Question 1

By default, what color does EnCase use for slack?

Accepted Answer

A)  Black on red 
B)  Red on black 
C)  Red 
D)  Black 
A)  Black on red 
B)  Red on black 
C)  Red 
D)  Black C

Question 2

To later verify the contents of an evidence file 7RODWHUYHULI\WKHFRQWHQWVRIDQHYLGHQFHILOH

Accepted Answer

A)  EnCase writes a CRC value for every 64 sectors copied. 
B)  EnCase writes a CRC value for every 128 sectors copied. 
C)  EnCase writes an MD5 hash value every 64 sectors copied. 
D)  EnCase writes an MD5 hash value for every 32 sectors copied. 
A)  EnCase writes a CRC value for every 64 sectors copied. 
B)  EnCase writes a CRC value for every 128 sectors copied. 
C)  EnCase writes an MD5 hash value every 64 sectors copied. 
D)  EnCase writes an MD5 hash value for every 32 sectors copied. A

Question 3

The following keyword was typed in exactly as shown. Choose the answer(s) that would be found. All search criteria have default settings. Tom

Accepted Answer

A)  Tomorrow 
B)  TomJ@hotmail.com 
C)  Tom 
D)  Stomp 
E)  None of the above 
A)  Tomorrow 
B)  TomJ@hotmail.com 
C)  Tom 
D)  Stomp 
E)  None of the above A,B,C,D

Question 4

You are conducting an investigation and have encountered a computer that is running in the field. The operating system is Windows XP. A software program is currently running and is visible on the screen. You should:

Accepted Answer

A)  Navigate through the program and see what the program is all about, then pull the plug. 
B)  Pull the plug from the back of the computer. 
C)  Photograph the screen and pull the plug from the back of the computer. 
D)  Pull the plug from the wall. 
A)  Navigate through the program and see what the program is all about, then pull the plug. 
B)  Pull the plug from the back of the computer. 
C)  Photograph the screen and pull the plug from the back of the computer. 
D)  Pull the plug from the wall.

Question 5

The first sector on a volume is called the:

Accepted Answer

A)  Master file table 
B)  Volume boot device 
C)  Volume boot sector or record 
D)  Master boot record 
A)  Master file table 
B)  Volume boot device 
C)  Volume boot sector or record 
D)  Master boot record

Question 6

The FAT in the File Allocation Table file system keeps track of:

Accepted Answer

A)  File fragmentation 
B)  Clusters marked as bad 
C)  Every addressable cluster on the partition 
D)  All of the above. 
A)  File fragmentation 
B)  Clusters marked as bad 
C)  Every addressable cluster on the partition 
D)  All of the above.

Question 7

Searches and bookmarks are stored in the evidence file.

Accepted Answer

A) True 
 B)False

Question 8

When a drive letter is assigned to a logical volume, that information is temporarily written the volume boot record on the hard drive.

Accepted Answer

A) True 
 B)False

Question 9

How does EnCase verify that the case information (Case Number, Evidence Number, Investigator Name, etc) in an evidence file has not been damaged or changed, after the evidence file has been written?

Accepted Answer

A)  EnCase writes a CRC value of the case information and verifies the CRC value when the evidence is added to a case. 
B)  EnCase does not verify the case information and case information can be changed by the user as it becomes necessary. 
C)  The .case file writes a CRC value for the case information and verifies it when the case is opened. 
D)  EnCase writes an MD5 hash value for the entire evidence file, which includes the case information, and verifies the MD5 hash when the evidence is added to a case. 
A)  EnCase writes a CRC value of the case information and verifies the CRC value when the evidence is added to a case. 
B)  EnCase does not verify the case information and case information can be changed by the user as it becomes necessary. 
C)  The .case file writes a CRC value for the case information and verifies it when the case is opened. 
D)  EnCase writes an MD5 hash value for the entire evidence file, which includes the case information, and verifies the MD5 hash when the evidence is added to a case.

