separately. Therefore, ls -la functions the same as ls -
l -a. Arguments consisting of multiple letters must be preceded by two -- characters instead of one and can’t be
grouped together, as in ls --all.
45. A tarball is a highly compressed data file containing one or more files or directories and their contents. It's similar to
Windows zip utilitied and typically has a .tar or .gz extension.
46. In Mac, a file consists of two parts: a data fork, where data is stored, and a resource fork, where file metadata and
application information are stored. Both forks contain the following essential information for each file:
-Resource Map
-Resource header information for each file
-Windows location
-Icons
The data fork typically contains data the user creates, such as text or sprreadsheets. Applications, such as Microsoft Word
or Excel, also read and write to the data fork.
When you're working with an application file, the resource fork contains additional information, such as menus, dialog
boxes, icons, executable code, and controls.
47. After making an acquisition, the next step is examining the image of the file system with a forensics tool. The tool you
use depends on the image file’s format. For example, if you used EnCase, FTK, or X-Ways Forensics to create an Expert
Witness (.e0l) image, you must use one of these tools to analyze the image. If you made a raw format image, you can use
any of the following tools:
• BlackBag Technologies Macintosh Forensic Software (OS X only)
• SubRosaSoft MacForensicsLab (OS X only)
• Guidance Software EnCase
• X-Ways Forensics
• AccessData FTK
48. To examine a Mac computer, you need to make an image of the drive, using the same techniques described in Chapter
5. You should be aware of some exceptions, however, caused by Mac design and engineering. (In addition, removing the
drive from a Mac Mini case is difficult, and attempting to do so without Apple factory training could damage the
computer. A MacBook Air poses similar problems, as you need special Apple screwdrivers to open the case.) You need a
Mac-compatible forensic boot CD/DVD to make an image, which then must be written to an external drive, such as a
FireWire or USB drive. Larger Macs are constructed much like desktop PCs, making removal of the hard drive easier.
chapter 7
49. A hard link is a pointer that allows accessing the same file by different filenames. The filenames refer to the same
inode and physical location on a drive, and increases the link count within the file's inode. A symbolic link is simply a
pointer to other files, and does not increase the link count. Symbolic links have their own inodes, and can be used to point
to files on other drives or on remote network locations.
50. Plist files are preference files for installed applications on a system, usually stored in /Library/Preferences.
These files can exist in plain XML form, or binary form, which consists of condensed XML.
testbankdeal.com