In FAT$12,$ FAT$16$ and FAT$32,$ the number $(12,16,32)$ is

Question $1$ options:

the year they were introduced.

number of bytes per sector.

number of bits to refer to clusters.

the FAT versions.

Question $2($Mandatory$)(1$ point$)$

Data is written to or read from the hard disk

Question $2$ options:

sector $($typically $512$ bytes$)$ at a time.

byte at a time.

word at a time.

bit at a time.

Question $3($Mandatory$)(1$ point$)$

On a hard disk $,$ space is allocated to a file in terms of

Question $3$ options:

bits.

bytes.

sectors$.$

clusters.

Question $4($Mandatory$)(1$ point$)$

Slack space is the

Question $4$ options:

unused allocated space to files.

used allocated space to files.

space of no interest to hacker.

space of no interest to forensic engineer.

Question $5($Mandatory$)(1$ point$)$

The unallocated clusters on a disk

Question $5$ options:

are empty.

may have data from previous allocation.

are of no interest to forensic engineer.

are of no interest to operating system.

Question $6($Mandatory$)(1$ point$)$

This file system always stores a value of $0$x$55$AA in byte number $510$ and $511.$

Question $6$ options:

EXT$1$

NTFS

UFS$2$

FAT

Question $7($Mandatory$)(1$ point$)$

The partition table in the master boot record $($MBR$)$ is stored at byte numbers

Question $7$ options:

$0-445$

$446-509$

$510-511$

outside of the disk.

Question $8($Mandatory$)(1$ point$)$

The FAT$16$ system has a signature $0$x$55$AA in bytes $510-511.$ FAT$32$ has

Question $8$ options:

the same signature at the same location.

same signatures but at byte numbers $508-511.$

different signatures at the same byte location $(510-511).$

$0$x$55$AA$0000$ at bytes $508-511.$

Question $9($Mandatory$)(1$ point$)$

The following clusters in FAT$16$ are unusable by a programmer because they are unaddressable. They are used for information for the operating system, such as media type.

Question $9$ options:

the first two clusters $(0$ and $1).$

the last two clusters $(511-512).$

any two clusters.

secret clusters.

Question $10($Mandatory$)(1$ point$)$

In FAT$16,0$xFFF$7$ marks

Question $10$ options:

end of file.

end of cluster.

good cluster.

bad cluster.

Question $11($Mandatory$)(1$ point$)$

Recovering files in FAT is not easy when

Question $11$ options:

they are fragmented.

clusters have been over$-$written.

there are missing entries and$/$or directories.

any of the above.

Question $12($Mandatory$)(1$ point$)$

Logging, File permissions, compression, encryption and alternate data streams are some of the properties of

Question $12$ options:

NTSF

FAT$12$

FAT$16$

FAT$32$

Question $13($Mandatory$)(1$ point$)$

A deleted compressed file in NTFS is

Question $13$ options:

easier to discover by a forensics engineer than an uncompressed file because it is smaller.

harder to discover by a forensics engineer than an uncompressed file because it needs decompression.

is not possible.

is something a forensics engineer never comes across.

Question $14($Mandatory$)(1$ point$)$

The encrypting file system $($EFS$)$ stores the encryption key.

Question $14$ options:

publicly.

separately from the file on the disk.

with the file.

on the master boot record because it is inaccessible by the user.

Question $15($Mandatory$)(1$ point$)$

The file encryption key in encrypting file system is encrypted

Question $15$ options:

using only the users public key so that only s$/$he can decrypt it to recover the file

using users and a recovery agent's public keys so that only these keys can decrypt it to recover the file

using only the users private key so that only s$/$he can decrypt it to recover the file

using only the OS public key so that only the OS can decrypt it to recover the file

Question $16($Mandatory$)(1$ point$)$

Alternate data stream was introduced to support

Question $16$ options:

Windows NTFS files.

FAT$32$ files.

EFS files.

Macintosh files.

Question $17($Mandatory$)(1$ point$)$

In NTFS there are files that store the metadata for files.

Question $17$ options:

True

False

Question $18($Mandatory$)(1$ point$)$

Tracks in a hard disk are defined by the manufacturer. A track consists of

Question $18$ options:

many sectors$.$

one sector.

one cluster.

less than one sector.

Question $19($Mandatory$)(1$ point$)$

On a hard disk drive

Question $19$ options:

tracks and sectors are logical while clusters and partitions are physical.

tracks and sectors are physical and also clusters and partitions are physical.

tracks and sectors are logical and so are clusters and partitions.

tracks and sectors are physical while clusters and partitions are logical$.$

Question $20($Mandatory$)(1$ point$)$

$MFT file is present in all file systems.

Question $20$ options:

True

False