Question 10

How many copies of the FAT are located on a FAT 32, Windows 98-formatted partition?

Accepted Answer

A)  2 
B)  3 
C)  1 
D)  4 
A)  2 
B)  3 
C)  1 
D)  4

Question 11

The EnCase methodology dictates that ________ be created prior to acquiring evidence.

Accepted Answer

A)  a unique directory on the lab drive for case management 
B)  a text file for notes 
C)  an .E01 file on the lab drive 
D)  All of the above 
A)  a unique directory on the lab drive for case management 
B)  a text file for notes 
C)  an .E01 file on the lab drive 
D)  All of the above

Question 12

A hard drive has been formatted as NTFS and Windows XP was installed. The user used fdisk to remove all partitions from that drive. Nothing else was done. You have imaged the drive and have opened the evidence file with EnCase. What would be the best way to examine this hard drive?

Accepted Answer

A)  Use the add Partition feature to rebuild the partition and then examine the system. 
B)  EnCase will not see a drive that has been fdisked. 
C)  Conduct a physical search of the hard drive and bookmark any evidence. 
D)  Use the Recovered Deleted Partitions feature and then examine the system. 
A)  Use the add Partition feature to rebuild the partition and then examine the system. 
B)  EnCase will not see a drive that has been fdisked. 
C)  Conduct a physical search of the hard drive and bookmark any evidence. 
D)  Use the Recovered Deleted Partitions feature and then examine the system.

Question 13

A standard DOS 6.22 boot disk is acceptable for booting a suspect drive.

Accepted Answer

A) True 
 B)False

Question 14

When a file is deleted in the FAT or NTFS file systems, what happens to the data on the hard drive?

Accepted Answer

A)  Nothing. 
B)  It is moved to a special area. 
C)  It is overwritten with zeroes. 
D)  The file header is marked with a Sigma so the file is not recognized by the operating system. 
A)  Nothing. 
B)  It is moved to a special area. 
C)  It is overwritten with zeroes. 
D)  The file header is marked with a Sigma so the file is not recognized by the operating system.

Question 15

A sector on a floppy disk is the same size as a sector on a NTFS formatted hard drive.

Accepted Answer

A) True 
 B)False

Question 16

An evidence file was archived onto five CD-Rom disks with the third file segment on disk number three. Can the contents of the third file segment be verified by itself while still on the CD?

Accepted Answer

A)  No. Archived files are compressed and cannot be verified until un-archived. 
B)  No. All file segments must be put back together. 
C)  Yes. Any segment of an evidence file can be verified through re-computing and comparing the CRCs, even if it is on a CD. 
D)  No. EnCase cannot verify files on CDs. 
A)  No. Archived files are compressed and cannot be verified until un-archived. 
B)  No. All file segments must be put back together. 
C)  Yes. Any segment of an evidence file can be verified through re-computing and comparing the CRCs, even if it is on a CD. 
D)  No. EnCase cannot verify files on CDs.

Question 17

GREP terms are automatically recognized as GREP by EnCase.

Accepted Answer

A) True 
 B)False

Question 18

Which of the following selections is NOT found in the case file

Accepted Answer

A)  External viewers 
B)  Pointers to evidence files 
C)  Signature analysis results 
D)  Search results 
A)  External viewers 
B)  Pointers to evidence files 
C)  Signature analysis results 
D)  Search results

Question 19

An Enhanced Metafile would best be described as:

Accepted Answer

A)  A compressed zip file. 
B)  A graphics file attached to an e-mail message. 
C)  A compound e-mail attachment. 
D)  A file format used in the printing process by Windows. 
A)  A compressed zip file. 
B)  A graphics file attached to an e-mail message. 
C)  A compound e-mail attachment. 
D)  A file format used in the printing process by Windows.

Question 20

Bookmarks are stored in which of the following files?

