WGU D431 FINAL SCRIPT PAPER 2026
VERIFIED SOLUTIONS FULL CONTENT
◉ Good blocks marked as bad
Answer: - Suppose that someone manipulates the file system
metadata to mark unused blocks as bad. The operating system will
no longer access these blocks. These blocks can then be used to hide
data.
◉ File stack
Answer: - the unused space that is created between the end of file
and the end of the last data cluster assigned to a file
◉ Advanced Forensic Format (AFF)
Answer: - stores all data and metadata in a single file
◉ AFM
Answer: - stores the data and the metadata in separate files
◉ AFD
Answer: - stores data and metadata in multiple small files
, ◉ EnCase format
Answer: - a proprietary format that is defined by guidance software
for use in its tool to store hard drive images and individual files
- includes a hash of the file to ensure nothing was changed when it
was copied from the source
◉ Common Forensic Software Programs
Answer: - EnCase from guidance software
- forensic toolkit (FTK)
◉ Forensic Toolkit (FTK)
Answer: - from access data that is very popular with law
enforcement
- can select what hash to use to verify the drive when you copy it ,
which features you want to use on the suspect drive, and how to
search
- useful at cracking passwords
◉ The sleuth kit
VERIFIED SOLUTIONS FULL CONTENT
◉ Good blocks marked as bad
Answer: - Suppose that someone manipulates the file system
metadata to mark unused blocks as bad. The operating system will
no longer access these blocks. These blocks can then be used to hide
data.
◉ File stack
Answer: - the unused space that is created between the end of file
and the end of the last data cluster assigned to a file
◉ Advanced Forensic Format (AFF)
Answer: - stores all data and metadata in a single file
◉ AFM
Answer: - stores the data and the metadata in separate files
◉ AFD
Answer: - stores data and metadata in multiple small files
, ◉ EnCase format
Answer: - a proprietary format that is defined by guidance software
for use in its tool to store hard drive images and individual files
- includes a hash of the file to ensure nothing was changed when it
was copied from the source
◉ Common Forensic Software Programs
Answer: - EnCase from guidance software
- forensic toolkit (FTK)
◉ Forensic Toolkit (FTK)
Answer: - from access data that is very popular with law
enforcement
- can select what hash to use to verify the drive when you copy it ,
which features you want to use on the suspect drive, and how to
search
- useful at cracking passwords
◉ The sleuth kit
