Centennial College - COMP CNET239LAB 09.

Document Content and Description Below

Chapter 9 Lab 9.1 Review Questions 1. How many exact matches were found for the keyword “project”? 2. Autopsy displays SHA-1 hash values with each file result. True or False? 3. Was Jim Shu�... ��s e-mail address found in the list of e-mail addresses 4. How many PDF files are in the gcfi-ntfs.dd image? (Hint: Expand Views in the left pane to find the answer.) 5. In Autopsy, substring searches can reveal matches in which of the following? (Choose all that apply.) 1. FTK Imager can calculate only MD5 hash values. True or False? 2. What’s the SHA-1 hash value for the HISTORY.txt file? 3. FTK Imager can find files in hidden partitions and slack space. True or False 4. What’s the file size of the LFG.pdf file without slack space? 5. FTK Imager can’t be used to edit hex values. True or False Lab 9.3 Review Questions 1. WinHex can calculate only SHA-1 and MD5 hash values. True or False? 2. WinHex can edit hex values in file headers. True or False? 3. What’s the size in bytes of the HISTORY.txt file? 4. The hex values of the first 4 [Show More]

Last updated: 1 year ago

Preview 1 out of 2 pages