MidTerm-Quiz106

What are the two EOF descriptors?

The end of file descriptors are:
Logical EOF - the actual ending of the file
Physical EOF- The number of bytes alloted on the volume for a file

Review slides 24 and 25 for important image on EOF descriptors

Other side

What is a clump in Mac' file system?

Groups of contiguous allocation blocks
reduces fragmentation

What is the Master Directory Block (MDB) or the Volume Information Block(VIB)
The block an older macintosh uses to store all information about a volume

What is the Volume Control Block?

Stores information from the MDB when the OS mounts

What is the Extents Overflow File?

Stores file information that is not in the MDB or VCB.

What are the three application setting formats? (for mac OS)
Plaintext, plist files and SQLite Databases

What is FileVault used for?

Used to encrypt and decrypt a user's /user directory

What are Mac Keychains?

A file used to manage passwords for applications, Web Sites, and other file systems
Enables you to restore passwords

True or False: All deleted files go to the Trashes folder

False. Files deleted by the command line DO NOT go to the trashes folder.
However, all other files do.

(The wording of the question is important)

True or False: Deleted files are in the Trashes Folder

True. Deleted files are in the trashes folder

(The wording of the question is important)

When you copy a file in Mac OS X ______________________

The creation time is copied.
What does windows do with copied files that Mac OS X does not do?
Windows resets the timestamp of copied files.

List some acquisition methods of Mac OS X

Make an image of the device
Removing the harddrives of the mac mini and macbook air is difficult
Use a Mac-compatible forensic boot CD/DVD to make an image
Blackbag Technology sells acquisition products for Mac OS 9 and OS X
MacQuisition is a forensic boot CD that makes an image of the drive
After making an acquisition, examine the image with a tool that works with the
format you made

Which tools work with a RAW mac image?

Blackbag Macintosh Forensic Software
SubRosaSoft MacForensicsLab
Guidance Software EnCase
Magnet AXIOM
X-Way Forensics
AccessData FTK

Which two tools can enable/disable Disk Arbitration?

Blackbag Macintosh Forensic Software
SubRosaSoft MacForensicsLab

Tarball
A data file containing one or more files or whole directories and their contents
(much like a .zip)

What is Foremost?
Re-written as scalpel, Is a freeware carving tool that can read many image file
formats

Configuration file: foremost.conf(scalpel.conffor scalpel)

What is a bitmap image?

an image made of pixels

What is a raster image?

An image made with pixels. Pixels are stored in rows for printing

Screen resolution
Determines detail based on # of pixels

Based on the number of galaxies visible in the Hubble eXtreme Deep Field (Figure
20.1 in your text), the estimated number of galaxies in our observable universe is
about ______.
100 billion
Which of the following is not one of the three major categories of galaxies?
globular galaxies

Galaxies with disks but no evident spiral arms are called ______.
lenticular galaxies

On a graph plotting galaxy luminosities against galaxy colors, the red sequence
represents galaxies that are _________ than galaxies of the blue cloud.
larger and more elliptical

Which of the following best describes the status of the Milky Way in our Local
Group of galaxies?
It is one of the two largest galaxies in the group.

A standard candle is _________.

a light source of known luminosity

What is a Cepheid variable?

A type of luminous star that makes an excellent standard candle.

What two observable properties of a Cepheid variable are directly related to one
another?
the period between its peaks of brightness and its luminosity

What does Hubble's law tell us?

The more distant a galaxy, the faster it is moving away from us.

Given that white dwarf supernovae are such good standard candles, why don't we
use them to measure the distance to all galaxies?
They are rare events, so we have observed them in only a tiny fraction of all
galaxies.

Overall, what is our most accurate technique for measuring the distance to a
nearby star?
stellar parallax

When we use an analogy that represents the expanding universe with the surface
of an expanding balloon, what does the inside of the balloon represent?
The inside of the balloon does not represent any part of our universe.