Exam 2: Certification for EnCE Outside North America

The signature table data is found in which of the following files?

Which of the following would be a true statement about the function of the BIOS?

When an EnCase user double-clicks on a file within EnCase what determines the action that will result?

Select the appropriate name for the highlighted area of the binary numbers.

Which of the following would most likely be an add-in card?

Bookmarks are stored in which of the following files?

Searches and bookmarks are stored in the evidence file.

When does the POST operation occur?

Within EnCase for Windows, the search process is:

Using good forensic practices, when seizing a computer at a business running Windows 2000 Server you should:

You are working in a computer forensic lab. A law enforcement investigator brings you a computer and a valid search warrant. You have legal authority to search the computer. The investigator hands you a piece of paper that has three printed checks on it. All three checks have the same check and account number. You image the suspect's computer and open the evidence file with EnCase. You perform a text search for the account number and check number. Nothing returns on the search results. You perform a text search for all other information found on the printed checks and there is still nothing returned in the search results. You run a signature analysis and check the gallery. You cannot locate any graphical copies of the printed checks in the gallery. At this point, is it safe to say that the checks are not located on the suspect computer? 

The spool files that are created during a print job are __________ after the print job is completed.

Search terms are case sensitive by default.

For an EnCase evidence file acquired with a hash value to pass verification, which of the following must be true?

In Windows, the file MyNote.txt is deleted from C Drive and is automatically sent to the Recycle Bin. The long filename was MyNote.txt and the short filename was MYNOTE.TXT. When viewing the Recycle Bin with EnCase, how will the long filename and MyNote.txt and the short filename was MYNOTE.TXT?

The first sector on a hard drive is called the:

The acronym ASCII stands for:

Within EnCase, what is purpose of the default export folder?

Assume that an evidence file is added to a case, the case is saved, and the case is closed. What happens if the evidence file is moved, and the case is then opened?

When an EnCase user double-clicks on a valid . jpg file, that file is: