You are working as an investigator for a corporation and you have just received instructions from your manager to assist in the collection of 15 hard drives that are part of an ongoing investigation. Your job is to complete the required evidence custody forms to properly document each piece of evidence as other members of your team collect it. Your manager instructs you to complete one multi-evidence form for the entire case and a single-evidence form for each hard drive. How will these forms be stored to help preserve the chain of custody of the case?

• A.All forms should be placed in an approved secure container because they are now primary evidence in the case
• B.The multi-evidence form should be placed in the report file and the single-evidence forms should be kept with each hard drive in an approved secure container
• C.The multi-evidence form should be placed in an approved secure container with the hard drives and the single-evidence forms should be placed in the report file
• D.All forms should be placed in the report file because they are now primary evidence in the case

Comment: *

Name: *

Email: *

Verification: *

When a user deletes a file, the system creates a $I file to store its details. What detail does the $I file not contain?

• A.Time and date of deletion
• B.File Name
• C.File origin and modification
• D.File Size

Comment: *

Name: *

Email: *

Verification: *

What will the following command accomplish in Linux?
fdisk /dev/hda

• A.Delete all files under the /dev/hda folder
• B.Partition the hard drive
• C.Format the hard drive
• D.Fill the disk with zeros

Comment: *

Name: *

Email: *

Verification: *

Preparing an image drive to copy files to is the first step in Linux forensics. For this purpose, what would the following command accomplish?
dcfldd if=/dev/zero of=/dev/hda bs=4096 conv=noerror, sync

• A.Copy files from the master disk to the slave disk on the secondary IDE controller
• B.Fill the disk with 4096 zeros
• C.Low-level format
• D.Fill the disk with zeros

Comment: *

Name: *

Email: *

Verification: *

NTFS has reduced slack space than FAT, thus having lesser potential to hide data in the slack space. This is because:

• A.NTFS has lower cluster size space
• B.FAT is an older and inefficient file system
• C.NTFS is a journaling file system
• D.FAT does not index files

Comment: *

Name: *

Email: *

Verification: *