Show:
exFAT
Artifacts
Partitians and FAT
Headers and Footers
Misc
100
Changed hex after a file is deleted in exFAT
What is x05, x40, x41
100
3 types of index.dat locations
What is history, cookies, cache (temporary internet files)
100
How many primary partitians can you have?
What is 4
100
FFD8, FFD9
What is .JPG
100
The smallest unit that data can be written to
What is a sector
200
Stored in the xC0 directory
What is file size and first cluster
200
Two types of spool files
What is shadow and spool
200
What does FDISK.EXE do?
What is create, display, delete, activate partitians
200
CREG
What is registry file: SYSTEM.DAT, USER.DAT
200
What is found in CHS 001 AKA the absolute sector 0 on a hard disk?
What is the MBR
300
What clusters are allocated for hex offset x1F
What is clusters 2-6
300
Name the main swap file
What is win386.swp
300
How many bytes is each partitian entry?
What is 16
300
MZ
What is .EXE
300
Name one thing that hashing is used for
What is seeing if a file's hex has been altered, seeing if a file is the same but named differently, finding similarities between files, etc.
400
Stored in the x85 directory
What is attributes, MAC date & time
400
How big in the header and record for info2?
What is 20 byte header, 280 byte record
400
How is fat 32 different?
What is root and data are combined, FSINFO, makes copy of the VBR 6 sectors after original
400
Footer: PK
What is a zip file
400
3 files essential for the boot process
What is IO.SYS, MSDOS.SYS, COMMAND.COM
500
Tracks allocated/unallocated status of clusters
What is bitmap
500
Where would you find time zone information?
What is SYSTEM.DAT in system\control\currentcontrolset\timezoneinformation
500
2 things found in the FSINFO sector
What is number of free clusters on the partitian, and the last allocated cluster
500
. ..
What is subdirectory
500
3 extensions for COMMAND.COM in order
What is .COM, .EXE, .BAT