Digital Forensics in Cybersecurity - C840 Q&A 2022/2023

FAT - Answer- Stores file locations by sector in a file called the file allocation table. This table contains information about which clusters are being used by which particular files and which clusters are free to be used. NTFS (New Technology File System) - Answer- File system used by Windows NT 4, 2000, XP, Vista, 7, Server 2003, and Server 2008. One major improvement of this system was the increased volume sizes. Extended file system - Answer- System created specifically for Linux. There have been many versions; the current version is 4. ReiserFS - Answer- Popular journaling file system, used primarily with Linux. It was the first file system to be included with the standard Linux kernel, and first appeared in kernel version 2.4.1. The Berkeley Fast File System - Answer- This is also known as the UNIX file system. Uses a bitmap to track free clusters, indicating which clusters are available and which are not. Data hiding - Answer- Storage of data where an investigator is unlikely to find it. Data transformation - Answer- Disguising the meaning of information. Data contraception - Answer- Storage of data where a forensic specialist cannot analyze it. Data fabrication - Answer- Uses false positives and false leads extensively. File system alteration - Answer- Corruption of data structures and files that organize data. Daubert standard - Answer- Any scientific evidence presented in a trial has to have been reviewed and tested by the relevant scientific community. For a computer forensics investigator, that means that any tools, techniques, or processes you utilize in your investigation should be ones that are widely accepted in the computer forensics community. You cannot simply make up new tests or procedures. (1) whether the theory or technique in question can be and has been tested; (2) whether it has been subjected to peer review and publication; (3) its known or potential error rate; (4) the existence and maintenance of standards controlling its operation; and (5) whether it has attracted widespread acceptance within a relevant scientific community. The Federal Privacy Act of 1974 - Answer- Prohibits unauthorized disclosures of records( about