Computer Forensics - Exam 1 questions with accurate
answers
A revised High Sierra standard by the International Organization for
Standardization Ans✓✓✓ISO 9660
A volume that can store up to 4,084 clusters Ans✓✓✓FAT 12
CD's use the same file system as flash drives. Ans✓✓✓False
Comes in 3 versions Ans✓✓✓FAT
FAT 16 can have up to 65,624 clusters. Ans✓✓✓FALSE
FAT12 Ans✓✓✓A version of the FAT file system for very small drives
—mainly for floppy drives, using a 12-bit file allocation table.
FAT16 Ans✓✓✓A version of the FAT file system used by MS-DOS
for hard drives, using a 16-bit file allocation table.
FAT32 Ans✓✓✓A version of the FAT file system used by hard drives
and some flash drives (thumb drives, etc.), using a 32-bit file allocation
table.
First sector of the logical volume Ans✓✓✓VBR
, How can you identify end of file? Ans✓✓✓FFFF
How do you secure the scene? Ans✓✓✓Two teams are designated to
secure the scene.
The Security Team establishes a secure perimeter, and the Search Team
conducts the actual search.
How to determine if the partition is active or not? Ans✓✓✓The first
byte will determine if active or not. Hex 80 denotes active partition.
How to get # of bytes? Ans✓✓✓must multiply # of sectors by 512 = #
bytes
How to get # of sectors? Ans✓✓✓must Divide # of bytes by 512 = #
sectors
How would you create a boot disk? Ans✓✓✓Start by creating a disk
that does not interact with the C: drive at all. Typically boot floppy
drives have the command.com file that will call what we need. The
IO.SYS loads itself into memory long with device drivers.
Involves recovering information from a computer that was deleted by
mistake or lost during a power surge Ans✓✓✓Data Recovery
answers
A revised High Sierra standard by the International Organization for
Standardization Ans✓✓✓ISO 9660
A volume that can store up to 4,084 clusters Ans✓✓✓FAT 12
CD's use the same file system as flash drives. Ans✓✓✓False
Comes in 3 versions Ans✓✓✓FAT
FAT 16 can have up to 65,624 clusters. Ans✓✓✓FALSE
FAT12 Ans✓✓✓A version of the FAT file system for very small drives
—mainly for floppy drives, using a 12-bit file allocation table.
FAT16 Ans✓✓✓A version of the FAT file system used by MS-DOS
for hard drives, using a 16-bit file allocation table.
FAT32 Ans✓✓✓A version of the FAT file system used by hard drives
and some flash drives (thumb drives, etc.), using a 32-bit file allocation
table.
First sector of the logical volume Ans✓✓✓VBR
, How can you identify end of file? Ans✓✓✓FFFF
How do you secure the scene? Ans✓✓✓Two teams are designated to
secure the scene.
The Security Team establishes a secure perimeter, and the Search Team
conducts the actual search.
How to determine if the partition is active or not? Ans✓✓✓The first
byte will determine if active or not. Hex 80 denotes active partition.
How to get # of bytes? Ans✓✓✓must multiply # of sectors by 512 = #
bytes
How to get # of sectors? Ans✓✓✓must Divide # of bytes by 512 = #
sectors
How would you create a boot disk? Ans✓✓✓Start by creating a disk
that does not interact with the C: drive at all. Typically boot floppy
drives have the command.com file that will call what we need. The
IO.SYS loads itself into memory long with device drivers.
Involves recovering information from a computer that was deleted by
mistake or lost during a power surge Ans✓✓✓Data Recovery