Accepted Answer

A)  The case file 
B)  The evidence file 
C)  The configuration Bookmarks.ini file 
D)  All of the above 
A)  The case file 
B)  The evidence file 
C)  The configuration Bookmarks.ini file 
D)  All of the above

By default, what color does EnCase use for slack?

To later verify the contents of an evidence file 7RODWHUYHULI\WKHFRQWHQWVRIDQHYLGHQFHILOH

The following keyword was typed in exactly as shown. Choose the answer(s) that would be found. All search criteria have default settings. Tom

You are conducting an investigation and have encountered a computer that is running in the field. The operating system is Windows XP. A software program is currently running and is visible on the screen. You should:

The first sector on a volume is called the:

The FAT in the File Allocation Table file system keeps track of:

Searches and bookmarks are stored in the evidence file.

When a drive letter is assigned to a logical volume, that information is temporarily written the volume boot record on the hard drive.

How does EnCase verify that the case information (Case Number, Evidence Number, Investigator Name, etc) in an evidence file has not been damaged or changed, after the evidence file has been written?

How many copies of the FAT are located on a FAT 32, Windows 98-formatted partition?

The EnCase methodology dictates that ________ be created prior to acquiring evidence.

A hard drive has been formatted as NTFS and Windows XP was installed. The user used fdisk to remove all partitions from that drive. Nothing else was done. You have imaged the drive and have opened the evidence file with EnCase. What would be the best way to examine this hard drive?

A standard DOS 6.22 boot disk is acceptable for booting a suspect drive.

When a file is deleted in the FAT or NTFS file systems, what happens to the data on the hard drive?

A sector on a floppy disk is the same size as a sector on a NTFS formatted hard drive.

An evidence file was archived onto five CD-Rom disks with the third file segment on disk number three. Can the contents of the third file segment be verified by itself while still on the CD?

GREP terms are automatically recognized as GREP by EnCase.

Which of the following selections is NOT found in the case file

An Enhanced Metafile would best be described as:

Bookmarks are stored in which of the following files?

Certification for EnCE Outside North America

Filters

Exam 1: Certification For ENCE North America

By default, what color does EnCase use for slack?

To later verify the contents of an evidence file 7RODWHUYHULI\WKHFRQWHQWVRIDQHYLGHQFHILOH

The following keyword was typed in exactly as shown. Choose the answer(s) that would be found. All search criteria have default settings. Tom

You are conducting an investigation and have encountered a computer that is running in the field. The operating system is Windows XP. A software program is currently running and is visible on the screen. You should:

The first sector on a volume is called the:

The FAT in the File Allocation Table file system keeps track of:

Searches and bookmarks are stored in the evidence file.

When a drive letter is assigned to a logical volume, that information is temporarily written the volume boot record on the hard drive.

How does EnCase verify that the case information (Case Number, Evidence Number, Investigator Name, etc) in an evidence file has not been damaged or changed, after the evidence file has been written?

How many copies of the FAT are located on a FAT 32, Windows 98-formatted partition?

The EnCase methodology dictates that ________ be created prior to acquiring evidence.

A hard drive has been formatted as NTFS and Windows XP was installed. The user used fdisk to remove all partitions from that drive. Nothing else was done. You have imaged the drive and have opened the evidence file with EnCase. What would be the best way to examine this hard drive?

A standard DOS 6.22 boot disk is acceptable for booting a suspect drive.

When a file is deleted in the FAT or NTFS file systems, what happens to the data on the hard drive?

A sector on a floppy disk is the same size as a sector on a NTFS formatted hard drive.

An evidence file was archived onto five CD-Rom disks with the third file segment on disk number three. Can the contents of the third file segment be verified by itself while still on the CD?

GREP terms are automatically recognized as GREP by EnCase.

Which of the following selections is NOT found in the case file

An Enhanced Metafile would best be described as:

Bookmarks are stored in which of the following files?

Certification for EnCE Outside North America

Filters