Question 1

The term signature and reader as they relate to a signature analysis are:

Accepted Answer

A)  Areas compared with each other to verify the correct file type. 
B)  Synonymous. 
C)  The signature is the file extension.  The header is a standard pattern normally found at the beginning of a file. 
D)  None of the above 
A)  Areas compared with each other to verify the correct file type. 
B)  Synonymous. 
C)  The signature is the file extension.  The header is a standard pattern normally found at the beginning of a file. 
D)  None of the above

Question 2

When can an evidence file containing a NTFS partition be logically restored to a FAT 32 partition?

Accepted Answer

A)  When the FAT 32 has the same number of sectors / clusters. 
B)  When the FAT 32 is the same size or bigger. 
C)  Never 
D)  Both A and B 
A)  When the FAT 32 has the same number of sectors / clusters. 
B)  When the FAT 32 is the same size or bigger. 
C)  Never 
D)  Both A and B

Question 3

In the FAT file system, the size of a deleted file can be found:

Accepted Answer

A)  In the FAT 
B)  In the file header 
C)  In the file footer 
D)  In the directory entry 
A)  In the FAT 
B)  In the file header 
C)  In the file footer 
D)  In the directory entry

Question 4

The FAT in the File Allocation Table file system keeps track of:

Accepted Answer

A)  All of the above. 
B)  Every addressable cluster on the partition 
C)  Clusters marked as bad 
D)  File fragmentation 
A)  All of the above. 
B)  Every addressable cluster on the partition 
C)  Clusters marked as bad 
D)  File fragmentation

Question 5

This question addresses the EnCase for Windows search process.  If a target word is within a logical file, and it begins in cluster 10 and ends in cluster 15 (the word is fragmented), the search

Accepted Answer

A)  Will find it because EnCase performs a logical search. 
B)  Will not find it unless slack is checked on the search dialog box. 
C)  Will not find it because EnCase performs a physical search only. 
D)  Will not find it because the letters of the keyword are not contiguous. 
A)  Will find it because EnCase performs a logical search. 
B)  Will not find it unless slack is checked on the search dialog box. 
C)  Will not find it because EnCase performs a physical search only. 
D)  Will not find it because the letters of the keyword are not contiguous.

Question 6

RAM is an acronym for:

Accepted Answer

A)  Random Addressable Memory 
B)  Relative Addressable Memory 
C)  Relative Address Memory 
D)  Random Access Memory 
A)  Random Addressable Memory 
B)  Relative Addressable Memory 
C)  Relative Address Memory 
D)  Random Access Memory

Question 7

Search terms are stored in what .ini configuration file?

Accepted Answer

A)  FileTypes.ini 
B)  FileSignatures.ini 
C)  TextStyle.ini 
D)  Keywords.ini 
A)  FileTypes.ini 
B)  FileSignatures.ini 
C)  TextStyle.ini 
D)  Keywords.ini

Question 8

The end of a logical file to the end of the cluster that the file ends in is called:

Accepted Answer

A)  Unallocated space 
B)  Allocated space 
C)  Slack 
D)  Available space 
A)  Unallocated space 
B)  Allocated space 
C)  Slack 
D)  Available space

Question 9

Will EnCase allow a user to write data into an acquired evidence file?

Accepted Answer

A)  No.  Data cannot be added to the evidence file after the acquisition is made. 
B)  Yes, but only bookmarks. 
C)  Yes, but only case information. 
D)  No, unless the user established a writing privilege when the evidence was acquired. 
E)  Yes, but only to resize the partitions. 
A)  No.  Data cannot be added to the evidence file after the acquisition is made. 
B)  Yes, but only bookmarks. 
C)  Yes, but only case information. 
D)  No, unless the user established a writing privilege when the evidence was acquired. 
E)  Yes, but only to resize the partitions.

Question 10

A SCSI host adapter would most likely perform which of the following tasks?

Accepted Answer

A)  Set up the connection of IDE hard drives. 
B)  None of the above. 
C)  Configure the motherboard settings to the BIOS. 
D)  Make SCSI hard drives and other SCSI devices accessible to the operating system. 
A)  Set up the connection of IDE hard drives. 
B)  None of the above. 
C)  Configure the motherboard settings to the BIOS. 
D)  Make SCSI hard drives and other SCSI devices accessible to the operating system.

Question 11

How does EnCase verify that the case information (Case Number, Evidence Number, Investigator Name, etc) in an evidence file has not been damaged or changed, after the evidence file has been written?

Accepted Answer

A)  The .case file writes a CRC value for the case information and verifies it when the case is opened. 
B)  EnCase does not verify the case information and case information can be changed by the user as it becomes necessary. 
C)  EnCase writes a CRC value of the case information and verifies the CRC value when the evidence is added to a case. 
D)  EnCase writes an MD5 hash value for the entire evidence file, which includes the case information, and verifies the MD5 hash when the evidence is added to a case. 
A)  The .case file writes a CRC value for the case information and verifies it when the case is opened. 
B)  EnCase does not verify the case information and case information can be changed by the user as it becomes necessary. 
C)  EnCase writes a CRC value of the case information and verifies the CRC value when the evidence is added to a case. 
D)  EnCase writes an MD5 hash value for the entire evidence file, which includes the case information, and verifies the MD5 hash when the evidence is added to a case.

Question 12

In hexadecimal notation, one byte is represented by _____ character(s).

Accepted Answer

A)  8 
B)  4 
C)  2 
D)  1 
A)  8 
B)  4 
C)  2 
D)  1

Question 13

During the power-up sequence, which of the following happens first?

Accepted Answer

A)  The BIOS on an add-in card is executed. 
B)  The boot sector is located on the hard drive. 
C)  The power On Self-Test. 
D)  The floppy drive is checked for a diskette. 
A)  The BIOS on an add-in card is executed. 
B)  The boot sector is located on the hard drive. 
C)  The power On Self-Test. 
D)  The floppy drive is checked for a diskette.

Question 14

A physical file size is:

Accepted Answer

A)  The total size of all the clusters used by the file measured in bytes. 
B)  The total size in bytes of a logical file. 
C)  The total size of the file including the ram slack in bytes. 
D)  The total size in sectors of an allocated file. 
A)  The total size of all the clusters used by the file measured in bytes. 
B)  The total size in bytes of a logical file. 
C)  The total size of the file including the ram slack in bytes. 
D)  The total size in sectors of an allocated file.

Question 15

A FAT directory has as a logical size of:

Accepted Answer

A)  One cluster 
B)  0 bytes 
C)  128 bytes 
D)  64 bytes 
A)  One cluster 
B)  0 bytes 
C)  128 bytes 
D)  64 bytes

Question 16

Which of the following selections would be used to keep track of a fragmented file in the FAT file system?

Accepted Answer

A)  All of the above 
B)  The partition table of extents 
C)  The File Allocation Table 
D)  The directory entry for the fragmented file 
A)  All of the above 
B)  The partition table of extents 
C)  The File Allocation Table 
D)  The directory entry for the fragmented file

Question 17

What does the acronym BIOS stand for?

Accepted Answer

A)  Basic Integrated Operating System 
B)  Basic Input/Output System 
C)  Binary Input/Output System 
D)  Binary Integrated Operating System 
A)  Basic Integrated Operating System 
B)  Basic Input/Output System 
C)  Binary Input/Output System 
D)  Binary Integrated Operating System

Question 18

An Enhanced Metafile would best be described as:

Accepted Answer

A)  A compound e-mail attachment. 
B)  A graphics file attached to an e-mail message. 
C)  A file format used in the printing process by Windows. 
D)  A compressed zip file. 
A)  A compound e-mail attachment. 
B)  A graphics file attached to an e-mail message. 
C)  A file format used in the printing process by Windows. 
D)  A compressed zip file.

