In Linux -Computer Forensic

Noncommercial-Based Forensic Duplication

What does DD stand for, what are the command line parameters of DD?

How to list the partition info (size, starting address, etc.) of a hard disk?

How to create an ext2/ext3 file system on a hard disk?

How to copy suspects hard disk into one file?

How to restore the image of a hard disk stored in a file back to a hard disk if needed?

How to copy just one partition of the suspects disk into one file?

How to restore the image of a partition back to a hard disk if needed?

How to do question 4 and 5 over the network?

How to wipe a disk zero, random numbers, or certain patterns (such as writing your name over and over on every sector of the disk)?

Compare dd_rescue, dcfldd with DD

What is Qualified Forensic Duplicate?

Commercial-Based Forensic Duplication

List two commercial computer forensic duplication and analysis tool.

What is write blocker?

What is driver adapter?

Common forensic analysis techniques

What is inode?

What info does an inode contain?

Directories are implemented as a special type of files in Linux. What is in the directory entry?

What is the command in Linux to find the inode number of a file?

How to use debugfs to recover deleted files?

What is Link Count in an inode?

What are symbolic link and hard link respectively?

How to find the type of a file regardless of the file extension?