Question 1

A SCSI host adapter would most likely perform which of the following tasks?

Accepted Answer

A)  Configure the motherboard settings to the BIOS. 
B)  Set up the connection of IDE hard drives. 
C)  Make SCSI hard drives and other SCSI devices accessible to the operating system. 
D)  None of the above. 
A)  Configure the motherboard settings to the BIOS. 
B)  Set up the connection of IDE hard drives. 
C)  Make SCSI hard drives and other SCSI devices accessible to the operating system. 
D)  None of the above.

Question 2

The Windows 98 Start Menu has a selection called documents which displays a list of recently used files. Which of the following The Windows 98 Start Menu has a selection called documents which displays a list of recently used files. Which of the following folders contain those files?

Accepted Answer

A)  C : \ Windows\History 
B)  C : \ Windows\Start menu\Documents 
C)  C : \ Windows\Documents 
D)  C : \ Windows\Recent 
A)  C : \ Windows\History 
B)  C : \ Windows\Start menu\Documents 
C)  C : \ Windows\Documents 
D)  C : \ Windows\Recent

Question 3

The EnCase evidence file is best described as:

Accepted Answer

A)  A clone of the source hard drive. 
B)  A sector-by-sector copy of the source hard drive written to the corresponding sectors of the target hard drive. 
C)  A bit stream image of the source hard drive written to a file, or several file segments. 
D)  A bit stream image of the source hard drive written to the corresponding sectors of the target hard drive. 
A)  A clone of the source hard drive. 
B)  A sector-by-sector copy of the source hard drive written to the corresponding sectors of the target hard drive. 
C)  A bit stream image of the source hard drive written to a file, or several file segments. 
D)  A bit stream image of the source hard drive written to the corresponding sectors of the target hard drive.

Question 4

During the power-up sequence, which of the following happens first?

Accepted Answer

A)  The boot sector is located on the hard drive. 
B)  The Power On Self-Test (POST) 
C)  The floppy drive is checked for a diskette. 
D)  The BIOS on an add-in card is executed. 
A)  The boot sector is located on the hard drive. 
B)  The Power On Self-Test (POST) 
C)  The floppy drive is checked for a diskette. 
D)  The BIOS on an add-in card is executed.

Question 5

What information should be obtained from the BIOS during computer forensic investigations?

Accepted Answer

A)  The video caching information 
B)  The date and time 
C)  The port assigned to the serial port 
D)  The boot sequence 
A)  The video caching information 
B)  The date and time 
C)  The port assigned to the serial port 
D)  The boot sequence

Question 6

The maximum file segment size for an EnCase evidence file is:

Accepted Answer

A)  1500 MB 
B)  1000 MB 
C)  2000 MB 
D)  There is no limit. 
E)  500 MB 
A)  1500 MB 
B)  1000 MB 
C)  2000 MB 
D)  There is no limit. 
E)  500 MB

Question 7

A file extension and signature can be manually added by:

Accepted Answer

A)  Using the new library feature under hash libraries. 
B)  Right-clicking on a file and selecting add. 
C)  Using the new set feature under hash sets. 
D)  Using the new file signature feature under file signatures. 
A)  Using the new library feature under hash libraries. 
B)  Right-clicking on a file and selecting add. 
C)  Using the new set feature under hash sets. 
D)  Using the new file signature feature under file signatures.

Question 8

Which of the following would most likely be an add-in card?

Accepted Answer

A)  A video card that is connected to the motherboard in the AGP slot 
B)  Anything plugged into socket 7 
C)  A motherboard 
D)  The board that connects to the power supply 
A)  A video card that is connected to the motherboard in the AGP slot 
B)  Anything plugged into socket 7 
C)  A motherboard 
D)  The board that connects to the power supply

Question 9

A hard drive has 8 sectors per cluster. File Mystuff.doc has a logical file size of 13,000 bytes. How many clusters will be used by Mystuff.doc?

Accepted Answer

A)  4 
B)  1 
C)  2 
D)  3 
A)  4 
B)  1 
C)  2 
D)  3

Question 10

The spool files that are created during a print job are __________ after the print job is completed.

Accepted Answer

A)  moved 
B)  wiped 
C)  deleted and wiped 
D)  deleted 
A)  moved 
B)  wiped 
C)  deleted and wiped 
D)  deleted

Question 11

Using good forensic practices, when seizing a computer at a business running Windows 2000 Server you should:

Accepted Answer

A)  Pull the plug from the back of the computer. 
B)  Press the power button and hold it in. 
C)  Shut it down normally. 
D)  Pull the plug from the wall. 
A)  Pull the plug from the back of the computer. 
B)  Press the power button and hold it in. 
C)  Shut it down normally. 
D)  Pull the plug from the wall.

Question 12

Which of the following is commonly used to encode e-mail attachments?

Accepted Answer

A)  GIF 
B)  EMF 
C)  JPEG 
D)  Base64 
A)  GIF 
B)  EMF 
C)  JPEG 
D)  Base64

Question 13

A restored floppy diskette will have the same hash value as the original diskette.

Accepted Answer

A) True 
 B)False

Question 14

The case file should be archived with the evidence files at the termination of a case.

Accepted Answer

A) True 
 B)False

Question 15

A case file can contain ____ hard drive images?

Accepted Answer

A)  5 
B)  1 
C)  any number of 
D)  10 
A)  5 
B)  1 
C)  any number of 
D)  10

Question 16

To undelete a file in the FAT file system, EnCase obtains the starting extent from the:

Accepted Answer

A)  Directory entry 
B)  FAT 
C)  Operating system 
D)  File header 
A)  Directory entry 
B)  FAT 
C)  Operating system 
D)  File header

Question 17

Which of the following aspects of the EnCase evidence file can be changed during a reacquire of the evidence file

Accepted Answer

A)  The evidence number 
B)  The acquisition notes 
C)  The investigator name 
D)  None of the above 
A)  The evidence number 
B)  The acquisition notes 
C)  The investigator name 
D)  None of the above

Question 18

EnCase marks a file as overwritten when _____________ has been allocated to another file.

Accepted Answer

A)  all of the file 
B)  the starting cluster of the file 
C)  the directory entry for the file 
D)  any part of the file 
A)  all of the file 
B)  the starting cluster of the file 
C)  the directory entry for the file 
D)  any part of the file

Question 19

Creating an image of a hard drive that was seized as evidence:

Accepted Answer

A)  May be done by anyone because it is a relatively simple procedure. 
B)  May only be done by trained personnel because the process has the potential to alter the original evidence. 
C)  May only be done by computer scientists. 
D)  Should be done by the user, as they are most familiar with the hard drive. 
A)  May be done by anyone because it is a relatively simple procedure. 
B)  May only be done by trained personnel because the process has the potential to alter the original evidence. 
C)  May only be done by computer scientists. 
D)  Should be done by the user, as they are most familiar with the hard drive.

Question 20

The EnCase case file can be best described as:

Accepted Answer

A)  The file that runs EnCase for Windows. 
B)  A filecontain configuration settings for cases. 
C)  A file that contains information specific to one case. 
D)  None of the above. 
A)  The file that runs EnCase for Windows. 
B)  A filecontain configuration settings for cases. 
C)  A file that contains information specific to one case. 
D)  None of the above.

A SCSI host adapter would most likely perform which of the following tasks?

The Windows 98 Start Menu has a selection called documents which displays a list of recently used files. Which of the following The Windows 98 Start Menu has a selection called documents which displays a list of recently used files. Which of the following folders contain those files?

The EnCase evidence file is best described as:

During the power-up sequence, which of the following happens first?

What information should be obtained from the BIOS during computer forensic investigations?

The maximum file segment size for an EnCase evidence file is:

A file extension and signature can be manually added by:

Which of the following would most likely be an add-in card?

A hard drive has 8 sectors per cluster. File Mystuff.doc has a logical file size of 13,000 bytes. How many clusters will be used by Mystuff.doc?

The spool files that are created during a print job are __________ after the print job is completed.

Using good forensic practices, when seizing a computer at a business running Windows 2000 Server you should:

Which of the following is commonly used to encode e-mail attachments?

A restored floppy diskette will have the same hash value as the original diskette.

The case file should be archived with the evidence files at the termination of a case.

A case file can contain ____ hard drive images?

To undelete a file in the FAT file system, EnCase obtains the starting extent from the:

Which of the following aspects of the EnCase evidence file can be changed during a reacquire of the evidence file

EnCase marks a file as overwritten when _____________ has been allocated to another file.

Creating an image of a hard drive that was seized as evidence:

The EnCase case file can be best described as:

Certification for EnCE Outside North America

Filters

Exam 1: Certification For ENCE North America

A SCSI host adapter would most likely perform which of the following tasks?

The Windows 98 Start Menu has a selection called documents which displays a list of recently used files. Which of the following The Windows 98 Start Menu has a selection called documents which displays a list of recently used files. Which of the following folders contain those files?

The EnCase evidence file is best described as:

During the power-up sequence, which of the following happens first?

What information should be obtained from the BIOS during computer forensic investigations?

The maximum file segment size for an EnCase evidence file is:

A file extension and signature can be manually added by:

Which of the following would most likely be an add-in card?

A hard drive has 8 sectors per cluster. File Mystuff.doc has a logical file size of 13,000 bytes. How many clusters will be used by Mystuff.doc?

The spool files that are created during a print job are __________ after the print job is completed.

Using good forensic practices, when seizing a computer at a business running Windows 2000 Server you should:

Which of the following is commonly used to encode e-mail attachments?

A restored floppy diskette will have the same hash value as the original diskette.

The case file should be archived with the evidence files at the termination of a case.

A case file can contain ____ hard drive images?

To undelete a file in the FAT file system, EnCase obtains the starting extent from the:

Which of the following aspects of the EnCase evidence file can be changed during a reacquire of the evidence file

EnCase marks a file as overwritten when _____________ has been allocated to another file.

Creating an image of a hard drive that was seized as evidence:

The EnCase case file can be best described as:

Certification for EnCE Outside North America

Filters