Question 1

When a file is deleted in the FAT file system, what happens to the filename?

Accepted Answer

A)  It is zeroed out. 
B)  The first character of the directory entry is marked with a hex 00. 
C)  It is wiped from the directory. 
D)  The first character of the directory entry is marked with a hex E5. 
A)  It is zeroed out. 
B)  The first character of the directory entry is marked with a hex 00. 
C)  It is wiped from the directory. 
D)  The first character of the directory entry is marked with a hex E5.

Question 2

You are working in a computer forensic lab. A law enforcement investigator brings you a computer and a valid search warrant. You have legal authority to search the computer. The investigator hands you a piece of paper that has three printed checks on it. All three checks have the same check and account number. You image the suspect computer and open the evidence file with EnCase. You checks have the same check and account number. You image the suspect's computer and open the evidence file with EnCase. You perform a text search for the account number and check number. Nothing returns on the search results. You perform a text search for all other information found on the printed checks and there is still nothing returned in the search results. You run a signature analysis and check the gallery. You cannot locate any graphical copies of the printed checks in the gallery. At this point, is it safe to say that the checks are not located on the suspect computer?

Accepted Answer

A)  No. The images could be located a compressed file. 
B)  No. The images could be embedded in a document. 
C)  No. The images could be in unallocated clusters. 
D)  No. The images could be in an image format not viewable inside EnCase. 
E)  All of the above. 
A)  No. The images could be located a compressed file. 
B)  No. The images could be embedded in a document. 
C)  No. The images could be in unallocated clusters. 
D)  No. The images could be in an image format not viewable inside EnCase. 
E)  All of the above.

Question 3

If a hash analysis is run on a case, EnCase:

Accepted Answer

A)  Will compute a hash value of the evidence file and begin a verification process. 
B)  Will generate a hash set for every file in the case. 
C)  Will compare the hash value of the files in the case to the hash library. 
D)  Will create a hash set to the user specifications. 
A)  Will compute a hash value of the evidence file and begin a verification process. 
B)  Will generate a hash set for every file in the case. 
C)  Will compare the hash value of the files in the case to the hash library. 
D)  Will create a hash set to the user specifications.

Question 4

The following keyword was typed in exactly as shown. Choose the answer(s) that would result. All search criteria have default settings. Speed and Meth

Accepted Answer

A)  Meth 
B)  Meth Speed 
C)  Speed and Meth 
D)  Speed 
A)  Meth 
B)  Meth Speed 
C)  Speed and Meth 
D)  Speed

Question 5

Consider the following path in a FAT file system:

Accepted Answer

A)  From the My Pictures directory 
B)  From the My Documents directory 
C)  From the root directory C : \ 
D)  From itself 
A)  From the My Pictures directory 
B)  From the My Documents directory 
C)  From the root directory C : \ 
D)  From itself

Question 6

The end of a logical file to the end of the cluster that the file ends in is called:

Accepted Answer

A)  Allocated space 
B)  Slack 
C)  Unallocated space 
D)  Available space 
A)  Allocated space 
B)  Slack 
C)  Unallocated space 
D)  Available space

Question 7

When can an evidence file containing a NTFS partition be logically restored to a FAT 32 partition?

Accepted Answer

A)  Never 
B)  When the FAT 32 has the same number of sectors / clusters. 
C)  When the FAT 32 is the same size or bigger. 
D)  Both B and C 
A)  Never 
B)  When the FAT 32 has the same number of sectors / clusters. 
C)  When the FAT 32 is the same size or bigger. 
D)  Both B and C

Question 8

A personal data assistant was placed in an evidence locker until an examiner has time to examine it. Which of the following areas would require special attention?

Accepted Answer

A)  Chain-of-custody 
B)  Storage 
C)  There is no concern 
D)  Cross-contamination 
A)  Chain-of-custody 
B)  Storage 
C)  There is no concern 
D)  Cross-contamination

Question 9

What information in a FAT file system directory entry refers to the location of a file on the hard drive?

