FORMATIVE 2 Flashcards
(51 cards)
How does a solid-state drive (SSD) store data?
Group of answer choices
Using tape-based storage
Using magnetic spinning platters
With optical storage discs
Using NAND-based flash memory
Using NAND-based flash memory
What feature distinguishes ext3 from ext2?
Group of answer choices
Compatibility with older hardware
File journaling support
Faster booting times
Higher compression rates
File journaling support
What type of data structure is used in NTFS to store file metadata?
Inode
Master File Table (MFT)
Superblock
Logical Block
Master File Table (MFT)
What does “journaling” in a file system ensure?
Recovery of data in case of system crashes
File compression for efficient storage
Faster execution of user applications
Permanent deletion of unused files
Recovery of data in case of system crashes
In a hard disk drive, what is the purpose of the read/write head?
Group of answer choices
To manage network traffic
To process data stored in RAM
To transfer data between different partitions
To read and write data to/from the disk surface
To read and write data to/from the disk surface
What is a common disk interface used in modern hard drives?
Group of answer choices
SATA
NVMe
IDE
Both SATA and NVMe
Both SATA and NVMe
What is the significance of “logical black addressing (LBA)”?
It simplifies the storage addressing system
It describes physical hardware connections
It compresses files for storage efficiency
It determines the encryption key of a hard drive
It simplifies the storage addressing system
What is a “superblock” in the context of Linux file systems?
Group of answer choices
A temporary file used during booting
A security feature that encrypts system logs
A reserved area for storing deleted files
Metadata containing information about the entire file system
Metadata containing information about the entire file system
What is the main purpose of sectors on a hard drive?
Group of answer choices
To store the operating system kernel
To define physical divisions on the disk for data storage
To divide data into compressed files
To encrypt critical system information
To define physical divisions on the disk for data storage
Which file system is specific to macOS?
Group of answer choices
ext4
HFS+
NTFS
FAT32
HFS+
What is the primary concern when capturing data from encrypted devices?
Group of answer choices
Creating an incremental backup
Encrypting volatile data
Ensuring compatibility with file systems
Acquiring data without damaging encryption keys
Acquiring data without damaging encryption keys
Which step comes first in the data acquisition process?
Group of answer choices
Securing the scene
Hashing the collected data
Analyzing evidence
Creating a forensic image
Securing the scene
What does a “bit-stream image” include?
Group of answer choices
Only the active files on a disk
Metadata of the analyzed file system
A compressed copy of user data
A complete copy of all sectors, including deleted and hidden data
A complete copy of all sectors, including deleted and hidden data.
What is the primary objective of data acquisition in digital forensics?
Group of answer choices
Preserving the integrity of evidence during collection
Encrypting evidence for security
Analyzing the original evidence directly
Formatting the storage device for analysis
Preserving the integrity of evidence during collection
What does “selective acquisition” focus on?
Group of answer choices
Hashing volatile system logs
Collecting only relevant files or folders
Analyzing encrypted file systems
Capturing all data on a disk
Collecting only relevant files or folders
Which acquisition tool can capture data at the sector level?
Group of answer choices
dd
EnCase
Sleuth Kit
FTK Imager
dd
What does the term “logical acquisition” refer to?
Group of answer choices
Creating a complete bit-stream image
Capturing data from volatile storage
Encrypting file systems during acquisition
Copying only specific files or folders
Copying only specific files or folders
What is the purpose of an acquisition report?
Group of answer choices
To store acquired data in a compressed format
To outline the steps and tools used during data collection
To encrypt collected evidence for secure transfer
To create backups of volatile data
To outline the steps and tools used during data collection
Why is documentation critical during the data acquisition process?
Group of answer choices
To encrypt collected evidence for security
To generate reports for end users
To reduce the size of collected evidence
To track all steps and tools used for evidence collection
To track all steps and tools used for evidence collection
Which of the following data types is considered volatile?
Group of answer choices
Open network connections
Archived emails
Data stored on a USB drive
System logs
Open network connections
What is the primary focus of metadata analysis in anti-forensics countermeasures?
Group of answer choices
To identify inconsistencies in file properties
To encrypt sensitive data
To delete unused logs
To compress large datasets for analysis
To identify inconsistencies in file properties
Which countermeasure is used to detect manipulated timestamps?
Group of answer choices
Metadata verification
Steganalysis
Log correlation
Hash comparison
Metadata verification
What is the role of secure file deletion software?
Group of answer choices
To overwrite data to ensure it cannot be recovered
To encrypt files for storage
To create backups of important files
To compress large files for transmission
To overwrite data to ensure it cannot be recovered
Which anti-forensics technique is aimed at hiding the true content of files?
Group of answer choices
Encryption
Log wiping
File carving
Metadata alteration
Encryption
