Question

1. Explain the difference between logical addresses and physical addresses in Microsoft file structures.

Answer:

2. To help prevent loss of information, software vendors, including Microsoft, now provide whole disk encryption. This feature creates new challenges in examining and recovering data from drivers. What are four features offered by whole disk encryption tools that forensics examiners should be aware of?

Answer:

3. What does the $Secure metadata file contain?

Answer:

4. Describe both ways in which file or folder information is    typically stored in an MFT record.

Answer:

5. Why are alternate data streams of particular interest when      examining NTFS disks?

Answer:

6. Describe the three current versions of FAT.

Answer:

7. When Microsoft introduced Windows 2000, it added optional built-in encryption to NTFS called Encrypting File System (EFS) . Explain how EFS works.

Answer:

8. What is a partition gap, and how might it be used to hide data?

Answer:

9. With the release of Windows Server 2012, Microsoft created a new file system: Resilient File System (ReFS) . State the features that are incorporated into ReFS's design.

Answer:

10. Compare the methods for deleting NTFS files.

Answer:

Answer 1

Q1.Answer)
The logical address in the computer is the virtual address and thus can only be viewed by the user. The users cannot view the physical address directly. The logical address cannot be viewed directly. To access the physical address, the logical address is used as a reference. The memory addresses which are generated by the CPU and for internal computer usage are the virtual addresses and the actual physical memory addresses which are used by the memory hardware to locate information are the physical addresses in the system. The logical addresses are mapped to the physical addresses. The logical address is actually generated by the CPU during the program execution but the physical address is the one which refers to a location in the memory unit.