UNIVERSITY EXAMINATIONS: 2016/2017
EXAMINATION FOR THE DIPLOMA IN NETWORK FORENSICS AND
COMPUTER SECURITY
DNF503 FILE SYSTEM AND MEDIA IMAGING
DATE: AUGUST, 2017 TIME: 2 HOURS
INSTRUCTIONS: Answer question ONE and any other TWO questions.
QUESTION ONE (30 MARKS) – COMPULSORY
a) Define the following terms (5 Marks)
i. A file
ii. File header
iii. Metadata
iv. Carving
v. Magic Rescue
b) File operation are available in different operations, discuss (5 Marks)
c) Describe briefly file types available in the market today ( 6 Marks)
d) Clearly state the procedure of file extraction in windows environment (9 Marks)
e) Discuss the role of the following file carver software (5 Marks)
i. CnW Recovery
ii. NFI Defraser
iii. CarvFs
iv. PhotoRescue
v. ReviveIt
QUESTION TWO (20 MARKS)
In order to store our data in a more secure way its important to identify files and allocate the
files with regards to their file extension in a given location.
a) Required, identify the available file extension in the field today (5Marks)
b) State the file path of choice justifying your decision (5 Marks)
c) You are running low of storage space (5 Marks)
d) State the relevant file actions that will be done (5 Marks)
QUESTION THREE (20 MARKS
a) Describe data carving explaining the relevant carving available in the market today
(10 Marks)
b) State the procedure of decompressing individual file clearly clarify the importance
(10 Marks)
QUESTION FOUR (20MARKS)
a) Discuss file Access mechanism (9Marks)
b) Discuss the relevant types of directory available in the industry (6 Marks)
c) Using example differentiate between program threats and system Threats (5 Marks)
QUESTION FIVE (20 MARKS)
a) Discuss how authentication can be achieved in data security (12 Marks)
b) What is disk imaging and its importance (8 Marks)
