Which of the following filesystem is used by Mac OS X?

Hackers can gain access to Windows Registry and manipulate user passwords, DNS settings,
access rights or others features that they may need in order to accomplish their objectives. One
simple method for loading an application at startup is to add an entry (Key) to the following
Registry Hive:

You are a computer forensics investigator working with local police department and you are called
to assist in an investigation of threatening emails. The complainant has printer out 27 email
messages from the suspect and gives the printouts to you. You inform her that you will need to
examine her computer because you need access to the ______________ in order to track the
emails back to the suspect.

The rule of thumb when shutting down a system is to pull the power plug. However, it has certain
drawbacks. Which of the following would that be?

The efforts to obtain information before a trail by demanding documents, depositions, questioned
and answers written under oath, written requests for admissions of fact and examination of the
scene is a description of what legal term?

Microsoft Outlook maintains email messages in a proprietary format in what type of file?

Law enforcement officers are conducting a legal search for which a valid warrant was obtaineD.
While conducting the search, officers observe an item of evidence for an unrelated crime that was
not included in the warrant. The item was clearly visible to the officers and immediately identified

as evidence. What is the term used to describe how this evidence is admissible?

You are working as an independent computer forensics investigator and receive a call from a
systems administrator for a local school system requesting your assistance. One of the students at
the local high school is suspected of downloading inappropriate images from the Internet to a PC
in the Computer laB. When you arrive at the school, the systems administrator hands you a hard
drive and tells you that he made a simple backup copy of the hard drive in the PC and put it on this
drive and requests that you examine that drive for evidence of the suspected images. You inform
him that a simple backup copy will not provide deleted files or recover file fragments. What type of
copy do you need to make to ensure that the evidence found is complete and admissible in future
proceedings?

You are assisting in the investigation of a possible Web Server Hack. The company who called
you stated that customers reported to them that whenever they entered the web address of the
company in their browser, what they received was a porno graphic web site. The company
checked the web server and nothing appears wrong. When you type in the IP address of the web
site in your browser everything appears normal. What is the name of the attack that affects the
DNS cache of the name resolution servers, resulting in those servers directing users to the wrong
web site?

In conducting a computer abuse investigation you become aware that the suspect of the
investigation is using ABC Company as his Internet Service Provider (ISP). You contact ISP and
request that they provide you assistance with your investigation. What assistance can the ISP
provide?