Accepted Answer

A)  The file size 
B)  The file attributes 
C)  The starting cluster 
D)  The fragmentation settings 
A)  The file size 
B)  The file attributes 
C)  The starting cluster 
D)  The fragmentation settings

Question 10

In DOS acquisition mode, if a physical drive is detected, but no partition information is displayed, what would be the cause:

Accepted Answer

A)  The partition scheme is not recognized by DOS. 
B)  There are no partitions present. 
C)  Both a and b 
D)  Neither a or b 
A)  The partition scheme is not recognized by DOS. 
B)  There are no partitions present. 
C)  Both a and b 
D)  Neither a or b

Question 11

When handling computer evidence, an investigator should:

Accepted Answer

A)  Make any changes to the evidence that will further the investigation. 
B)  Avoid making any changes to the original evidence. 
C)  Neither a or b 
D)  Both a and b 
A)  Make any changes to the evidence that will further the investigation. 
B)  Avoid making any changes to the original evidence. 
C)  Neither a or b 
D)  Both a and b

Question 12

The case number in an evidence file can be changed without causing the verification feature to report an error, if:

Accepted Answer

A)  The user utilizes a text editor. 
B)  The case information cannot be changed in an evidence file, without causing the verification feature to report an error. 
C)  The user utilizes the case information editor within EnCase. 
D)  The evidence file is reacquired. 
A)  The user utilizes a text editor. 
B)  The case information cannot be changed in an evidence file, without causing the verification feature to report an error. 
C)  The user utilizes the case information editor within EnCase. 
D)  The evidence file is reacquired.

Question 13

When a non-compressed evidence file is reacquired with compression, the acquisition and verification hash values for the evidence will remain the same for both files.

Accepted Answer

A) True 
 B)False

Question 14

For an EnCase evidence file acquired with a hash value to pass verification, which of the following must be true?

Accepted Answer

A)  The MD5 hash value must verify. 
B)  The CRC values must verify. 
C)  The CRC values and the MD5 hash value both must verify. 
D)  Either the CRC or MD5 hash values must verify. 
A)  The MD5 hash value must verify. 
B)  The CRC values must verify. 
C)  The CRC values and the MD5 hash value both must verify. 
D)  Either the CRC or MD5 hash values must verify.

Question 15

Assume that MyNote.txt was allocated to clusters 5, 9, and 11. Cluster 6, 7, and 8 belong to MyResume.doc. Both files have been deleted and the directory entry in the FAT file system for MyResume.doc has been overwritten. What clusters would EnCase use to undelete MyNote.txt?

Accepted Answer

A)  5,9,11 
B)  5,6,7 
C)  7,8,9 
D)  6,7,8 
A)  5,9,11 
B)  5,6,7 
C)  7,8,9 
D)  6,7,8

Question 16

All investigators using EnCase should run tests on the evidence file acquisition and verification process to:

Accepted Answer

A)  Insure that the investigator is using the proper method of acquisition. 
B)  Further the investigator understanding of the evidence file. 
C)  Give more weight to the investigator testimony in court. 
D)  All of the above. 
A)  Insure that the investigator is using the proper method of acquisition. 
B)  Further the investigator understanding of the evidence file. 
C)  Give more weight to the investigator testimony in court. 
D)  All of the above.

Question 17

A CPU is:

Accepted Answer

A)  A chip that would be considered the brain of a computer, which is installed on a motherboard. 
B)  A Central Programming Unit. 
C)  A motherboard with all required devices connected. 
D)  An entire computer box, not including the monitor and other attached peripheral devices. 
A)  A chip that would be considered the brain of a computer, which is installed on a motherboard. 
B)  A Central Programming Unit. 
C)  A motherboard with all required devices connected. 
D)  An entire computer box, not including the monitor and other attached peripheral devices.

Question 18

EnCase can build a hash set of a selected group of files.

