Question

QUESTION 1

1. $MFT file is present in all file systems.

   True

   False

QUESTION 2

1. This file system always stores a value of 0x55AA in byte number 510 and 511.

   		EXT1
   		NTFS
   		UFS2
   		FAT

QUESTION 3

1. The unallocated clusters on a disk

   		are empty.
   		may have data from previous allocation.
   		are of no interest to forensic engineer.
   		are of no interest to operating system.

QUESTION 4

1. In NTFS there are files that store the metadata for files.

   True

   False

  

QUESTION 5

1. Slack space is the

   		unused allocated space to files.
   		used allocated space to files.
   		space of no interest to hacker.
   		space of no interest to forensic engineer.

Answer 1

`Hey,

Note: Brother if you have any queries related the answer please do comment. I would be very happy to resolve all your queries.

1) FALSE

2) OPTION D IS CORRECT

3) OPTION D IS CORRECT

4) TRUE

5) OPTION A IS CORRECT

Kindly revert for any queries

Thanks.