SANS 500 ACTUAL EXAMS SCRIPT ANSWERS AND
QUESTIONS SET A+
✔✔What are the registry hives? - ✔✔SAM, SYSTEM, SOFTWARE, DEFAULT,
NTUSER.DAT, USRCLASS.DAT
✔✔*.evtx - ✔✔event logs file extension
✔✔*.lnk files - ✔✔link file extension
✔✔*.pf - ✔✔prefetch file extension
✔✔Pagefile.sys - ✔✔Windows pagefile(an extension of RAM)
✔✔KAPE - ✔✔Kroll Artifact Parser and Extractor
✔✔KAPE - ✔✔Primary a triage program that collects files and processes those
collected files with one or more programs
✔✔KAPE Targets - ✔✔Contain a list of file masks that allow for finding various types of
items on a storage device
✔✔KAPE Modules - ✔✔contain information about a program to execute, including
command line arguments, export format etc.
✔✔File Allocation Table (FAT) - ✔✔table that provides a linked list of the clusters a file
is stored inside.
✔✔What does it mean if someone deletes a file? - ✔✔The data still exists on disk and is
fully recoverable until the unallocated space is overwritten
✔✔$MFT - ✔✔Decribes the MFT. Name and information
, ✔✔$MFTMIRR - ✔✔Backup of the $MFT record
✔✔$LOGFILE - ✔✔Transactional logging information used by NTFS to maintain the
integrity of the filesystem in the event of a crash
✔✔$VOLUME - ✔✔Friendly name of volume for display in My Computer. NTFS version
and mount flags
✔✔$ATTRDEF - ✔✔defines NTFS attributes for version on NTFS used on drive.
✔✔$BITMAP - ✔✔long string of binary data, but for each cluster in the volume. Cluster
with corresponding bit will be set to either 1 or 0 depending on the cluster is allocated to
a file. Tracks clusters in used or not.
✔✔$BOOT - ✔✔allows the VBR to be accessed via normal IO operations
✔✔$BADCLUS - ✔✔Tracks bad clusters on the partition.
✔✔$SECURE - ✔✔index used to track security information for the files on the system.
Who owns the file and can open it.
✔✔$UPCASE - ✔✔upper/lowercase Unicode letters
✔✔$EXTEND - ✔✔record number 11 to hold the new system files.
✔✔$EXTEND\$ObjId - ✔✔object IDs contained and used within a drive. Allow a file to
be tracked even if the file gets moved, renamed, or otherwise changed in a way that
would cause a pointer like a link file to be able to find the file
✔✔$EXTEND\$Quota - ✔✔Contains infomration about how much allocated space each
user is allowed to and has consumed on volume, in order for system administrator to
technically prevent a user from using too much disk space.
✔✔$EXTEND\$UsnJrnl - ✔✔change journal, index listing all of the files that have
changed on the system and why the change tool place
✔✔NTFS records four times referring to files/folders: - ✔✔1. Last Modification time of
file data
2. Last access time of file data
3. Last modification of the MFT record
4. File creation time of MFT record in the volume
✔✔Alternate Data Streams(ADS) - ✔✔alternative content for a file that exists by
creating additional data pointers within the same NTFS file
QUESTIONS SET A+
✔✔What are the registry hives? - ✔✔SAM, SYSTEM, SOFTWARE, DEFAULT,
NTUSER.DAT, USRCLASS.DAT
✔✔*.evtx - ✔✔event logs file extension
✔✔*.lnk files - ✔✔link file extension
✔✔*.pf - ✔✔prefetch file extension
✔✔Pagefile.sys - ✔✔Windows pagefile(an extension of RAM)
✔✔KAPE - ✔✔Kroll Artifact Parser and Extractor
✔✔KAPE - ✔✔Primary a triage program that collects files and processes those
collected files with one or more programs
✔✔KAPE Targets - ✔✔Contain a list of file masks that allow for finding various types of
items on a storage device
✔✔KAPE Modules - ✔✔contain information about a program to execute, including
command line arguments, export format etc.
✔✔File Allocation Table (FAT) - ✔✔table that provides a linked list of the clusters a file
is stored inside.
✔✔What does it mean if someone deletes a file? - ✔✔The data still exists on disk and is
fully recoverable until the unallocated space is overwritten
✔✔$MFT - ✔✔Decribes the MFT. Name and information
, ✔✔$MFTMIRR - ✔✔Backup of the $MFT record
✔✔$LOGFILE - ✔✔Transactional logging information used by NTFS to maintain the
integrity of the filesystem in the event of a crash
✔✔$VOLUME - ✔✔Friendly name of volume for display in My Computer. NTFS version
and mount flags
✔✔$ATTRDEF - ✔✔defines NTFS attributes for version on NTFS used on drive.
✔✔$BITMAP - ✔✔long string of binary data, but for each cluster in the volume. Cluster
with corresponding bit will be set to either 1 or 0 depending on the cluster is allocated to
a file. Tracks clusters in used or not.
✔✔$BOOT - ✔✔allows the VBR to be accessed via normal IO operations
✔✔$BADCLUS - ✔✔Tracks bad clusters on the partition.
✔✔$SECURE - ✔✔index used to track security information for the files on the system.
Who owns the file and can open it.
✔✔$UPCASE - ✔✔upper/lowercase Unicode letters
✔✔$EXTEND - ✔✔record number 11 to hold the new system files.
✔✔$EXTEND\$ObjId - ✔✔object IDs contained and used within a drive. Allow a file to
be tracked even if the file gets moved, renamed, or otherwise changed in a way that
would cause a pointer like a link file to be able to find the file
✔✔$EXTEND\$Quota - ✔✔Contains infomration about how much allocated space each
user is allowed to and has consumed on volume, in order for system administrator to
technically prevent a user from using too much disk space.
✔✔$EXTEND\$UsnJrnl - ✔✔change journal, index listing all of the files that have
changed on the system and why the change tool place
✔✔NTFS records four times referring to files/folders: - ✔✔1. Last Modification time of
file data
2. Last access time of file data
3. Last modification of the MFT record
4. File creation time of MFT record in the volume
✔✔Alternate Data Streams(ADS) - ✔✔alternative content for a file that exists by
creating additional data pointers within the same NTFS file