Accepted Answer

A) True 
 B)False

Question 19

If cases are worked on a lab drive in a secure room, without any cleaning of the contents of the drive, which of the following areas would be of most concern?

Accepted Answer

A)  There is no concern 
B)  Cross-contamination 
C)  Chain-of-custody 
D)  Storage 
A)  There is no concern 
B)  Cross-contamination 
C)  Chain-of-custody 
D)  Storage

Question 20

The EnCase evidence file logical filename can be changed without affecting the verification of the acquired evidence.

Accepted Answer

A) True 
 B)False

When a file is deleted in the FAT file system, what happens to the filename?

If a hash analysis is run on a case, EnCase:

The following keyword was typed in exactly as shown. Choose the answer(s) that would result. All search criteria have default settings. Speed and Meth

Consider the following path in a FAT file system:

The end of a logical file to the end of the cluster that the file ends in is called:

When can an evidence file containing a NTFS partition be logically restored to a FAT 32 partition?

A personal data assistant was placed in an evidence locker until an examiner has time to examine it. Which of the following areas would require special attention?

What information in a FAT file system directory entry refers to the location of a file on the hard drive?

In DOS acquisition mode, if a physical drive is detected, but no partition information is displayed, what would be the cause:

When handling computer evidence, an investigator should:

The case number in an evidence file can be changed without causing the verification feature to report an error, if:

When a non-compressed evidence file is reacquired with compression, the acquisition and verification hash values for the evidence will remain the same for both files.

For an EnCase evidence file acquired with a hash value to pass verification, which of the following must be true?

Assume that MyNote.txt was allocated to clusters 5, 9, and 11. Cluster 6, 7, and 8 belong to MyResume.doc. Both files have been deleted and the directory entry in the FAT file system for MyResume.doc has been overwritten. What clusters would EnCase use to undelete MyNote.txt?

All investigators using EnCase should run tests on the evidence file acquisition and verification process to:

A CPU is:

EnCase can build a hash set of a selected group of files.

If cases are worked on a lab drive in a secure room, without any cleaning of the contents of the drive, which of the following areas would be of most concern?

The EnCase evidence file logical filename can be changed without affecting the verification of the acquired evidence.

Certification for EnCE Outside North America

Filters

Exam 1: Certification For ENCE North America

When a file is deleted in the FAT file system, what happens to the filename?

If a hash analysis is run on a case, EnCase:

The following keyword was typed in exactly as shown. Choose the answer(s) that would result. All search criteria have default settings. Speed and Meth

Consider the following path in a FAT file system:

The end of a logical file to the end of the cluster that the file ends in is called:

When can an evidence file containing a NTFS partition be logically restored to a FAT 32 partition?

A personal data assistant was placed in an evidence locker until an examiner has time to examine it. Which of the following areas would require special attention?

What information in a FAT file system directory entry refers to the location of a file on the hard drive?

In DOS acquisition mode, if a physical drive is detected, but no partition information is displayed, what would be the cause:

When handling computer evidence, an investigator should:

The case number in an evidence file can be changed without causing the verification feature to report an error, if:

When a non-compressed evidence file is reacquired with compression, the acquisition and verification hash values for the evidence will remain the same for both files.

For an EnCase evidence file acquired with a hash value to pass verification, which of the following must be true?

Assume that MyNote.txt was allocated to clusters 5, 9, and 11. Cluster 6, 7, and 8 belong to MyResume.doc. Both files have been deleted and the directory entry in the FAT file system for MyResume.doc has been overwritten. What clusters would EnCase use to undelete MyNote.txt?

All investigators using EnCase should run tests on the evidence file acquisition and verification process to:

A CPU is:

EnCase can build a hash set of a selected group of files.

If cases are worked on a lab drive in a secure room, without any cleaning of the contents of the drive, which of the following areas would be of most concern?

The EnCase evidence file logical filename can be changed without affecting the verification of the acquired evidence.

Certification for EnCE Outside North America

Filters