1.
The final component in the UNIX and Linux file system is a(n) ____, which is where directories and files are stored on a disk drive.
A. 
B. 
C. 
D. 
2.
The standard Linux file system is ____.
A. 
B. 
C. 
D. 
3.
A UNIX or Linux computer has two boot blocks, which are located on the main hard disk.
4.
GPL and BSD variations are examples of open-source software.
5.
Older Macintosh computers use the same type of BIOS firmware commonly found in PC-based systems.
6.
FTK and other computer forensics programs use ____ to tag and document digital evidence.
A. 
B. 
C. 
D. 
7.
In FTK ____ search mode, you can also look for files that were accessed or changed during a certain time period.
A. 
B. 
C. 
D. 
8.
Marking bad clusters data-hiding technique is more common with ____ file systems.
A. 
B. 
C. 
D. 
9.
People who want to hide data can also use advanced encryption programs, such as PGP or ____.
A. 
B. 
C. 
D. 
10.
There are ____ searching options for keywords that FTK offers.5
A. 
B. 
C. 
D. 
11.
For target drives, use only recently wiped media that have been reformatted and inspected for computer viruses.
12.
FTK cannot perform forensics analysis on FAT12 file systems.
13.
The defense request for full discovery of digital evidence applies only to criminal cases in the United States.
14.
Computer forensics tools are divided into ____ major categories.
A. 
B. 
C. 
D. 
15.
Many password recovery tools have a feature that allows generating potential lists for a ____ attack.
A. 
B. 
C. 
D. 
16.
Raw data is a direct copy of a disk drive. An example of a Raw image is output from the UNIX/Linux ____ command.
A. 
B. 
C. 
D. 
17.
Software forensics tools are commonly used to copy data from a suspect's disk drive to a(n) ____.
A. 
B. 
C. 
D. 
18.
The NIST project that has as a goal to collect all known hash values for commercial software applications and OS files is ____.
A. 
B. 
C. 
D. 
19.
The simplest method of duplicating a disk drive is using a tool that does a direct ____ copy from the original disk to the target disk.
A. 
B. 
C. 
D. 
20.
IDE ATA controller on an old 486 PC doesn’t recognize disk drives larger than 8.4 ____.
A. 
B. 
C. 
D. 
21.
In older Mac OSs, a file consists of two parts: a data fork, where data is stored, and a ____ fork, where file metadata and application information are stored.
A. 
B. 
C. 
D. 
22.
Linux is probably the most consistent UNIX-like OS because the Linux kernel is regulated under the ____ agreement.
A. 
B. 
C. 
D. 
23.
On a Linux computer, ____ is the path for the first partition on the primary master IDE disk drive.
A. 
B. 
C. 
D. 
24.
On Mac OSs, File Manager uses the ____to store any information, not in the MDB or Volume Control Block (VCB).
A. 
B. 
C. 
D.