Term
|
Definition
| type of computer file that attempts to use FS space more efficiently when blocks allocated to the file are mostly empty |
|
|
Term
|
Definition
| command on Vista to display all ADS's |
|
|
Term
| How many files does $MFT_Mirr back up? |
|
Definition
|
|
Term
| Two attributes unique to $Volume_Data? |
|
Definition
| $Volume_Data and $Volume_Information |
|
|
Term
| The operating system initially reserves ____% of disk space after the MFT for the MFT ZOne? |
|
Definition
|
|
Term
| DOS Command to make the content of a file named "student.jpg" an alternate data stream for the file named "class.mov" is.... |
|
Definition
|
|
Term
| Reparse Point was a feature introduced in NTFS Version_____ |
|
Definition
|
|
Term
| Conceptually, Hard Links are similar to ________ |
|
Definition
|
|
Term
| What allows data backup programs to archive files currently in use by the system?? |
|
Definition
|
|
Term
| What groups changes to files togather into a transaction? |
|
Definition
|
|
Term
| What allows identical files to be merged to one file? |
|
Definition
|
|
Term
| Both $INDEX_ROOT and $INDEX_ALLOCATIONS are named _____ |
|
Definition
|
|
Term
| A tree is a collection of nodes connected by _____ edges with no ______. |
|
Definition
|
|
Term
| A _____ special kind of tree optimized for searching. |
|
Definition
|
|
Term
| _____ command line program formats a flash drive as NTFS volume. |
|
Definition
|
|
Term
| What is the most important file on an NTFS volume? |
|
Definition
|
|
Term
| Three improvements of NTFS over FAT? |
|
Definition
| 1. better performance. 2. better integrity, 3. higher amount file storage |
|
|
Term
| 3 peices of info that each MFT record holds |
|
Definition
| 1. Size of file 2. Location of file 3. File Name, 4. Length |
|
|
Term
| Identify as Positive or Negative Integer... CD AB 78 34 |
|
Definition
|
|
Term
| Identify as Positive or Negative Integer..12 34 56 87 |
|
Definition
|
|
Term
| On a windows NT 4.x volume, the first __ records of the $MFT are reserved |
|
Definition
|
|
Term
| What is the DOS command on Vista to display all ADSs? |
|
Definition
|
|
Term
| If an attribute is stored in an _______ MFT record, it is called external? |
|
Definition
|
|
Term
| Applications in Windows Vista can use _____ NTFS to group changes to files together into a trasaction. |
|
Definition
|
|
Term
| There are _____ types of directory index attributes. |
|
Definition
|
|
Term
| ______ registry root key stores the SID information |
|
Definition
|
|
Term
| NTFS can compress files using a variant of the ___ algorithm, which is also used in the popular ZIP file format. |
|
Definition
|
|
Term
| ____ feature of NTFS can be used in place of sparse files |
|
Definition
|
|
Term
| In Encrypting System, the encrypted data is stored is what? |
|
Definition
|
|
Term
| GUID is what hex digits in size? |
|
Definition
|
|
Term
| Directories in NTFS make use of _____ data structure |
|
Definition
|
|
Term
|
Definition
|
|
Term
|
Definition
| Globally Unique Identifier |
|
|
Term
| What is a small file which allows a user quicker access to a program or file? |
|
Definition
|
|
Term
| C:\Documents and Settings\\Desktop has what artifact? |
|
Definition
|
|
Term
| The four byte little-endian hex header of a shortcut file is what? |
|
Definition
|
|
Term
| Browsers save local copies of what for faster access? |
|
Definition
|
|
Term
| Path to a cookie file on XP is what? |
|
Definition
| C:\Documents and Settings\\cookies |
|
|
Term
| List two dates that a cookie file holds: |
|
Definition
| Modified Date. Expiry Date |
|
|
Term
| T/F: The physical size of an MFT record is contained within the record |
|
Definition
|
|
Term
| T/F: Fix-up code occurs a maximum of three time in a single $MFT entry |
|
Definition
|
|
Term
| T/F: Hard-link count takes long file names into considerations |
|
Definition
|
|
Term
| T/F: Volume serial number is contained in $Volume file |
|
Definition
|
|
Term
| T/F: $MFT is backed up in the very last sector of the partition |
|
Definition
|
|
Term
| T/F: The MFT can grow but never shrink |
|
Definition
|
|
Term
| T/F: Reparse points are used to implement Native Structured Storage |
|
Definition
|
|
Term
| T/F: Volume mount points are similar to UNIX Mount points |
|
Definition
|
|
Term
| T/F: Symbolic links were introduced in WIndows XP |
|
Definition
|
|
Term
| T/F: Slowest link in a notebook is not the CPU, but the speed of hard disk |
|
Definition
|
|
Term
| T/F: There are four types of Directory Index Attributes |
|
Definition
|
|
Term
| T/F: A node which does not have a parent is called a leaf node |
|
Definition
|
|
Term
| T/F: DIrectories cannot be hard-linked |
|
Definition
|
|
Term
| T/F: When original file is deleted, shortcut is recyclyed |
|
Definition
|
|
Term
| T/F: Size of an MFT entry is 1KB |
|
Definition
|
|
Term
| T/F: NTFS was first introduced in 1995 |
|
Definition
|
|
Term
| T/F: NTFS system files can be anywhere in the volume except $BOOT |
|
Definition
|
|
Term
| T/F: Every sector in an NTFS volume is available for file storage |
|
Definition
|
|
Term
| T/F: Size of an MFT record is specified in the record header |
|
Definition
|
|
Term
| $Boot on NTFS is same as _____ on a FAT file system |
|
Definition
|
|
Term
| T/F: Symbolic links were introduced in Windows Vista |
|
Definition
|
|
Term
| T/F: Reparse point was introduced in NTFS v3 |
|
Definition
|
|
Term
| T/F: Hard links are used to link directories |
|
Definition
|
|
Term
| T/F: A leaf node cannot have children |
|
Definition
|
|
Term
| T/F: Well known SID "everyone" has the SID S-1-3-0 |
|
Definition
|
|
Term
| T/F: Unix "symbolic links to directories" is conceptually similar to Volume Mount Points |
|
Definition
|
|
Term
| T/F: Tree is a collection of nodes with cycles |
|
Definition
|
|
Term
| T/F: A shortcut file has extension file |
|
Definition
|
|
Term
| T/F: A cookie file is a simple executable file |
|
Definition
|
|
Term
| T/F: A prefetch folder can hold only 126 entries |
|
Definition
|
|
Term
| T/F: Prefetch time recorded at byte offset 120 is in EST. |
|
Definition
|
|
Term
| T/F: Size of an INFO2 Record on XP is 520 bytes |
|
Definition
|
|
Term
| Two standard MFT record header sizes are what? |
|
Definition
|
|
Term
| Size of MFT record attribute is given at byte-offset ____ for length of ______. |
|
Definition
|
|
Term
| List any five NTFS system files besides $Boot and $MFT |
|
Definition
| $MFTMirr,$LogFile, $Volume,$AttrDef, $Bitmap, $BadClus.... |
|
|
Term
|
Definition
|
|
