Ence Practice Test Questions

Front 1

To undelete a file in the FAT file system, EnCase computes the number of_______ the file will use based on the file ______.

Back 1

Clusters; file size

Front 2

ROM is an acronym for:

Back 2

Read Only Memory

Front 3

Search terms are case sensitive by default.

Back 3

False

Front 4

Within EnCase, you highlight a range of data within a file. The lengthindicator displays the value 30.How many bytes have you actually selected?

Back 4

30

Front 5

A sector on a floppy disk is the same size as a sector on a NTFS formattedhard drive.

Back 5

True

Front 6

Pressing the power button on a computer that is running could have whichof the following results?

Back 6

The operating system will shut down normally, The computer will instantly shut off, The computer will go into stand-by mode, or Nothing will happen.

Front 7

In the EnCase environment, the term external viewers is best described as:

Back 7

Programs that are associated with EnCase to open specific file types.

Front 8

A SCSI drive is pinned as a master when it is:

Back 8

A SCSI drive is not pinned as a master.

Front 9

The term signature and header as they relate to a signature analysis are:

Back 9

Synonymous.

Front 10

Which of the following selections is NOT found in the case file?

Back 10

External viewers

Front 11

A file extension and signature can be manually added by:

Back 11

Using the new file signature feature under file signatures.

Front 12

In Windows, the file MyNote.txt is deleted from C Drive and isautomatically sent to the recycle Bin. The long filename was MyNote.txt and the shortfilename was MYNOTE.TXT. When viewing the recycle Bin with EnCase, how will the longfilename and short filename appear?

Back 12

MyNote.txt, DC0.txt

Front 13

You are investigating a case involving fraud. You seized a computer froma suspect who stated that the computer is not used by anyone other than himself. Thecomputer has Windows 98 installed on the hard drive. You find the filenameC:\downloads\check01.jpg that EnCase shows as being moved. The starting extent is0C4057. You find another filename :\downloads\chk1.dll with the starting extent 0C4057,which EnCase also shows as being moved. In the C:\Windows\System folder you find anallocated file named chk1.dll with the starting extent 0C4057. The chk1.dll file is aJPEG image of a counterfeit check. What can be deduced from your findings?

Back 13

The presence and location of the files is strong evidence the suspect committed thecrime.

Front 14

To undelete a file in the FAT file system, EnCase obtains the startingextent from the:

Back 14

Directory entry

Front 15

Which of the following would most likely be an add-in card?

Back 15

A video card that is connected to the motherboard in the AGP slot

Front 16

Which of the following is found in the FileSignatures.ini configurationfile?

Back 16

The information contained in the signature table

Front 17

The default export folder remains the same for all cases

Back 17

False

Front 18

Assume that MyNote.txt was allocated to clusters 5, 9, and 11. Cluster 6,7, and 8 belong to MyResume.doc. Both files have been deleted and the directory entryin the FAT file system for MyResume.doc has been overwritten. What clusters wouldEnCase use to undelete MyNote.txt?

Back 18

5,6,7

Front 19

Which of the following directories contain the information that is foundon a Windows 98 Desktop?

Back 19

C:\Windows\Desktop

Front 20

If a hard drive is left in a room while acquiring, and several personshave access to that room, which of the following areas would be of most concern?

Back 20

Chain-of-custody

Front 21

In Windows 2000 and XP, which of the following directories contain userpersonal folders?

Back 21

C:\Documents and Settings

Front 22

By default, what color does EnCase use for the contents of a logicalfile?

Back 22

Black

Front 23

A hash library would most accurately be described as:

Back 23

A file containing hash values from one or more selected hash sets.

Front 24

A standard DOS 6.22 boot disk is acceptable for booting a suspect drive.

Back 24

False

Front 25

By default, EnCase will display the data from the end of a logical file,Search... Search VenderListWAPSiteFreeDownNewUpdateAboutusto the end of the cluster, in what color:

Back 25

Red

Front 26

If a hash analysis is run on a case, EnCase:

Back 26

Will compare the hash value of the files in the case to the hash library.

Front 27

Creating an image of a hard drive that was seized as evidence:

Back 27

May only be done by trained personnel because the process has the potential to alterthe original evidence.

Front 28

Which of the following selections would be used to keep track of afragmented file in the FAT file system?

