Digital Forensics 2

Which of these is the correct order for Data Organization

• Raw Disk --> Partition--> File System -> Root Directory

• Partition --> Raw Disk --> Root Directory --> File System

• Raw Disk --> Root Directory --> File System-->Partition -->

• All of the above

.................................................... contains a physical bitstream of an acquired disk, prefixed with a “Case Info” header, interlaced with CRCs for every block of 64 sectors (32 KB), and followed by a footer containing an MD5 hash for the entire bitstream.

• Forensic Toolkit (FTK) Formats

• ProDiscover Image File Format

• EnCase’s Evidence File format

• Advanced Forensic Format

........................... space on the computer is where deleted documents, file system information, and other electronic artifacts reside on the hard drive, which is often able to be recovered and analyzed through a forensic investigation.

• Unallocated

• Swap

• Allocated

• RAW

Parity Encoding, Phase Coding, Spread Spectrum

are some of the method used in ...................type of steganography

• Text

• Audio

• Image

• Network

This file system is designed for storing huge amount of small files.It has a good capability for searching files and it enables allocation of compact files by storing file tails or small files along with metadata in order not to use large file system blocks for this purpose.

• Journal File System

• Zettabyte File System

• NTFS

• ReiserFS

MPEG

• Memory Picture Experts Group

• Moving Picture Experts Group

• Moving Picture Experimental Group

• Moving Picture Experts Generation

The hex value of "FFD8" is the header signature of which file format

• JPEG

• BMP

• PDF

• PNG

Which is the correct order of volatility

• Disk-> Temp file-> Memory-> Archival media

• Register-> ARP cache->Temp files->Network topology

• Archival media-> Disk-> Memory- Network Topology

• Routing table -> cache-> Register-> Archival media

.............................clusters can result from files not being closed properly, from shutting down a computer without first closing an application (power failure) or from ejecting a storage medium

• Unallocated

• Deleted

• LOST

• Allocated

Steganography

• Depends on hiding the message existence

• Depends on hiding the message meaning

• Depends on protecting the data

• None of the above