CTC 328 Final Exam 2025 Questions and
Answers
Scope creep - ANS The goal of recovering as much information as possible can result in
________________, in which an investigation expands beyond the original description because
of unexpected evidence found.
The sender's physical location - ANS What information is not typically included in an e-mail
header?
FFEI - ANS For EXIF JPEG files, the hexadecimal value starting at offset 2 is _____________.
HexEdit - ANS Which option below is not a disk management tool?
Microsoft Extensible Storage Engine (ESE) - ANS Exchange uses an Exchange database and is
based on the _______________________, which uses several files in different combinations to
provide e-mail service.
XFS - ANS Which of the following file systems can't be analyzed by OSForensics?
demos icing - ANS The process of converting raw picture data to another format, such as
JPEG or TIF.
Pg. 1 Copyright © 2025 Jasonmcconell. ALL RIGHTS RESERVED.
, vector graphics - ANS Graohics based on mathematicsl instructions to form lines, curves,
text, and other geometrical shapes.
metafile graphics - ANS Graphics files that are combinations of bitmap and vector images.
raster images - ANS Collections of pixels stored in rows rather than a grid, as with bitmap
images, to make graphics easier to print; usually creates when a vector graphic is converted to a
bitmap image.
bitmap images - ANS Collection of dots, or pixels, in a grid format that form a graphic.
vector quantization (VQ - ANS A form of compression that uses an algorithm similar to
rounding off decimal values to eliminate unnecessary bits of data.
Exchangeable Image File (ExIF) - ANS A file format the Japan Electronics and Informatuin
Technology Industries Association (JEITA) developed as a standard for storing metadata in JPEG
or TIF files.
carving - ANS The process of recovering file fragments that are scattered across a disk.
nonstandard graphics file formats - ANS Less common graphic file formats, including
proprietary formats, newer formats, formats that most image viewers don't recognize, and old
or obsolete formats.
false positives - ANS The results of keyword searches that contain the correct match but
aren't relevant to the investigation.
.tmp - ANS What kind of files are created by Exchange while converting binary data to
readable text in order to prevent loss of data?
Pg. 2 Copyright © 2025 Jasonmcconell. ALL RIGHTS RESERVED.
Answers
Scope creep - ANS The goal of recovering as much information as possible can result in
________________, in which an investigation expands beyond the original description because
of unexpected evidence found.
The sender's physical location - ANS What information is not typically included in an e-mail
header?
FFEI - ANS For EXIF JPEG files, the hexadecimal value starting at offset 2 is _____________.
HexEdit - ANS Which option below is not a disk management tool?
Microsoft Extensible Storage Engine (ESE) - ANS Exchange uses an Exchange database and is
based on the _______________________, which uses several files in different combinations to
provide e-mail service.
XFS - ANS Which of the following file systems can't be analyzed by OSForensics?
demos icing - ANS The process of converting raw picture data to another format, such as
JPEG or TIF.
Pg. 1 Copyright © 2025 Jasonmcconell. ALL RIGHTS RESERVED.
, vector graphics - ANS Graohics based on mathematicsl instructions to form lines, curves,
text, and other geometrical shapes.
metafile graphics - ANS Graphics files that are combinations of bitmap and vector images.
raster images - ANS Collections of pixels stored in rows rather than a grid, as with bitmap
images, to make graphics easier to print; usually creates when a vector graphic is converted to a
bitmap image.
bitmap images - ANS Collection of dots, or pixels, in a grid format that form a graphic.
vector quantization (VQ - ANS A form of compression that uses an algorithm similar to
rounding off decimal values to eliminate unnecessary bits of data.
Exchangeable Image File (ExIF) - ANS A file format the Japan Electronics and Informatuin
Technology Industries Association (JEITA) developed as a standard for storing metadata in JPEG
or TIF files.
carving - ANS The process of recovering file fragments that are scattered across a disk.
nonstandard graphics file formats - ANS Less common graphic file formats, including
proprietary formats, newer formats, formats that most image viewers don't recognize, and old
or obsolete formats.
false positives - ANS The results of keyword searches that contain the correct match but
aren't relevant to the investigation.
.tmp - ANS What kind of files are created by Exchange while converting binary data to
readable text in order to prevent loss of data?
Pg. 2 Copyright © 2025 Jasonmcconell. ALL RIGHTS RESERVED.
