Module 2 -Part 2 - File System Forensics

What is the primary file system used by Windows?

• NTFS

• HFS+

• FAT32

• exFAT

Explain the difference between FAT and NTFS file systems.

• FAT and NTFS are identical in functionality and performance.

• FAT supports larger files and better security than NTFS.

• FAT is simpler and more compatible, while NTFS supports larger files and offers better security and data management.

• NTFS is simpler and more compatible than FAT.

What is whole disk encryption and why is it used?

• Whole disk encryption is used to improve system performance.

• Whole disk encryption only protects files in the cloud.

• It is a method to speed up data access on a hard drive.

• Whole disk encryption is a security measure that encrypts all data on a storage device to protect it from unauthorized access.

How does the Windows registry function in the operating system?

• The Windows registry stores configuration settings and options for the operating system and applications.

• The Windows registry manages user accounts and permissions.

• The Windows registry is a file storage system for documents.

• The Windows registry is a type of antivirus software.

What are the key startup tasks performed by MS-DOS?

• Running CHKDSK at startup

• Key startup tasks performed by MS-DOS include hardware initialization, loading the kernel, executing CONFIG.SYS, running AUTOEXEC.BAT, and presenting the command prompt.

• Loading device drivers

• Initializing network settings

Describe the structure of a UNIX file system.

• The UNIX file system is a flat structure with no directories.

• The UNIX file system uses only one type of file called a 'blob'.

• The UNIX file system is a linear structure with no root directory.

• The UNIX file system is a hierarchical structure with a root directory, inodes for metadata, and supports files, directories, and special files.

What is the purpose of the boot process in Linux?

• To initialize the system and prepare it for use.

• To update the kernel and drivers.

• To run user applications immediately.

• To shut down the system safely.

How do CD data structures differ from traditional disk structures?

• CD data structures prioritize data integrity over speed.

• CD data structures are primarily used for local storage solutions.

• CD data structures are optimized for network efficiency and speed, while traditional disk structures focus on local storage and data integrity.

• Traditional disk structures are designed for network efficiency.

What are IDE and EIDE devices, and how do they function?

• EIDE is a type of graphics card used in computers.

• IDE and EIDE are types of computer programming languages.

• IDE and EIDE are protocols for internet communication.

• IDE and EIDE are interfaces for connecting storage devices to a computer, with EIDE offering enhancements over IDE.

Explain the role of SATA devices in modern computing.

• SATA devices are essential for connecting and managing storage in modern computers, offering speed, reliability, and ease of use.

• SATA devices are only used in mobile devices and not in desktops.

• SATA devices are primarily used for graphics processing in computers.

• SATA devices are obsolete and have been replaced by USB connections.