1.
Which of the following statements is more accurate?
2.
EnCase marks a file as overwritten when _____________ has been allocated to another file.
3.
When a document is printed using EMF in Windows, what file(s) are generated in the spooling process?
4.
An Enhanced Metafile would best be described as:
5.
How many clusters can a FAT 16 system address?
6.
The EnCase evidence file logical filename can be changed without affecting the verification of the acquired evidence.
7.
A sector on a hard drive contains how many bytes?
8.
A sector on a floppy disk is the same size as a sector on a NTFS formatted hard drive.
9.
A suspect typed a file on his computer and saved it to a floppy diskette. The filename was MyNote.txt. You receive the floppy and the suspect computer. The suspect denies that the floppy disk belongs to him. You search the suspect computer an d locate only the filename within a .LNK file. The .LNK file is located in the folder C:\Windows\Recent. How you would use the .LNK file to establish a connection between the file on the floppy diskette and the suspect computer?
10.
In the FAT file system, the size of a deleted file can be found: