Midterm Review 1

Front

What is true about data stored in slack space?

Back

It can only be located using special forensic software.

Front

Which is true about alternate data streams? Options: They can be stored on Windows NTFS and Linux partitions. You can find them on a Windows computer with the dir /r command. They can only be located using a specialized forensic tool. The hidden data is saved in ASCII code.

Back

You can find them on a Windows computer with the dir /r command.

Front

What happens on a system if physical memory runs low?

Back

A process called paging is performed to move the data to the hard disk.

Front

Why should a CPU cache be the first place to search for data before searching a hard disk?

Back

The data is only present when there is electrical power.

Front

Which location is the most volatile in the following list? Swap File, Alternate data stream, Stored data on a hard disk, Data in RAM

Back

Data in RAM

Front

Which describes a method of hiding data behind another file? Options: Converting Hex to ASCII, Inserting the data into slack space, Inserting data in an alternate data stream, Changing data properties to be hidden

Back

Inserting data in an alternate data stream

Front

The remaining space in the portion of the drive where the last pieces of data are saved is called ____.

Back

slack space

Front

When data is saved, it is saved in a portion of the hard drive called a(n) ____.

Back

cluster

Front

Which is a true statement about a file’s signature?

Back

Once created, a file’s signature is not modified.

Front

What does a forensic examiner use to read raw binary data?

Back

Hex Editor