Question 19

The EnCase evidence file is best described as:

Accepted Answer

A)  A bit stream image of the source hard drive written to the corresponding sectors of the target hard drive. 
B)  A clone of the source hard drive. 
C)  A bit stream image of the source hard drive written to a file, or several file segments. 
D)  A sector-by-sector copy of the source hard drive written to the corresponding sectors of the target hard drive. 
A)  A bit stream image of the source hard drive written to the corresponding sectors of the target hard drive. 
B)  A clone of the source hard drive. 
C)  A bit stream image of the source hard drive written to a file, or several file segments. 
D)  A sector-by-sector copy of the source hard drive written to the corresponding sectors of the target hard drive.

Question 20

In Windows 98 and ME, Internet based e-mail, such as Hotmail, will most likely be recovered in the _____________________ folder.

Accepted Answer

A)  C : \ Windows\Online\Applications\email 
B)  C : \ Windows\Temp 
C)  C : \ Windows\Temporary Internet files 
D)  C : \ Windows\History\Email 
A)  C : \ Windows\Online\Applications\email 
B)  C : \ Windows\Temp 
C)  C : \ Windows\Temporary Internet files 
D)  C : \ Windows\History\Email

The term signature and reader as they relate to a signature analysis are:

When can an evidence file containing a NTFS partition be logically restored to a FAT 32 partition?

In the FAT file system, the size of a deleted file can be found:

The FAT in the File Allocation Table file system keeps track of:

This question addresses the EnCase for Windows search process. If a target word is within a logical file, and it begins in cluster 10 and ends in cluster 15 (the word is fragmented), the search

RAM is an acronym for:

Search terms are stored in what .ini configuration file?

The end of a logical file to the end of the cluster that the file ends in is called:

Will EnCase allow a user to write data into an acquired evidence file?

A SCSI host adapter would most likely perform which of the following tasks?

How does EnCase verify that the case information (Case Number, Evidence Number, Investigator Name, etc) in an evidence file has not been damaged or changed, after the evidence file has been written?

In hexadecimal notation, one byte is represented by _____ character(s).

During the power-up sequence, which of the following happens first?

A physical file size is:

A FAT directory has as a logical size of:

Which of the following selections would be used to keep track of a fragmented file in the FAT file system?

What does the acronym BIOS stand for?

An Enhanced Metafile would best be described as:

The EnCase evidence file is best described as:

In Windows 98 and ME, Internet based e-mail, such as Hotmail, will most likely be recovered in the _____________________ folder.

Certification For ENCE North America

Filters

Exam 2: Certification for EnCE Outside North America

The term signature and reader as they relate to a signature analysis are:

When can an evidence file containing a NTFS partition be logically restored to a FAT 32 partition?

In the FAT file system, the size of a deleted file can be found:

The FAT in the File Allocation Table file system keeps track of:

This question addresses the EnCase for Windows search process. If a target word is within a logical file, and it begins in cluster 10 and ends in cluster 15 (the word is fragmented), the search

RAM is an acronym for:

Search terms are stored in what .ini configuration file?

The end of a logical file to the end of the cluster that the file ends in is called:

Will EnCase allow a user to write data into an acquired evidence file?

A SCSI host adapter would most likely perform which of the following tasks?

How does EnCase verify that the case information (Case Number, Evidence Number, Investigator Name, etc) in an evidence file has not been damaged or changed, after the evidence file has been written?

In hexadecimal notation, one byte is represented by _____ character(s).

During the power-up sequence, which of the following happens first?

A physical file size is:

A FAT directory has as a logical size of:

Which of the following selections would be used to keep track of a fragmented file in the FAT file system?

What does the acronym BIOS stand for?

An Enhanced Metafile would best be described as:

The EnCase evidence file is best described as:

In Windows 98 and ME, Internet based e-mail, such as Hotmail, will most likely be recovered in the _____________________ folder.

Certification For ENCE North America

Filters