Name: _________________________ Date: _____________
Fill in your name above, put your full response below each question, save the file using the file naming convention: “ISSC456_Week1_Assignment_LastName_FirstName.doc” where LastName is your last name and FirstName is your first name, then return this document for grading.
You are required to answer the question(s) using course resources and the Internet
Assignment Rubric ( 100 Points)
Synthesis of Concepts
60
Writing Standards – APA format
20
Timeliness
20
1. Explain the difference between fixed and removable disk drives, and give at least one example of each.
2. Explain the Master File Table (MFT) and its contents.
More details;
Master File Table (MFT)
MFT or $MFT can be considered one of the most important files in the NTFS file system. It keeps records of all files in a volume, the files’ location in the directory, the physical location of the files in on the drive, and file metadata. The metadata includes file and folder create dates, entry modified dates, access dates, last written dates, physical and logical file size, and ACLs of the files. The file and directory metadata is stored as an MFT entry that is 1024 bytes in size. The first 16 entries in the MFT belong to system files, such as the MFT itself. From a forensics investigator perspective, entries are very interesting because when a file is deleted an entry gets marked as unallocated while the file content on the drive remains intact. The file name in the MFT entry can be overwritten due to MFT tree structure reorganization so most of the time file names are not maintained. File data eventually is overwritten as the unallocated drive space gets used.