Module 03 - Understand Various File Systems of Windows, Linux, and Mac Operating Systems

What operating system uses file systems such as FAT, FAT32, NTFS, etc. NTFS stores

metadata of files and folders in a system file called Master File Table (MFT)?

Windows OS

Examining the ________ file provides information such as MAC times, file name, file location, etc., which is of forensic interest. Forensic investigators also should possess knowledge on file allocation and deletion that helps them recover lost data during investigation.

$MFT

What was designed in 1976,and is a file system for many OSes such as DOS, Windows, and OpenDOS?

File Allocation Table (FAT)

Designed for small hard disks and a simple folder structure, the _______ file system is named after the way it organizes folders and a file allocation table, which stores all the files and resides at the beginning of the volume.

File Allocation Table (FAT)

File Allocation Table (FAT) has three versions which differ in terms of the size of the entries in the FAT structure. Which of the following are of three versions of FAT?

FAT12, FAT16, and FAT32

True or False: FAT creates two copies of the file allocation table to protect the volume

from damage.

True

The file allocation table and root folder are stored in a permanent location. The volume formatted using the FAT file system forms a _____-and the size of the formatted volume determines the _______.

Cluster and Cluster Size

What is one of the latest file systems supported by Windows that is a high-performance file system that repairs itself; it supports several advanced features such as file-level security, compression, and auditing? It also supports large and powerful volume storage solutions such as self-recovering disks.

New Technology File System (NTFS)

What provides data security as it has the capability to encrypt or decrypt data, files, or folders and uses a 16-bit Unicode character set naming method for files and folders?This attribute allows users worldwide to manage their files in their native languages.

New Technology File System (NTFS)

Which of the following are features of NTFS?

NTFS uses the b-tree directory scheme to store information about file clusters

Which of the following are features of NTFS?

NTFS stores the information about a file’s clusters and other data within the cluster

Which of the following are features of NTFS?

NTFS supports files of size up to approximately 16 billion bytes

Which of the following are features of NTFS?

An access-control list (ACL) allows the server administrator to access specific files

Which of the following are features of NTFS?

NTFS features integrated file compression

Which of the following are features of NTFS?

NTFS provides data security on both removable and fixed disks

Which of the following components is a part of the NTFS architecture?

Hard disk

Which of the following components is a part of the NTFS architecture?

Master Boot Record

Which of the following components is a part of the NTFS architecture?

Boot Sector

Which of the following components is a part of the NTFS architecture?

Ntldlr.dll

Which of the following components is a part of the NTFS architecture?

Ntfs.sys

Which of the following components is a part of the NTFS architecture?

Kernel mode

Which of the following components is a part of the NTFS architecture?

User mode

What component of NTFS is comprised of at least one partition?

Hard disk

What component of NTFS contains executable master boot code that the computer system BIOS loads into memory; this code is used to scan the Master Boot Record to locate the partition table to find out which partition is active/bootableleast one partition?

Master Boot Record

What component of NTFS is also known as volume boot record (VBR), it is a very first sector found in a NTFS filesystem which stores the boot code and other information, such as the type, location of size of data in NTFS filesystem?

Boot Sector

What component of NTFS as a boot loader, it accesses the NTFS filesystem and loads contents of the boot.ini file?

Ntldlr.dll

What component of NTFS is a computer system file driver for NTFS?

Ntfs.sys

What component of NTFS is the processing mode that permits the executable code to have direct access to all the system components?

Kernel mode

What component of NTFS is the processing mode in which an executable program or code runs?

User mode

Which of the following NTFS system files contain file-system metadata?

$attrdef

Which of the following NTFS system files contain file-system metadata?

$badclus

Which of the following NTFS system files contain file-system metadata?

$bitmap

Which of the following NTFS system files contain file-system metadata?

$boot

Which of the following NTFS system files contain file-system metadata?

$logfile

Which of the following NTFS system files contain file-system metadata?

$mft

Which of the following NTFS system files contain file-system metadata?

$mftmirr

Which of the following NTFS system files contain file-system metadata?

$quota

Which of the following NTFS system files contain file-system metadata?

$upcase

Which of the following NTFS system files contain file-system metadata?

$volume

Which of the following NTFS system files contains definitions of all system-and user-defined attributes of the volume?

$attrdef

Which of the following NTFS system files contains all the bad clusters?

$badclus

Which of the following NTFS system files contains bitmap for the entire volume?

$bitmap

Which of the following NTFS system files contains the volume's bootstrap?

$boot

Which of the following NTFS system files is used for recovery purposes?

$logfile

Which of the following NTFS system files is a mirror of the MFT used for recovering files?

$mft

Which of the following NTFS system files contains a record for every file?

$mftmirr

Which of the following NTFS system files converts characters into uppercase Unicode?

$upcase

Which of the following NTFS system files contains volume name and version number?

$volume

When was Encrypting File System (EFS) first introduced?

Version 3.0 of NTFS

What offers file system-level encryption?

Encrypting File System (EFS)

What has the Encrypting File System (EFS) as a built-in feature?

New Technology File System (NTFS)

What encryption technology maintains a level of transparency for the users who encrypted a file?

Encrypting File System (EFS)

To take the best advantage of the encryption capability, experts recommend that the

system should have encryption at the_____

Folder level

What is a part of the security subsystem, acts as an interface with the EFS driver by using the local procedure call (LPC) communication port between the Local Security Authority (LSA) and the kernel-mode security reference monitor?

Encryption File System (EFS) Service

What acts as an interface with CryptoAPI in the user mode in order to derive file encryption keys to generate data decryption fields (DDFs) and data recovery fields (DRFs)? This service also supports Win32 application programming interfaces (APIs).

Encryption File System (EFS) Service

What uses CryptoAPI to extract the file encryption key (FEK) for a data file and uses it to encode the FEK and produce the DDF?

Encryption File System (EFS) Service

What is a file system filter driver stacked on top of NTFS. It connects with the EFS service to obtain file encryption keys, DDFs, DRFs, and other key management services.

Encryption File System (EFS) Driver

What sends information to the EFS file system runtime library (FSRTL) to perform file-system functions such as open, read, write, and append?

Encryption File System (EFS) Driver

What contains a set of functions that allow application developers to encrypt their Win32 applications; these functions allow applications to encrypt or digitally sign data and offer security for private key data?

CryptoAPI

What supports public-key and symmetric-key operations such as generation, management and secure storage, exchange, encryption, decryption, hashing, digital signatures, and the verification of signature?

CryptoAPI

What is a part of the EFS driver that implements NTFS callouts to handle various file-system operations such as reads, writes, and opens on encrypted files and directories, as well as operations to encrypt, decrypt, and recover file data when the system writes it to or reads it from the disk?

Encryption File System (EFS) FSRTL

EFS provides an API set to provide access to its features; the API set also provides a programming interface for operations such as the encryption of plaintext files, decryption or recovery of ciphertext files, and import and export of encrypted files without decryption.

Win32 API

What is a type of computer file that attempts to use file-system space more efficiently when blocks allocated to the file are mostly empty?

Sparse file

To improve efficiency, what file system writes brief information (metadata) about the file in the empty blocks to fill the block using a low amount of disk space?

Sparse file

What offers a technique of saving disk space by allowing the I/O subsystem to allocate only meaningful (nonzero) data?

Sparse file

What OS uses different file systems to store data?

Linux

The Linux file system architecture consists of two parts. Which of the following is one of the two parts?

User space

The Linux file system architecture consists of two parts. Which of the following is one of the two parts?

Kernel space

What is the protected memory area where user processes run, and this area contains the available memory?

User space

What is the memory space where the system supplies all kernel services through kernel processes? Users can access this space through a system call only. A user process turns into a kernel process only when it executes a system call.

Kernel space

What sits between the user space and kernel space and provides the system call interface that connects the kernel to user-space applications?

GNU C Library (glibc)

What is an abstract layer on top of a complete file system and allows client applications to access various file systems?

Virtual File System (VFS)

What internal architecture consists of a dispatching layer, which provides filesystem abstraction and numerous caches to enhance the performance of file-system operations?

Virtual File System (VFS)

What has a single hierarchical tree structure representing the file system as a single entity and supports many different file systems and implements a basic set of common concepts, which were originally developed for UNIX?

Linux

What was Linux’s first file system?

Minix

What defines the directory structure and its contents in Linux and Unix-like OSes?

Filesystem Hierarchy Standard (FHS)

What has all files and directories are present under the root directory

(represented by /)?

Filesystem Hierarchy Standard (FHS)

What FHS directory Essential command binaries; e.g., cat, ls,

cp?

/bin

What FHS directory Static files of the boot loader; e.g.,

Kernels, Initrd?

/boot

What FHS directory Essential device files; e.g., /dev/null?

/dev

What FHS directory Host-specific system configuration files?

/etc

What FHS directory Users’ home directories, which hold saved files, personal settings, etc?

/home

What FHS directory Essential libraries for the binaries in /bin/ and /sbin/?

/lib

What FHS directory Mount points for removable media?

/media

What FHS directory Temporarily mounted file systems?

/mnt

What FHS directory Add-on application software packages?

/opt

What FHS directory is the Home directory for the root user?

/root

What FHS directory Virtual file system providing process and

kernel information as files?

/proc

What FHS directory Information about running processes; e.g., running daemons, currently logged- In users?

/run

What FHS directory Contains the binary files required for working?

/sbin

What FHS directory Site-specific data for services provided by the system?

/srv

What FHS directory are temporary files?

/tmp

What FHS directory Secondary hierarchy for read-only user data?

/usr

What FHS directory Variable data; e.g., logs, spool files, etc?

/var