Back 28

The File Allocation Table

Front 29

A suspect typed a file on his computer and saved it to a floppy diskette.The filename was MyNote.txt. You receive the floppy and the suspect's computer. Thesuspect denies that the floppy disk belongs to him. You search the suspect's computerand locate only the filename within a .LNK file. The .LNK file is located in the folderC:\Windows\Recent. How you would use the .LNK file to establish a connection betweenthe file on the floppy diskette and the suspect computer?

Back 29

The dates and time of the file found in the .LNK file, at file offset 28, and The full path of the file, found in the .LNK file

Front 30

Using good forensic practices, when seizing a computer at a businessrunning Windows 2000 Server you should:

Back 30

Shut it down normally.

Front 31

A signature analysis has been run on a case. The result !Bad Signaturemeans:

Back 31

The file signature is unknown and the file extension is known.

Front 32

A FAT directory has as a logical size of:

Back 32

0 bytes

Front 33

What are the EnCase configuration .ini files used for?

Back 33

Storing information that will be available to EnCase each time it is opened,regardless of the active case(s).

Front 34

Assume that an evidence file is added to a case, the case is saved, andthe case is closed. What happens if the evidence file is moved, and the case is thenopened?

Back 34

EnCase asks for the location of the evidence file the next time the case is opened.

Front 35

The EnCase case file can be best described as:

Back 35

A file that contains information specific to one case.

Front 36

The case file should be archived with the evidence files at thetermination of a case.

Back 36

True

Front 37

Name of this set of binary numbers: 0000 0000 0000 0000 0000 0000 0000 0000

Back 37

Dword

Front 38

You are conducting an investigation and have encountered a computer thatis running in the field. The operating system is Windows XP. A software program iscurrently running and is visible on the screen.

Back 38

Photograph the screen and pull the plug from the back of the computer.

Front 39

An Enhanced Metafile would best be described as:

Back 39

A file format used in the printing process by Windows.

Front 40

Changing the filename of a file will change the hash value of the file.

Back 40

False

Front 41

The results of a hash analysis on an evidence file that has been added toa case will be stored in which of the following files?

Back 41

The case file

Front 42

In Unicode, one printed character is composed of ____ bytes of data.

Back 42

2

Front 43

To generate an MD5 hash value for a file, EnCase:

Back 43

Computes the hash value based on the logical file.

Front 44

What does the acronym BIOS stand for?

Back 44

Basic Input/Output System

Front 45

The EnCase signature analysis is used to perform which of the followingactions?

Back 45

Analyzing the relationship of a file signature to its file extension.

Front 46

The spool files that are created during a print job are __________ afterthe print job is completed.

Back 46

deleted

Front 47

The following keyword was typed in exactly as shown. Choose the answer(s)that would result. All search criteria have default settings.

credit card

Back 47

Credit Card, credit card

Front 48

What files are reconfigured or deleted by EnCase during the creation ofan EnCase boot disk?

Back 48

command.com , io.sys , drvspace.bin

Front 49

A hard drive was imaged using EnCase. The original drive was placed intoevidence. The restore feature was used to make a copy of the original hard drive.EnCase verifies the restored copy using:

Back 49

An MD5 hash

Front 50

Which of the following would be a true statement about the function ofthe BIOS?

Back 50

The BIOS is responsible for swapping out memory pages when RAM fills up.

The BIOS integrates compressed executable files with memory addresses for fasterexecution.

Front 51

Within EnCase, what is purpose of the default export folder?

Back 51

This is the folder that will be automatically selected when the copy/unerase featureis used.

Front 52

The following keyword was typed in exactly as shown. Choose the answer(s)that would result. All search criteria have default settings. Speed and Meth

Back 52

Speed and Meth

Front 53

You are assigned to assist with the search and seizure of severalcomputers. The magistrate ordered that the computers cannot be seized unless they arefound to contain any one of ten previously identified images. You currently have theten images in JPG format. Using the EnCase methodology, how would you best handle thissituation?

Back 53

Use FastBloc or a network/parallel port cable to preview the hard drives. Conduct ahash analysis of the files on the hard drives, using a hash library containing the hashvalues of the previously identified images.

Front 54

You are working in a computer forensic lab. A law enforcementinvestigator brings you a computer and a valid search warrant. You have legal authorityto search the computer. The investigator hands you a piece of paper that has threeprinted checks on it. All three checks have the same check and account number. Youimage the suspect's computer and open the evidence file with EnCase. You perform a textsearch for the account number and check number. Nothing returns on the search results.You perform a text search for all other information found on the printed checks andthere is still nothing returned in the search results. You run a signature analysis andcheck the gallery. You cannot locate any graphical copies of the printed checks in thegallery. At this point, is it safe to say that the checks are not located on thesuspect computer?

Back 54

No. The images could be in an image format not viewable inside EnCase, No. The images could be located a compressed file,No. The images could be embedded in a document, No. The images could be in unallocated clusters.

Front 55

You are investigating a case involving fraud. You seized a computer froma suspect who stated that the computer is not used by anyone other than himself. Thecomputer has Windows 98 installed on the hard drive. You find the filenameC:\downloads\check01.jpg?that EnCase shows as being moved. The starting extent is0C4057. You find another filename C:\downloads\chk1.dll with the starting extent0C4057, which EnCase also shows as being moved. In the C:\windows\System folder youfind an allocated file named chk1.dll with the starting extent 0C4057. The chk1.dllfile is a JPEG image of a counterfeit check. Could this information be used to refutethe suspect claim that he never knew it was on the computer?

Back 55

Yes, because the chk1.dll file was moved and renamed.

Front 56

How many partitions can be found in the boot partition table found at thebeginning of the drive?

Back 56

4

Front 57

In hexadecimal notation, one byte is represented by _____ character(s).

Back 57

2

Front 58

The EnCase evidence file is best described as:

Back 58

A bit stream image of the source hard drive written to a file, or several filesegments.

Front 59

In Windows 98 and ME, Internet based e-mail, such as Hotmail, will mostlikely be recovered in the _____________________ folder.

Back 59

C:\Windows\Temporary Internet files

Front 60

When an EnCase user double-clicks on a valid .jpg file, that file is:

Back 60

Copied to the EnCase specified temp folder and opened by an associated program.

Front 61

When a drive letter is assigned to a logical volume, that information istemporarily written the volume boot record on the hard drive.

Back 61

False

Front 62

A hash set would most accurately be described as:

Back 62

A group of hash values that can be added to the hash library.

Front 63

When a file is deleted in the FAT or NTFS file systems, what happens tothe data on the hard drive?

Back 63

Nothing

Front 64

Temp files created by EnCase are deleted when EnCase is properly closed.

Back 64

True

Front 65

For an EnCase evidence file acquired with a hash value to passverification, which of the following must be true?

Back 65

The CRC values and the MD5 hash value both must verify.

Front 66

The EnCase default export folder is:

Back 66

A case-specific setting that can be changed.

Front 67

A standard Windows 98 boot disk is acceptable for booting a suspectdrive.

Back 67

False

Front 68

Which of the following aspects of the EnCase evidence file can be changed during a reacquire of the evidence file?

Back 68

You cannot change the investigator name, the evidence number, the acquisition notes.

Front 69

EnCase can build a hash set of a selected group of files.

Back 69

True

Front 70

The signature table data is found in which of the following files?

Back 70

The configuration FileSignatures.ini file

Front 71

The following keyword was typed in exactly as shown. Choose the answer(s)that would result. All search criteria have default settings. Tom Jones

Back 71

Tom Jones, tom jones

Front 72

When a document is printed using EMF in Windows, what file(s) aregenerated in the spooling process?

Back 72

The .SPL file and The .S

Front 73

EnCase uses the _________________ to conduct a signature analysis.

Back 73

file signature table

Front 74

The MD5 hash algorithm produces a _____ number

Back 74

128 bit

Front 75

The Windows 98 Start Menu has a selection called documents which displaysa list of recently used files. Which of the following folders contain those files?

Back 75

C:\Windows\Recent

Front 76

The first sector on a hard drive is called the:

Back 76

Master boot record

Front 77

Before utilizing an analysis technique on computer evidence, theinvestigator should:

Back 77

Be trained in the employment of the technique.

Test the technique on simulated evidence in a controlled environment to confirm thatthe results are consistent.

Front 78

A signature analysis has been run on a case. The result ?*JPEG ?in thesignature column means:

Back 78

The file signature is a JPEG signature and the file extension is incorrect.

Front 79

EnCase marks a file as overwritten when _____________ has been allocatedto another file.

Back 79

the starting cluster of the file

Front 80

Will EnCase allow a user to write data into an acquired evidence file?

Back 80

No. Data cannot be added to the evidence file after the acquisition is made.

Front 81

When undeleting a file in the FAT file system, EnCase will check the_____________ to see if it has already been overwritten.

Back 81

FAT

Front 82

4 bits allows what number of possibilities?

Back 82

16

Front 83

An evidence file can be moved to another directory without changing thefile verification.

Back 83

True

Front 84

If cases are worked on a lab drive in a secure room, without any cleaningof the contents of the drive, which of the following areas would be of most concern?

Back 84

Cross-contamination

Front 85

A personal data assistant was placed in a evidence locker until anexaminer has time to examine it. Which of the following areas would require specialattention?

Back 85

Storage

Front 86

Which statement would most accurately describe a motherboard?

Back 86

The main circuit board that has slots for the microprocessor, RAM, ROM, and add-incards.

Front 87

The EnCase methodology dictates that the lab drive for evidence have a__________ prior to making an image.

Back 87

unique volume label

Front 88

When a file is deleted in the FAT file system, what happens to thefilename?

Back 88

The first character of the directory entry is marked with a hex E5.

Front 89

Which of the following is commonly used to encode e-mail attachments?

Back 89

Base64

Front 90

The FAT in the File Allocation Table file system keeps track of:

Back 90

File fragmentation, Every addressable cluster on the partition, and Clusters marked as bad

Front 91

What information should be obtained from the BIOS during computerforensic investigations?

Back 91

The date and time, The boot sequence

Front 92

Search terms are stored in what .ini configuration file?

Back 92

Keywords.ini

Front 93

Search results are found in which of the following files?

Back 93

The case file

Front 94

When Unicode is selected for a search keyword, EnCase

Back 94

Will find the keyword if it is either Unicode or ASCII.

Front 95

How many clusters can a FAT 16 system address?

Back 95

65,536

Front 96

You are at an incident scene and determine that a computer containsevidence as described in the search warrant. When you seize the computer, you should:

Back 96

Record the location that the computer was recovered from, Record the identity of the person(s) involved in the seizure, and Record the date and time the computer was seized.

Front 97

EnCase is able to read and examine which of the following file systems?

Back 97

NTFS FAT EXT3 HFS

Front 98

The Unicode system can address ____ characters?

Back 98

65,536

Front 99

The following keyword was typed in exactly as shown. Choose the answer(s)that would be found. All search criteria have default settings. Tom

Back 99

Tomorrow, Tom, Stomp, [e-mail]

Front 100

The temporary folder of a case cannot be changed once it has been set.

Back 100

False

Front 101

The maximum file segment size for an EnCase evidence file is:

Back 101

2000 MB

Front 102

A restored floppy diskette will have the same hash value as the originaldiskette.

Back 102

True

Front 103

GREP terms are automatically recognized as GREP by EnCase.

Back 103

False

Front 104

How many copies of the FAT are located on a FAT 32, Windows 98-formattedpartition?

Back 104

2

Front 105

By default, what color does EnCase use for slack?

Back 105

Red

Front 106

RAM is tested during which phase of the power-up sequence?

Back 106

During POST

Front 107

Searches and bookmarks are stored in the evidence file.

Back 107

False

Front 108

RAM is an acronym for:

Back 108

Random Access Memory

Front 109

When handling computer evidence, an investigator should:

Back 109

Avoid making any changes to the original evidence.

Front 110

The case number in an evidence file can be changed without causing theverification feature to report an error, if:

Back 110

The case information cannot be changed in an evidence file, without causing theverification feature to report an error.

Front 111

In the FAT file system, the size of a deleted file can be found:

Back 111

In the directory entry

Front 112

A sector on a hard drive contains how many bytes?

Back 112

512

Front 113

You are an investigator and have encountered a computer that is runningat the home of a suspect. The computer does not appear to be a part of a network. Theoperating system is Windows XP Home. No programs are visibly running. You should:

Back 113

Pull the plug from the back of the computer.

Front 114

The EnCase methodology dictates that ________ be created prior toacquiring evidence.

Back 114

A unique directory on the lab drive for case management

Front 115

This question addresses the EnCase for Windows search process. If atarget word is located in the unallocated space, and the word is fragmented betweenclusters 10 and 15, the search:

Back 115

Will not find it because the letters of the keyword are not contiguous.

Front 116

When does the POST operation occur?

Back 116

When the power button to a computer is turned on.

Front 117

Which is the proper formula for determining the size in bytes of a harddrive that uses cylinders (C), heads (H), and sectors (S) geometry?

Back 117

C X H X S X 512

Front 118

If cluster #3552 entry in the FAT table contains a value of this would mean:

Back 118

The cluster is unallocated

Front 119

The acronym ASCII stands for:

Back 119

American Standard Code for Information Interchange

Front 120

You are examining a hard drive that has Windows XP installed as theoperating system. You see a file that has a date and time in the deleted column. Wheredoes that date and time come from?

Back 120

Info2 file

Front 121

Within EnCase, what is the purpose of the temp folder?

Back 121

This is the folder used to hold copies of files that are sent to external viewers.

Front 122

Select the appropriate name for the below area of the binarynumbers.

0000 0000 0000 0000

Back 122

Word

Front 123

To later verify the contents of an evidence file?

Back 123

EnCase writes a CRC value for every 64 sectors copied.

Front 124

Assume that MyNote.txt has been deleted. The FAT file system directory entry for that file has been overwritten. The data for MyNote.txt is now:

Back 124

Unallocated

Front 125

An evidence file was archived onto five CD-Rom disks with the third filesegment on disk number three. Can the contents of the third file segment be verified byitself while still on the CD?

Back 125

Yes. Any segment of an evidence file can be verified through re-computing andcomparing the CRCs, even if it is on a CD.

Front 126

The EnCase evidence file logical filename can be changed without affecting the verification of the acquired evidence.

Back 126

True

Front 127

If an evidence file has been added to a case and completely verified,what happens if the data area within the evidence file is later changed?

Back 127

EnCase will detect the error when that area of the evidence file is accessed by theuser.

EnCase detect the error if the evidence file is manually re-verified.

EnCase will allow the examiner to continue to access the rest of the evidence filethat has not been changed.

Front 128

The BIOS chip on an IBM clone computer is most commonly located on:

Back 128

The motherboard

Front 129

Consider the following path in a FAT file system: C:\My Documents\MyPictures\Bikes. Where does the directory bikes receive its name?

Back 129

From the My Pictures directory

Front 130

The following GREP expression was typed in exactly as shown. Choose theanswer(s) that would result. 800[) \-]+555-1212

Back 130

[phone]

Front 131

How does EnCase verify that the case information (Case Number, Evidence Number, Investigator Name, etc) in an evidence file has not been damaged or changed,after the evidence file has been written?

Back 131

EnCase writes a CRC value of the case information and verifies the CRC value when the evidence is added to a case.

Front 132

Which of the following statements is more accurate?

Back 132

The Recycle Bin increases the chance of locating the existence of a file on acomputer.

Front 133

The first sector on a volume is called the:

Back 133

Volume boot sector or record

Front 134

When an EnCase user double-clicks on a file within EnCase whatdetermines the action that will result?

Back 134

The settings in the FileTypes.ini file.

Front 135

The following GREP expression was typed in exactly as shown. Choose theanswer(s) that would result. Bob@[a-z]+.com

Back 135

[e-mail]

Front 136

The following GREP expression was typed in exactly as shown. Choose theanswer(s) that would result. [^a-z]Tom[^a-z]

Back 136

Tom

Front 137

The following GREP expression was typed in exactly as shown. Choose theanswer(s) that would result. [\x00-\x05]\x00\x00\x00?[\x00-\x05]\x00\x00\x00

Back 137

04 00 00 00 FF FF BA

Front 138

This question addresses the EnCase for Windows search process. If atarget word is within a logical file, and it begins in cluster 10 and ends in cluster15 (the word is fragmented), the search:

Back 138

Will find it because EnCase performs a logical search.

Front 139

When a file is deleted in the FAT file system, what happens to the FAT?

Back 139

The FAT entries for that file are marked as available.

Front 140

In DOS and Windows, how many bytes are in one FAT directory entry?

Back 140

32

Front 141

When a non-compressed evidence file is reacquired with compression, the acquisition and verification hash values for the evidence will remain the same for both files.

Back 141

True

Front 142

An EnCase evidence file of a hard drive ________ be restored to anotherhard drive of equal or greater size.

