WorksheetsMidterm Review 1
Total questions: 15
Worksheet time: 9mins
What is true about data stored in slack space?
You can find it with the Windows command dir /as
When a file is deleted, the slack space is deleted as well
It can only be located using special forensic software
ADS files cannot be located in slack space
Which is true about alternate data streams?
They can be stored on Windows NTFS and Linux partitions.
You can find them on a Windows computer with the dir /r command.
They can only be located using a specialized forensic tool.
The hidden data is saved in ASCII code.
What happens on a system if physical memory runs low?
A process called paging is performed to move the data to the hard disk.
The oldest data in memory is deleted to make room for the new data.
Data on a hard disk is deleted to make room for additional RAM.
Data is moved temporarily from RAM to ROM.
Why should a CPU cache be the first place to search for data before searching a hard disk?
It is the most valuable data.
The data is only present when there is electrical power.
The data could be deleted by accident easily.
The data can be changed quickly.
Which location is the most volatile in the following list?
Swap File
Alternate data stream
Stored data on a hard disk
Data in RAM
Which describes a method of hiding data behind another file?
Converting Hex to ASCII
Inserting the data into slack space
Inserting data in an alternate data stream
Changing data properties to be hidden
The remaining space in the portion of the drive where the last pieces of data are saved is called ____.
EXIF
metadata
slack space
variable space
When data is saved, it is saved in a portion of the hard drive called a(n) ____.
unit
cluster
metadata
slack space
Which is a true statement about a file’s signature?
It is stored in binary code.
The last digits at the end of the file indicate the file’s extension.
If you rename the file and its extension, the file signature is changed.
Once created, a file’s signature is not modified.
What does a forensic examiner use to read raw binary data?
Hex Editor
ASCII
Signatures
Binary Viewer application
Which of the following is the decimal equivalent of hexadecimal 4B?
15
19
75
180
Which is a true statement about a chain of custody document?
It indicates who is responsible for the evidence.
It is only necessary in criminal proceedings.
It contains information about the digital evidence found on a hard drive.
It keeps an accurate accounting of everyone who handled the evidence.
Which of the following is true regarding a technician transporting a hard drive from one location to another?
The technician needs to obtain a legal hold.
The technician should put the drive in a Faraday bag.
The technician is violating the chain of custody rules.
The technician must obtain written consent to protect intellectual property.
Which of these is not a true statement about intellectual property?
Intellectual property is the result of a person’s ideas.
Intellectual property can be an invention.
Intellectual property is often published as open-source code.
Intellectual property is owned.
Why is it important to take a hash of the forensically copied drive?
To ensure the forensic copy is the same as the original drive
To ensure there are no errors on the original copy
To ensure the copied drive was forensically copied
To ensure the copied drive was blank before the image was placed on the drive
