Unlock document.
This document is partially blurred.
Unlock all pages and 1 million more documents.
Get Access
Guide to Computer Forensics and Investigations, 5e, ISBN xxxxxxxxxxxxxxx
Ch. 5 Solutions-1
Chapter 5 Solutions
Review Questions
1. Sectors typically contain how many bytes?
2. What does CHS stand for?
3. Zone bit recording is how manufacturers ensure that the outer tracks store as much
data as possible. True or False?
4. Areal density refers to which of the following?
5. Clusters in Windows always begin numbering at what number?
6. How many sectors are typically in a cluster on a disk drive?
7. List three items stored in the FAT database.
8. What does the Ntuser.dat file contain?
9. In FAT32, a 123 KB file uses how many sectors?
10. What is the space on a drive called when a file is deleted? (Choose all that apply.)
12. What does MFT stand for?
13. In NTFS, files smaller than 512 bytes are stored in the MFT. True or False?
14. In Windows 7 and later, how much data from RAM is loaded into RAM slack on a
disk drive?
15. What’s a virtual cluster number?
Guide to Computer Forensics and Investigations, 5e, ISBN xxxxxxxxxxxxxxx
Ch. 5 Solutions-2
16. Why was EFI boot firmware developed?
17. Device drivers contain what kind of information?
18. Which of the following Windows 8 files contains user-specific information?
19. Virtual machines have which of the following limitations when running on a host
computer?
20. An image of a suspect drive can be loaded on a virtual machine. True or False?
21. EFS can encrypt which of the following?
22. What happens when you copy an encrypted file from an EFS-enabled NTFS disk to a
non-EFS disk or folder?
23. What are the functions of a data run’s field components in an MFT record?
Data runs have three components; the first declares how many bytes are required in the
Hands-On Projects
Hands-On Project 5-1
There should be no difference in the printouts as far as identifying file types. D0CF 11E0 A1B1
Hands-On Project 5-2
Hands-On Project 5-3
It’s important for students to recognize different data types in hexadecimal format. In Chapter 9,
they start data carving, which requires this knowledge.
Hands-On Project 5-4
Guide to Computer Forensics and Investigations, 5e, ISBN xxxxxxxxxxxxxxx
Ch. 5 Solutions-3
Case Projects
Case Project 5-1
Students’ memos should include which OSForensics functions they used to find the e-mail and
password data.
Case Project 5-2
Case Project 5-3