Back 142

Can

Front 143

A hard drive has been formatted as NTFS and Windows XP was installed.The user used fdisk to remove all partitions from that drive. Nothing else was done.You have imaged the drive and have opened the evidence file with EnCase. What would bethe best way to examine this hard drive?

Back 143

Use the add Partition feature to rebuild the partition and then examine the system

Front 144

How are the results of a signature analysis examined?

Back 144

By sorting on the signature column in the table view.

Front 145

A CPU is:

Back 145

A chip that would be considered the brain of a computer, which is installed on amotherboard.

Front 146

If a floppy diskette is in the a drive, the computer will always boot tothat drive before any other device.

Back 146

False

Front 147

During the power-up sequence, which of the following happens first?

Back 147

The power On Self-Test.

Front 148

A hard drive has 8 sectors per cluster. File Mystuff.doc has a logicalfile size of 13,000 bytes. How many clusters will be used by Mystuff.doc?

Back 148

3

Front 149

Select the appropriate name for the below set of the binarynumbers.

0

Back 149

Bit

Front 150

The end of a logical file to the end of the cluster that the file ends in is called:

Back 150

Slack

Front 151

The boot partition table found at the beginning of a hard drive islocated in what sector?

Back 151

Master boot record

Front 152

What information in a FAT file system directory entry refers to thelocation of a file on the hard drive?

Back 152

The starting cluster

Front 153

The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. Jan 1 st , 2?0?00

Back 153

Jan 1st, 2000

Front 154

EnCase can make an image of a USB flash drive.

Back 154

True

Front 155

All investigators using EnCase should run tests on the evidence file acquisition and verification process to:

Back 155

Further the investigator understanding of the evidence file.

Give more weight to the investigator testimony in court.

Insure that the investigator is using the proper method of acquisition.

Front 156

Within EnCase, clicking on save on the toolbar affects what file(s)?

Back 156

The open case file

Front 157

Hash libraries are commonly used to:

Back 157

Identify files that are already known to the user.

Front 158

A logical file would be best described as:

Back 158

The data from the beginning of the starting cluster to the length of the file.

Front 159

You are investigating a case of child pornography on a hard drivecontaining Windows XP. In theC:\Documents and Settings\Bad Guy\Local Settings\Temporary Internet Files folder youfind three images of child pornography. You find no other copies of the images on thesuspect hard drive, and you find no other copies of the filenames. What can be deducedfrom your findings?

Back 159

The presence and location of the images is not strong evidence of possession.

Front 160

Which of the following items could contain digital evidence?

Back 160

Cellular phones

Digital cameras

Personal assistant devices

Credit card readers

Front 161

Bookmarks are stored in which of the following files?

Back 161

The case file

Front 162

Two allocated files can occupy one cluster, as long as they can both fitwithin the allotted number of bytes.

Back 162

False

Front 163

A SCSI host adapter would most likely perform which of the followingtasks?

Back 163

Make SCSI hard drives and other SCSI devices accessible to the operating system.

Front 164

How does EnCase verify that the evidence file contains an exact copy ofthe suspect hard drive?

Back 164

By means of an MD5 hash of the suspect hard drive compared to an MD5 hash of thedata stored in the evidence file.

Front 165

In DOS acquisition mode, if a physical drive is detected, but nopartition information is displayed, what would be the cause:

Back 165

There are no partitions present, and The partition scheme is not recognized by DOS.

Front 166

RAM is used by the computer to:

Back 166

Temporarily store electronic data that is being processed.

Front 167

If cluster number 10 in the FAT contains the number 55, this means:

Back 167

That cluster 10 is used and the file continues in cluster number 55.

Front 168

Within EnCase for Windows, the search process is:

Back 168

A search of the logical files, a search of the physical disk in unallocated clusters and other unused disk areas

Front 169

A physical file size is:

Back 169

The total size of all the clusters used by the file measured in bytes.

Front 170

A case file can contain ____ hard drive images?

Back 170

Any number of

Front 171

When can an evidence file containing a NTFS partition be logicallyrestored to a FAT 32 partition?

Back 171

Never

Front 172

Select the appropriate name for the below area of the binarynumbers.

0000

Back 172

Nibble

Front 173

C:\ volume of the hard drive are not made by DOS when acomputer is booted with a standard DOS 6.22 boot disk.

Back 173

False

Front 174

Select the appropriate name for the below area of the binary numbers.

0000 0000

Back 174

Byte