It may not be possible to recover the file names and date-time stamps from an HFS volume with forensic tools because:
A) That information is overwritten when a file is deleted.
B) The inode table is deleted.
C) That information is only held in memory.
D) The B-tree data structure frequently rebalances.
Correct Answer:
Verified
Q1: Examination of a Mac computer must be
Q2: Keychains (~/Library/Keychains) are files that store:
A) Usernames
Q3: Macintosh disks can only be examined on
Q4: The boot sector and additional details about
Q6: The most common approach to salvaging deleted
Q7: The HFS equivalent to the NTFS MFT
Q8: A difference between HFS and other file
Q9: HFS Plus stores file and folder names
Q10: When a file is deleted, its Catalog
Q11: HFS represents time as:
A) The number of
Unlock this Answer For Free Now!
View this answer and more for free by performing one of the following actions
Scan the QR code to install the App and get 2 free unlocks
Unlock quizzes for free by uploading documents