Question 1

Many digital forensics laboratories have the capability to recover overwritten data from a hard drive.

Accepted Answer

Once data is overwritten on a hard drive, it is generally considered unrecoverable because the original magnetic states representing the data are physically replaced.

Question 2

The Macintosh Open Firmware can be instructed to boot from a CD-ROM by holding down the "b" key.

Accepted Answer

To boot a Macintosh from a CD-ROM, you should hold down the "C" key during startup, not the "b" key.

Question 3

A sector is composed of multiple clusters.

Accepted Answer

The answer of A sector is composed of multiple clusters....

Question 4

Unicode can represent more characters than ASCII.

Accepted Answer

Unicode was designed to encompass all characters from all the writing systems in the world, thus it can represent significantly more characters than ASCII, which is limited to 128 characters.

Question 5

Digital forensics examiners do not need to be concerned about the distinction between little-endian and big-endian representations because automated tools make the necessary translation.

Accepted Answer

Digital forensics examiners need to understand the distinction between little-endian and big-endian representations because interpreting data structures, memory, and some types of files correctly depends on this knowledge, even if automated tools are used.

Question 6

Describe the main steps that your computer takes during the boot process from the time you press the power switch to the first appearance of the operating system. Why is this important to a forensic examiner?

Accepted Answer

The answer of Describe the main steps that your computer...

Question 7

The Sun OpenBoot PROM can be interrupted by depressing the "Stop" key.

Accepted Answer

The Sun OpenBoot PROM can be interrupted by pressing the "Stop" key in combination with the "A" key, not just the "Stop" key alone.

Question 8

The number of sectors on any hard drive is calculated by multiplying its CHS values.

Accepted Answer

The answer of The number of sectors on any hard...

Question 9

Although storage media come in many forms, hard disks are the richest sources of digital evidence on computers.

Accepted Answer

Hard disks are commonly used for storing large amounts of data over long periods, making them rich sources of digital evidence due to their capacity and the variety of information they can contain, including system files, user documents, and logs.

Question 10

What is the storage capacity of a hard drive with 64 heads, 63 sectors, and 787 cylinders?

Accepted Answer

The answer of What is the storage capacity of a...

Question 11

How do you remove data from a hard drive to prevent it from being recovered (e.g., delete partition table, reformat drive, delete files)?

Accepted Answer

The answer of How do you remove data from a...

Question 12

What is the ASCII representation of this hexadecimal data: "54686520737573706563742773206E616D65206973204D69636861656C"?

Accepted Answer

The answer of What is the ASCII representation of this...

Question 13

Where is the partition table located on a hard drive, and what does it contain?

Accepted Answer

The answer of Where is the partition table located on...

Question 14

Sectors are 557 bytes long but only 512 bytes are used to store data.

Accepted Answer

The first 4 bytes of each sector are used for the sector header, which contains information about the sector, such as its size and location on the disk. The remaining 512 bytes are used to store data.

Quiz 15: Computer Basics for Digital Investigators