wgu d431

wgu d431 Leave the first rating Students also studied Terms in this set (15) Save

WGU - D426: Objective Assessment...

151 terms natesoundslike Preview D426 Data Management - Foundati...103 terms lashawnleary6ctr Preview Linux Command Line Cheat Sheet 140 terms daniel_ramos232 Preview WGU D 160 term Mo Practice questions for this set Learn1 / 7Study using Learn user preferences + this folder maintains the preferences of programs that have been deleted.Which file in Windows XP keeps track of deleted files? info2 (recycle bin) /var/log (MacOS & linux)general repository for logs. /var/log/daily.out contains data on all mounted volumes, including the dates they were mounted. This is very important in cases involving stolen data. You can see what devices have been attached and get data from them. This folder includes data on removable media, including serial numbers.Choose an answer 1/Users//Library/Preferences (MacOS) 2 Which file in Windows XP keeps track of deleted files?3The date Command (MacOS)4/private/var/VM Folder (MacOS) Don't know?

/var/spool/cups (MacOS)printed docs /private/var/audit Logs (MacOS)logs of system audits. This includes things like user login - these logs are often not in a human-readable format./private/var/VM Folder (MacOS)ontains swap and sleep image files. If you hibernate your Mac, this directory will usually occupy more than 5 gigabytes of disk space - useful for forensics./Library/Receipts (macOS)information about system and software updates. It is less useful for forensics./Library/Mobile (MacOSsyncs with iCloud /Users//.bash_history (MacOS)bash shell history. useful for forensics var/vm (MacOS)In this folder, you will find a subfolder named app profile. This will contain lists of recently opened applications as well as temporary data used by applications /Users//Library/Preferences (MacOS)user preferences + this folder maintains the preferences of programs that have been deleted./etc (MacOS & linux)this is where configuration files are located. useful for forensics /Library/Preferences/SystemConfiguration/dom.apple.pr eferences.plist File This file contains the network configuration data for each network card. This is important information to document before beginning your search for evidence.Target Disk ModeWhen you put MacOS in this mode, it cannot be written to, so there is no chance of altering the source disk. Then simply connect to the suspect computer with universal serial bus (USB) or FireWire and image the disk. - Also,this Mode allows you to preview the computer on-site. This allows investigators to do a quick inspection before disconnecting and transporting the computer to a forensic lab.This is important because, just like with Windows or Linux, you will want to check running systems' processes before shutting the machine down. You simply have to reboot the machine in this Mode.The date Command (MacOS)Returns the current date and time zone. It is good for documenting when exactly you begin your forensic examination. If you need the date in Coordinated Universal Time (UTC), then use the date −u version of the command.Trash bin (MacOS)the Trash folder—much like the Recycle Bin in Windows. The Trash is represented on the file system as a hidden folder, .Trash, on the root directory of the file system.