Question 1

The EnCase signature analysis is used to perform which of the following actions?

Accepted Answer

A)  Analyzing the relationship of a file signature to its file extension. 
B)  Analyzing the relationship of a file signature to its file header. 
C)  Analyzing the relationship of a file signature to a list of hash sets. 
D)  Analyzing the relationship of a file signature to its computed MD5 hash value. 
A)  Analyzing the relationship of a file signature to its file extension. 
B)  Analyzing the relationship of a file signature to its file header. 
C)  Analyzing the relationship of a file signature to a list of hash sets. 
D)  Analyzing the relationship of a file signature to its computed MD5 hash value.

Question 2

RAM is used by the computer to:

Accepted Answer

A)  Execute the POST during start-up. 
B)  Temporarily store electronic data that is being processed. 
C)  Permanently store electronic data. 
D)  Establish a connection with external devices. 
A)  Execute the POST during start-up. 
B)  Temporarily store electronic data that is being processed. 
C)  Permanently store electronic data. 
D)  Establish a connection with external devices.

Question 3

What files are reconfigured or deleted by EnCase during the creation of an EnCase boot disk?

Accepted Answer

A)  command.com 
B)  autoexec.bat 
C)  drvspace.bin 
D)  io.sys 
A)  command.com 
B)  autoexec.bat 
C)  drvspace.bin 
D)  io.sys

Question 4

An EnCase evidence file of a hard drive ________ be restored to another hard drive of equal or greater size.

Accepted Answer

A)  can 
B)  cannot 
A)  can 
B)  cannot

Question 5

Within EnCase for Windows, the search process is:

Accepted Answer

A)  a search of the physical disk in unallocated clusters and other unused disk areas 
B)  a search of the logical files 
C)  both a and b 
D)  None of the above 
A)  a search of the physical disk in unallocated clusters and other unused disk areas 
B)  a search of the logical files 
C)  both a and b 
D)  None of the above

Question 6

When a file is deleted in the FAT file system, what happens to the FAT?

Accepted Answer

A)  The FAT entries for that file are marked as allocated. 
B)  Nothing. 
C)  It is deleted as well. 
D)  The FAT entries for that file are marked as available. 
A)  The FAT entries for that file are marked as allocated. 
B)  Nothing. 
C)  It is deleted as well. 
D)  The FAT entries for that file are marked as available.

Question 7

Changing the filename of a file will change the hash value of the file.

Accepted Answer

A) True 
 B)False

Question 8

Which of the following would be a true statement about the function of the BIOS?

Accepted Answer

A)  The BIOS integrates compressed executable files with memory addresses for faster execution. 
B)  The BIOS is responsible for checking and configuring the system after the power is turned on. 
C)  The BIOS is responsible for swapping out memory pages when RAM fills up. 
D)  Both a and c. 
A)  The BIOS integrates compressed executable files with memory addresses for faster execution. 
B)  The BIOS is responsible for checking and configuring the system after the power is turned on. 
C)  The BIOS is responsible for swapping out memory pages when RAM fills up. 
D)  Both a and c.

Question 9

A signature analysis has been run on a case. The result "JPEG" in the signature column means

Accepted Answer

A)  The file signature is unknown and the header is a JPEG. 
B)  The file signature is a JPEG signature and the file extension is incorrect. 
C)  The file signature is unknown and the file extension is JPEG. 
D)  None of the above. 
A)  The file signature is unknown and the header is a JPEG. 
B)  The file signature is a JPEG signature and the file extension is incorrect. 
C)  The file signature is unknown and the file extension is JPEG. 
D)  None of the above.

Question 10

Which of the following selections would be used to keep track of a fragmented file in the FAT file system?

Accepted Answer

A)  The directory entry for the fragmented file 
B)  The partition table of extents 
C)  The File Allocation Table 
D)  All of the above 
A)  The directory entry for the fragmented file 
B)  The partition table of extents 
C)  The File Allocation Table 
D)  All of the above

Question 11

The following keyword was typed in exactly as shown. Choose the answer(s) that would result. All search criteria have default settings. Tom Jones

Accepted Answer

A)  tom jones 
B)  Tom 
C)  Jones 
D)  Tom Jones 
A)  tom jones 
B)  Tom 
C)  Jones 
D)  Tom Jones

Question 12

Temp files created by EnCase are deleted when EnCase is properly closed.

Accepted Answer

A) True 
 B)False

Question 13

Assume that MyNote.txt has been deleted. The FAT file system directory entry for that file has been overwritten. The data for MyNote.txt is now:

Accepted Answer

A)  Overwritten 
B)  Allocated 
C)  Cross-linked 
D)  Unallocated 
A)  Overwritten 
B)  Allocated 
C)  Cross-linked 
D)  Unallocated

Question 14

You are investigating a case involving fraud. You seized a computer from a suspect who stated that the computer is not used by anyone other than himself. The computer has Windows 98 installed on the hard drive. You find the filename C : \ downloads\check01. jpg that EnCase shows as being moved. The starting extent is 0C4057. You find another filename :\downloads\chk1.dll with the starting extent 0C4057, which EnCase also shows as being moved. In the C : \ Windows\System folder you find an allocated file named chk1.dll with the starting extent 0C4057. The chk1.dll file is a JPEG image of a counterfeit check. What can be deduced from your findings?

Accepted Answer

A)  The presence and location of the files is strong evidence the suspect committed the crime. 
B)  The presence and location of the files is not strong evidence the suspect committed the crime. 
A)  The presence and location of the files is strong evidence the suspect committed the crime. 
B)  The presence and location of the files is not strong evidence the suspect committed the crime.

Question 15

Within EnCase, you highlight a range of data within a file. The length indicator displays the value 30. How many bytes have you actually selected?

Accepted Answer

A)  30 
B)  3 
C)  60 
D)  15 
A)  30 
B)  3 
C)  60 
D)  15

Question 16

You are at an incident scene and determine that a computer contains evidence as described in the search warrant. When you seize the computer, you should:

Accepted Answer

A)  Record nothing to avoid inaccuracies that might jeopardize the use of the evidence. 
B)  Record the location that the computer was recovered from. 
C)  Record the identity of the person(s) involved in the seizure. 
D)  Record the date and time the computer was seized. 
A)  Record nothing to avoid inaccuracies that might jeopardize the use of the evidence. 
B)  Record the location that the computer was recovered from. 
C)  Record the identity of the person(s) involved in the seizure. 
D)  Record the date and time the computer was seized.

Question 17

Search terms are stored in what .ini configuration file

Accepted Answer

A)  FileSignatures.ini 
B)  Keywords.ini 
C)  TextStyle.ini 
D)  FileTypes.ini 
A)  FileSignatures.ini 
B)  Keywords.ini 
C)  TextStyle.ini 
D)  FileTypes.ini

Question 18

Within EnCase, what is the purpose of the temp folder?

Accepted Answer

A)  This is the folder used to hold copies of files that are sent to external viewers. 
B)  This is the folder that will automatically store an evidence file when the acquisition is made in DOS. 
C)  This is the folder that temporarily stores all bookmark and search results. 
D)  This is the folder that will be automatically selected when the copy/unerase feature is used. 
A)  This is the folder used to hold copies of files that are sent to external viewers. 
B)  This is the folder that will automatically store an evidence file when the acquisition is made in DOS. 
C)  This is the folder that temporarily stores all bookmark and search results. 
D)  This is the folder that will be automatically selected when the copy/unerase feature is used.

Question 19

A suspect typed a file on his computer and saved it to a floppy diskette. The filename was MyNote.txt. You receive the floppy and the suspect computer. The suspect denies that the floppy disk belongs to him. You search the suspect computer an d locate only the filename within a .LNK file. The .LNK file is located in the folder C : \ Windows\Recent. How you would use the .LNK file to establish a connection between the file on the floppy diskette and the suspect computer?

Accepted Answer

A)  The file signature found in the .LNK file 
B)  The dates and time of the file found in the .LNK file, at file offset 28 
C)  Both a and b 
D)  The full path of the file, found in the .LNK file 
A)  The file signature found in the .LNK file 
B)  The dates and time of the file found in the .LNK file, at file offset 28 
C)  Both a and b 
D)  The full path of the file, found in the .LNK file

Question 20

Which of the following statements is more accurate?

Accepted Answer

A)  The Recycle Bin increases the chance of locating the existence of a file on a computer. 
B)  The Recycle Bin reduces the chance of locating the existence of a file on a computer. 
A)  The Recycle Bin increases the chance of locating the existence of a file on a computer. 
B)  The Recycle Bin reduces the chance of locating the existence of a file on a computer.

The EnCase signature analysis is used to perform which of the following actions?

RAM is used by the computer to:

What files are reconfigured or deleted by EnCase during the creation of an EnCase boot disk?

An EnCase evidence file of a hard drive ________ be restored to another hard drive of equal or greater size.

Within EnCase for Windows, the search process is:

When a file is deleted in the FAT file system, what happens to the FAT?

Changing the filename of a file will change the hash value of the file.

Which of the following would be a true statement about the function of the BIOS?

A signature analysis has been run on a case. The result "JPEG" in the signature column means

Which of the following selections would be used to keep track of a fragmented file in the FAT file system?

The following keyword was typed in exactly as shown. Choose the answer(s) that would result. All search criteria have default settings. Tom Jones

Temp files created by EnCase are deleted when EnCase is properly closed.

Assume that MyNote.txt has been deleted. The FAT file system directory entry for that file has been overwritten. The data for MyNote.txt is now:

Within EnCase, you highlight a range of data within a file. The length indicator displays the value 30. How many bytes have you actually selected?

You are at an incident scene and determine that a computer contains evidence as described in the search warrant. When you seize the computer, you should:

Search terms are stored in what .ini configuration file

Within EnCase, what is the purpose of the temp folder?

Which of the following statements is more accurate?

Certification for EnCE Outside North America

Filters

Exam 1: Certification For ENCE North America

The EnCase signature analysis is used to perform which of the following actions?

RAM is used by the computer to:

What files are reconfigured or deleted by EnCase during the creation of an EnCase boot disk?

An EnCase evidence file of a hard drive ________ be restored to another hard drive of equal or greater size.

Within EnCase for Windows, the search process is:

When a file is deleted in the FAT file system, what happens to the FAT?

Changing the filename of a file will change the hash value of the file.

Which of the following would be a true statement about the function of the BIOS?

A signature analysis has been run on a case. The result "JPEG" in the signature column means

Which of the following selections would be used to keep track of a fragmented file in the FAT file system?

The following keyword was typed in exactly as shown. Choose the answer(s) that would result. All search criteria have default settings. Tom Jones

Temp files created by EnCase are deleted when EnCase is properly closed.

Assume that MyNote.txt has been deleted. The FAT file system directory entry for that file has been overwritten. The data for MyNote.txt is now:

Within EnCase, you highlight a range of data within a file. The length indicator displays the value 30. How many bytes have you actually selected?

You are at an incident scene and determine that a computer contains evidence as described in the search warrant. When you seize the computer, you should:

Search terms are stored in what .ini configuration file

Within EnCase, what is the purpose of the temp folder?

Which of the following statements is more accurate?

Certification for EnCE Outside North America

Filters