Guide to Computer Forensics and Investigations, 5th Edition,
Ch. 7 Solutions-1
Chapter 7 Solutions
Review Questions
1. Explain the differences in resource and data forks used in the Mac OS.
2. Which of the following is the main challenge in acquiring an image of a Mac
system? (Choose all that apply.)
3. To recover a password on a Mac system, which tool do you use?
4. What are the major improvements in the Linux Ext4 file system?
5. How does the Mac OS reduce file fragmentation?
6. Linux is the only OS that has a kernel. True or False?
7. Hard links work in only one partition or volume. True or False?
8. Which of the following Linux system files contains hashed passwords for the local
system?
9. Which of the following describes the superblock’s function in the Linux file system?
10. What’s the Disk Arbitration feature used for in Mac OS X?
11. In Linux, which of the following is the home directory for the superuser?
12. Which of the following certifies when an OS meets UNIX requirements?
13. On most Linux systems, current user login information is in which of the following
locations?
Guide to Computer Forensics and Investigations, 5th Edition,
Ch. 7 Solutions-2
14. Hard links are associated with which of the following?
15. Which of the following describes plist files? (Choose all that apply.)
16. Data blocks contain actual files and directories and are linked directly to inodes. True
or False?
Hands-On Projects
Hands-On Project 7-1
Students should find that they can mount drives and do full forensics examinations with this tool
as a live DVD. They should also note available mobile and network forensics tools.
Hands-On Project 7-2
This project gives students experience in figuring out how to use a tool that has little
documentation. When converting an image file from the ProDiscover .eve format to the raw
Hands-On Project 7-3
This project gives students more practice in using Sleuth Kit and Autopsy and adding to their user
manuals.
Case Projects
Case Project 7-1
Case Project 7-2