Shared Flashcard Set

Details

1 - Computer Forensics || Week 5
1 - Computer Forensics || Week 5
43
Computer Science
Undergraduate 4
09/18/2018

Additional Computer Science Flashcards

 


 

Cards

Term
File systems provide a mechanism for users to do what?
Definition
Store data in a hierarchy of files and directories.
Term
A file system consists of?
Definition
Structural and user data.
Term
File system is independent from what?
Definition
Any specific computer
Term
File systems use the logical volume addresses but also do what?
Definition
Assign logical file system addresses
Term
Why do file systems assign logical file system addresses?
Definition
They group consecutive sectors to form a data unit
Term
File systems use what two types of addresses?
Definition
Sector and Cluster Addresses
Term
The first cluster in data area of a file system is always what?
Definition
Cluster 2
Term
What happens when you update a file?
Definition
Applications can create a new copy or modify the existing file.
Term
Operating Systems Use Different What Strategies?
Definition
Allocation
Term
What are the three allocation strategies?
Definition
First Available

Next Available

Best Fit
Term
What is the First Available Strategy?
Definition
It always starts with the first cluster.
Term
What is the Next Available Strategy?
Definition
Starts from the last allocated cluster.
Term
What is the Best Fit Strategy?
Definition
Searches for consecutive data units.
Term
Many file systems have ability to mark a data unit as what?
Definition
Damaged
Term
What detects bad sectors in the modern day?
Definition
HDD
Term
Users can manually add a data unit to what list and place data in it?
Definition
Damaged Sector List
Term
Why do acquisition tools report bad sectors?
Definition
So that report can be compared the damaged sector list to identify sectors that may have been manually added to hide data.
Term
List the categories that all data in a file system belong to at least one of.
Definition
File System

Metadata

Filename

Applicaiton
Term
File system category
Definition
Contains general information
Term
Content Category
Definition
Contains the data that comprise the actual content of a file
Term
Metadata Category
Definition
Contains data that describes the file
Term
Filename Category
Definition
Contains the data that assign a name to each file
Term
Application Category
Definition
Contains data that provide special features
Term
Slack Space
Definition
The unused bytes in the last data unit
Term
A file must allocate a full data unit, even if?
Definition
It needs only a small part of it
Term
What is RAM Slack?
Definition
Between the end of the file and the end of the sector in which the file ends
Term
What is File Slack?
Definition
Remaining unused sectors in the data unit
Term
What is the most simple file systems found in common OSes and is the primary file system of the Microsoft DOS and Windows 9x operating systems?
Definition
FAT File System
Term
What are the two important data structures in FAT system?
Definition
Directory entries and File Allocation Table
Term
What are the three features of a Directory Entry?
Definition
Data structure that is allocated for every file and directory.

32 bytes per each entry.

Includes directory/file name and location.
Term
What does . mean?
Definition
It is the name of the cluster you are observing.
Term
What does .. mean?
Definition
It is the parent directory.
Term
What happens when you delete a directory?
Definition
It's name is changed and it's cluster is then listed as unallocated.

The contents of directory still exist within their respective cluster, until they are overwritten.
Term
FAT entries can either be 16 bites (2 bytes) or what?
Definition
32 bits (4 bytes)
Term
What does a FAT table show?
Definition
The allocation status of a cluster and the next allocated cluster.
Term
What is EOF?
Definition
End of File
Term
By default the Root Directory is fixed at the beginning of the data area before Cluster 2, in what FAT systems?
Definition
FAT 12 and FAT 16
Term
How do you find the Root Directory in a FAT 32 system?
Definition
It's location can be discovered by checking the Reserved Area for information on its whereabouts.
Term
Where does the Data Area always begin?
Definition
Cluster 2
Term
Cluster 2 is right after what, in a FAT 12 or FAT 16 system?
Definition
The Root Directory
Term
Root Directory can overlap with what?
Definition
Cluster 2
Term
What is the structure of FAT?
Definition
Reserved Area

FAT area

Root Directory (If FAT 12 or 16)

Cluster 2

Data Area

(Root Directory can be in Data Area if FAT 32)
Term
If you change the first byte to 0xe5, a directory entry will appear as what?
Definition
Deleted
Supporting users have an ad free experience!