1|Page
NWIT263 MIDTERM CHAPTER 6 EXAM
QUESTIONS AND ANSWERS 2025
Explain the differences in resource and data forks used
in macOS. - ...ANSWER... ✔ ✔The data fork stores a
file's actual data and the resource fork contains file
metadata and application information.
Which of the following is the main challenge in acquiring
an image of a system running macOS? (Choose all that
apply.) - ...ANSWER... ✔ ✔b. Vendor training is
needed.
d. You need special tools to remove drives from a
system running macOS or open its case.
To recover a password in macOS, which tool do you
use? - ...ANSWER... ✔ ✔c. Keychain Access
What are the major improvements in the Linux Ext4 file
system? - ...ANSWER... ✔ ✔It added support for
partitions larger than 16 TB, improved management of
,2|Page
large files, and offered a more flexible approach to
adding file system features.
How does macOS reduce file fragmentation? -
...ANSWER... ✔ ✔By using clumps, which are groups
of contiguous allocation blocks
Linux is the only OS that has a kernel. True or False? -
...ANSWER... ✔ ✔False
Hard links work in only one partition or volume. True or
False? - ...ANSWER... ✔ ✔True
Which of the following Linux system files contains hashed
passwords for the local system? - ...ANSWER... ✔
✔d. /etc/shadow
Which of the following describes the superblock's
function in the Linux file system? (Choose all that apply.)
- ...ANSWER... ✔ ✔b. Specifies the disk geometry
and available space
c. Manages the file system, including configuration
information
,3|Page
What's the Disk Arbitration feature used for in macOS? -
...ANSWER... ✔ ✔It's used to disable and enable
automatic mounting when a drive is connected via a USB
or FireWire device.
In Linux, which of the following is the home directory for
the superuser? - ...ANSWER... ✔ ✔b. root
Which of the following certifies when an OS meets UNIX
requirements? - ...ANSWER... ✔ ✔c. The Open
Group
On most Linux systems, current user login information is in
which of the following locations? - ...ANSWER... ✔
✔d. /var/log/utmp
Hard links are associated with which of the following? -
...ANSWER... ✔ ✔b. A specific inode
Which of the following describes plist files? (Choose all
that apply.) - ...ANSWER... ✔ ✔a. You must have a
special editor to view them.
c. They're preference files for applications.
, 4|Page
Data blocks contain actual files and directories and are
linked directly to inodes. True or False? - ...ANSWER...
✔ ✔True
Which of the following is a new file added in macOS?
(Choose all that apply.) - ...ANSWER... ✔ ✔c.
/var/db/diagnostics
d. /var/db/uuid.text
Forensics software tools are grouped into _________
and _______________ applications. - ...ANSWER... ✔
✔GUI, command-line
According to ISO standard 27037, which of the
following is an important factor in data acquisition?
(Choose all that apply.) - ...ANSWER... ✔ ✔a. The
DEFR's competency
c. Use of validated tools
An encrypted drive is one reason to choose a logical
acquisition. True or False? - ...ANSWER... ✔ ✔True
NWIT263 MIDTERM CHAPTER 6 EXAM
QUESTIONS AND ANSWERS 2025
Explain the differences in resource and data forks used
in macOS. - ...ANSWER... ✔ ✔The data fork stores a
file's actual data and the resource fork contains file
metadata and application information.
Which of the following is the main challenge in acquiring
an image of a system running macOS? (Choose all that
apply.) - ...ANSWER... ✔ ✔b. Vendor training is
needed.
d. You need special tools to remove drives from a
system running macOS or open its case.
To recover a password in macOS, which tool do you
use? - ...ANSWER... ✔ ✔c. Keychain Access
What are the major improvements in the Linux Ext4 file
system? - ...ANSWER... ✔ ✔It added support for
partitions larger than 16 TB, improved management of
,2|Page
large files, and offered a more flexible approach to
adding file system features.
How does macOS reduce file fragmentation? -
...ANSWER... ✔ ✔By using clumps, which are groups
of contiguous allocation blocks
Linux is the only OS that has a kernel. True or False? -
...ANSWER... ✔ ✔False
Hard links work in only one partition or volume. True or
False? - ...ANSWER... ✔ ✔True
Which of the following Linux system files contains hashed
passwords for the local system? - ...ANSWER... ✔
✔d. /etc/shadow
Which of the following describes the superblock's
function in the Linux file system? (Choose all that apply.)
- ...ANSWER... ✔ ✔b. Specifies the disk geometry
and available space
c. Manages the file system, including configuration
information
,3|Page
What's the Disk Arbitration feature used for in macOS? -
...ANSWER... ✔ ✔It's used to disable and enable
automatic mounting when a drive is connected via a USB
or FireWire device.
In Linux, which of the following is the home directory for
the superuser? - ...ANSWER... ✔ ✔b. root
Which of the following certifies when an OS meets UNIX
requirements? - ...ANSWER... ✔ ✔c. The Open
Group
On most Linux systems, current user login information is in
which of the following locations? - ...ANSWER... ✔
✔d. /var/log/utmp
Hard links are associated with which of the following? -
...ANSWER... ✔ ✔b. A specific inode
Which of the following describes plist files? (Choose all
that apply.) - ...ANSWER... ✔ ✔a. You must have a
special editor to view them.
c. They're preference files for applications.
, 4|Page
Data blocks contain actual files and directories and are
linked directly to inodes. True or False? - ...ANSWER...
✔ ✔True
Which of the following is a new file added in macOS?
(Choose all that apply.) - ...ANSWER... ✔ ✔c.
/var/db/diagnostics
d. /var/db/uuid.text
Forensics software tools are grouped into _________
and _______________ applications. - ...ANSWER... ✔
✔GUI, command-line
According to ISO standard 27037, which of the
following is an important factor in data acquisition?
(Choose all that apply.) - ...ANSWER... ✔ ✔a. The
DEFR's competency
c. Use of validated tools
An encrypted drive is one reason to choose a logical
acquisition. True or False? - ...ANSWER... ✔ ✔True
