CIT121 – INTRODUCTION TO COMPUTER FORENSICS
FINAL EXAMINATION – SPRING 2017 SEMESTER
DIRECTIONS: Each of the questions below calls for an open response. Each response to each question and/or sub-question will likely be 5-7 sentences long, depending upon the subject of the question itself. Please respond to each question with a short, concise answer. You can certainly write more, or less, than 5-7 sentences in response. You are being tested first on your understanding of the subject matter relative to each question. Thus, responses that include simple bullet points are insufficient. You can use any of the course resources that was distributed to you. The majority of the questions come from the course slides and supplemental reading materials. The response boxes expand as needed for your response. Please make sure to answer all questions. Make sure you insert your name as well. Once you complete the exam, save it, and email it to me at cwk.digitalforensics@gmail.com with the subject line: “Final Examination.” Good luck.
DEADLINE: 5:00PM EST ON FRIDAY, MAY 12TH, 2017
NAME:
1. A Windows user saves a file to a USB thumb drive that is formatted with the FAT32 file system. Explain what happens when the file is saved to the USB thumb drive with respect to: file name; file extension; FAT; directory entry; and physical clusters where the file is written.
2. A Windows user deletes a file from a USB thumb drive that is formatted with the FAT32 file system. Explain what happens when the file is deleted from the USB thumb drive with respect to: file name; file extension; FAT; directory entry; and physical clusters where the file is written.
3. Convert the decimal number 84 to its’ hex equivalent. What ASCII character represents these values? Describe how you performed these two conversions.
4. Explain the difference between a physical file and a logical file.
5. What is a sector? What is a typical sector size? Explain the difference between a sector and a cluster.
6. How much reliance can a digital forensic examiner place on date and time stamps? Please give three examples of how date and time stamps could be inaccurate or unreliable.
7. Which of the file management ($ files) files on a NTFS formatted volume is most important? (Hint: this is the file the volume boot record points to on the disk). Why is this file so important? Give 5 examples of the data found in a single record within this file.
8. Define the word “metadata.” Where is metadata found? Give three examples of how metadata can be important in a digital forensic examination.
9. What is a file system? What is an operating system? How are file systems and operating systems different?
10. A digital forensic examiners’ ability to take difficult technical concepts and explain them to non-technical people is critical during the presentation of findings. Explain one of these concepts using a non-technical analogy to every-day life: slack space; file system; hash value; deleted files remain on a hard drive even after a format; the process of creating a disk image.
