Compare inodes used in Linux and NTFS. Are they the same? If not,
which one is better?
2) Compare the forensic tools for UNIX environments (e.g, the Sleuth and
TCT) with tools for Windows environments (e.g., EnCase and FTK).
Discuss the advantage and disadvantage of Linux platform and Windows
platform for forensic analysis. Note that you are not required to install these
software tools on your computer; you can discuss these tools from their
manual or product description documents that could be found in the
corresponding web pages.
3) For Windows OS, Registry keys are extensively used for forensic
analysis, do we have similar information in UNIX or Macintosh OSes?
4) Compared to Windows environments, is UNIX system friendlier for digital
investigation? Discuss this question from the following aspects: UNIX as
the platform for forensic investigation and UNIX as the target.