1. Explain the difference between logical addresses and physical addresses in Microsoft file structures.

Answer:

2. To help prevent loss of information, software vendors, including Microsoft, now provide whole disk encryption. This feature creates new challenges in examining and recovering data from drivers. What are four features offered by whole disk encryption tools that forensics examiners should be aware of?

Answer:

3. What does the $Secure metadata file contain?

Answer:

4. Describe both ways in which file or folder information is typically stored in an MFT record.

Answer:

5. Why are alternate data streams of particular interest when examining NTFS disks?

Answer:

6. Describe the three current versions of FAT.

Answer:

7. When Microsoft introduced Windows 2000, it added optional built-in encryption to NTFS called Encrypting File System (EFS) . Explain how EFS works.

Answer:

8. What is a partition gap, and how might it be used to hide data?

Answer:

9. With the release of Windows Server 2012, Microsoft created a new file system: Resilient File System (ReFS) . State the features that are incorporated into ReFS's design.

Answer:

10. Compare the methods for deleting NTFS files.

Answer: