Deck 7: Investigating Windows, linux, and Graphic Files

Question 1

In a forensics context,hidden information about files and folders is called

A)Artifact data
B)Metadata
C)Archive data
D)Read-only data

Answer 1

B

Question 2

In an NTFS system,by default,which of the following have access to files and folders not uniquely theirs?

A)Each user in the Group folder
B)Only those users in the Users folder
C)Each user who successfully logs in
D)Only the user assigned to those resources

Answer 2

D

Question 3

?Which of the following is considered an excellent source to obtain information on when passwords were last changed within a Linux system?

A)/etc/sysconfig
B)/etc/shadow/passwd
C)/etc/shadow
D)/etc

Answer 3

C

Question 4

A(n)________ is created by the computer for each user.

Question 5

Sources of e-evidence within Windows subfolders can include all of the following EXCEPT

A)Pointers to Office files
B)Listing of programs on the Quick Launch bar
C)Pointers to Internet Favorites
D)The user's address book

Question 6

The user root folder may contain all of the following EXCEPT

A)Internet data
B)Application parameters
C)Wallpaper
D)Registry settings

Question 7

If you change a file extension by renaming the file,

A)You also change the data in the file
B)You will not be able to open the file
C)Windows will change the icon that represents the file
D)You also change the data header

Question 8

A(n)________ is designed as a hierarchical listing of folders and files.

Question 9

Files are first loaded into a(n)________ before being printed.

Question 10

All of the following are key differences in identifying an operating system EXCEPT

A)The Recycle Bin folder
B)Operating system folder names
C)User root folder construction
D)Folders containing group userids

Question 11

Which of the following is the primary default folder in Windows 2000 and XP?

A)Documents and Settings
B)My Documents
C)User Root
D)My Computer

Question 12

Which of the following is NOT one of the file types available within Linux?

A)Block devices
B)Directories
C)Named pipes
D)Superblock

Question 13

System data and artifacts are files generated by the ________.

Question 14

When you send a job to the printer,Windows creates a(n)

A)Enhanced metafile (EMF)
B)Enhanced image file (IMF)
C)Temporary print file (TPF)
D)Tagged image format file (TIFF)

Question 15

Which of the following is one of the default directories created when installing Linux?

A)/setup
B)/default
C)/bin
D)/swap

Question 16

The ________ folder is used by Internet sites to store information about the user.

Question 17

Clues that may indicate stego use include all of the following EXCEPT

A)The sophistication of the computer's owner
B)Software clues on the computer
C)Type of crime being investigated
D)Large number of files in the Recycle Bin

Question 18

Examples of user data include all of the following EXCEPT

A)User passwords
B)User profiles
C)Program files
D)Temp files

Question 19

In steganography,the original file that contains the hidden information is the

A)Steganographic carrier
B)Carrier medium
C)Hiding medium
D)Concealing medium

Question 20

All configuration information needed by the operating may be located in which of the following?

A)System folder
B)Configuration file
C)AutoexeC.bat file
D)Registry hives

Question 21

One application of metadata used by Windows is an uncommon storage concept called ________.

Question 22

The ________ tracks those actions deemed as events by the software application.

Question 23

The ________ command gives Linux users the ability to perform administrative duties,which require a separate password for each user.

Question 24

By default,the ________ is used as virtual memory.

Question 25

Windows NT and higher changed the registry to a mixture of several files referred to as ________.

Question 26

The ________ folder generally contains information concerning the programs the user typically works with.

Question 27

The process of retrieving image data from unallocated or slack space is called ________.

Question 28

In Linux,everything-including all devices,partitions,and folders-is seen as a unified ________.

Question 29

________ are used to determine where data starts and ends when graphic files are located in unallocated or slack space.

Question 30

The ________ subfolder lists the files that the user has accessed over several time periods.