____ involves sorting and searching through investigation findings to separate good data and suspicious data.

In ____, two or more disk drives become one large volume, so the computer views the disks as a single disk.

On older Mac OSs all information about the volume is stored in the ____.

In Linux, most applications and commands are in the ____ directory or its subdirectories bin and sbin.

In macOS, when you’re working with an application file, the ____ fork contains additional information, such as menus, dialog boxes, icons, executable code, and controls.

In Autopsy and many other forensics tools raw format image files don’t contain metadata.

A ____ is a column of tracks on two or more disk platters.

With a(n) ____ you can arrive at a scene, acquire the data you need, and return to the lab as quickly as possible.

On a Linux computer, ____  represents file systems exported to remote hosts.

____ is a tool for viewing network traffic graphically.