How is the Windows swap file, also known as page file, used?
Answer(s): C
Comprehensive and Detailed Explanation From Exact Extract:The Windows swap file, or page file, is a system file used to extend physical memory by storing data that cannot fit into the RAM. When RAM is full, the OS swaps inactive data pages to this file, thus augmenting RAM capacity.It does not replace bad sectors; that function is for disk management utilities.It is not primarily for security but for memory management.It is not reserved exclusively for system files but is used dynamically for memory paging.
Microsoft's official documentation and forensic guides like NIST SP 800-86 describe the page file's role in virtual memory management and its importance in forensic analysis because it may contain fragments of memory and sensitive information.
A forensic investigator wants to collect evidence from a file created by a Macintosh computer running OS X 10.8.Which file type can be created by this OS?
Comprehensive and Detailed Explanation From Exact Extract:Mac OS X 10.8 (Mountain Lion) uses the HFS+ (Hierarchical File System Plus) file system by default for its native storage volumes. HFS+ is Apple's proprietary file system introduced in the late 1990s, designed for macOS.ReiserFS is a Linux file system.MFS (Macintosh File System) is an outdated file system replaced by HFS.NTFS is a Windows file system.This is well documented in Apple technical specifications and forensic analysis standards for macOS systems.
Digital forensics references including NIST guidelines and vendor documentation confirm HFS+ as the standard file system for Mac OS X versions prior to APFS adoption.
Which operating system creates a swap file to temporarily store information from memory on the hard drive when needed?
Answer(s): D
Comprehensive and Detailed Explanation From Exact Extract:Windows uses a swap file (commonly called pagefile.sys) to extend physical memory (RAM) by temporarily storing data from memory to disk when RAM is insufficient. This allows the system to handle more data than the available RAM.Linux and Unix typically use dedicated swap partitions or swap files but refer to them differently and manage them in other ways.Mac OS X uses a paging file system but does not typically use a "swap file" in the Windows sense; it uses dynamic paging files instead.The terminology "swap file" is most commonly associated with Windows.
Microsoft Windows forensics guidelines and NIST documentation describe the page file's role in virtual memory management in Windows operating systems.
Which type of information does a Windows SAM file contain?
Comprehensive and Detailed Explanation From Exact Extract:The Windows Security Account Manager (SAM) file stores hashed passwords for local Windows user accounts. These hashes are used to authenticate users without storing plaintext passwords.The SAM file stores local account password hashes, not network passwords.Passwords are hashed (not encrypted) using algorithms like NTLM or LM hashes.Network password management occurs elsewhere (e.g., Active Directory).
NIST SP 800-86 and standard Windows forensics texts explain that the SAM file contains hashed local account credentials critical for forensic investigations involving Windows systems.
A USB flash drive was seized as evidence to be entered into a trial.Which type of evidence is this USB flash drive?
Comprehensive and Detailed Explanation From Exact Extract:Real evidence (also called physical evidence) refers to tangible objects that are involved in the crime or relevant to the investigation. A USB flash drive is physical evidence because it is an actual device containing potentially relevant digital data.Documentary evidence refers to written or recorded information, not physical devices.Demonstrative evidence is used to illustrate or clarify facts (e.g., models, charts).Testimonial evidence is oral or written statements provided by witnesses.
Digital forensics principles and legal evidentiary classifications (as outlined by NIST and court- admissibility guidelines) clearly categorize physical devices like USB drives as real evidence.
Post your Comments and Discuss WGU Digital-Forensics-in-Cybersecurity exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the Digital-Forensics-in-Cybersecurity content, but please register or login to continue.