A) A chip that would be considered the brain of a computer, which is installed on a motherboard. B) A Central Programming Unit. C) An entire computer box, not including the monitor and other attached peripheral devices. D) A motherboard with all required devices connected. A) A chip that would be considered the brain of a computer, which is installed on a motherboard. B) A Central Programming Unit. C) An entire computer box, not including the monitor and other attached peripheral devices. D) A motherboard with all required devices connected.

Exam 2: Certification for EnCE Outside North America

If cases are worked on a lab drive in a secure room, without any cleaning of the contents of the drive, which of the following areas would be of most concern?

(Multiple Choice)

4.8/5

(80)

Question 81

An evidence file can be moved to another directory without changing the file verification.

(True/False)

4.8/5

(82)

Question 82

Hash libraries are commonly used to:

(Multiple Choice)

4.8/5

(81)

Question 83

A case file can contain ____ hard drive images?

(Multiple Choice)

4.7/5

(83)

Question 84

Select the appropriate name for the highlighted area of the binary numbers.

(Multiple Choice)

4.8/5

(79)

Question 85

The following keyword was typed in exactly as shown. Choose the answer(s) that would result. All search criteria have default settings. Tom Jones

(Multiple Choice)

4.7/5

(92)

Question 86

To later verify the contents of an evidence file? 7RODWHUYHULI\WKHFRQWHQWVRIDQHYLGHQFHILOH

(Multiple Choice)

4.9/5

(78)

Question 87

In Unicode, one printed character is composed of ____ bytes of data.

(Multiple Choice)

4.8/5

(74)

Question 88

Assume that MyNote.txt has been deleted. The FAT file system directory entry for that file has been overwritten. The data for MyNote.txt is now:

(Multiple Choice)

4.8/5

(69)

Question 89

Select the appropriate name for the highlighted area of the binary numbers.

(Multiple Choice)

4.7/5

(73)

Question 90

By default, EnCase will display the data from the end of a logical file, to the end of the cluster, in what color:

(Multiple Choice)

5.0/5

(79)

Question 91

What files are reconfigured or deleted by EnCase during the creation of an EnCase boot disk?

(Multiple Choice)

5.0/5

(95)

Question 92

A hash set would most accurately be described as:

(Multiple Choice)

4.8/5

(80)

Question 93

The temporary folder of a case cannot be changed once it has been set.

(True/False)

4.9/5

(67)

Question 94

How does EnCase verify that the evidence file contains an exact copy of the suspect hard drive?

(Multiple Choice)

4.7/5

(76)

Question 95

The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. Jan 1 st , 2?0?00

(Multiple Choice)

4.8/5

(84)

Question 96

You are examining a hard drive that has Windows XP installed as the operating system. You see a file that has a date and time in the deleted column. Where does that date and time come from?

(Multiple Choice)

4.9/5

(85)

Question 97

In DOS acquisition mode, if a physical drive is detected, but no partition information is displayed, what would be the cause:

(Multiple Choice)

4.9/5

(82)

Question 98

Within EnCase, what is the purpose of the temp folder?

(Multiple Choice)

4.9/5

(86)

Question 99

A CPU is:

(Multiple Choice)

5.0/5

(90)

Question 100

Showing 81 - 100 of 127

If cases are worked on a lab drive in a secure room, without any cleaning of the contents of the drive, which of the following areas would be of most concern?

An evidence file can be moved to another directory without changing the file verification.

Hash libraries are commonly used to:

A case file can contain ____ hard drive images?

Select the appropriate name for the highlighted area of the binary numbers.

The following keyword was typed in exactly as shown. Choose the answer(s) that would result. All search criteria have default settings. Tom Jones

To later verify the contents of an evidence file? 7RODWHUYHULI\WKHFRQWHQWVRIDQHYLGHQFHILOH

In Unicode, one printed character is composed of ____ bytes of data.

Assume that MyNote.txt has been deleted. The FAT file system directory entry for that file has been overwritten. The data for MyNote.txt is now:

Select the appropriate name for the highlighted area of the binary numbers.

By default, EnCase will display the data from the end of a logical file, to the end of the cluster, in what color:

What files are reconfigured or deleted by EnCase during the creation of an EnCase boot disk?

A hash set would most accurately be described as:

The temporary folder of a case cannot be changed once it has been set.

How does EnCase verify that the evidence file contains an exact copy of the suspect hard drive?

The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. Jan 1 st , 2?0?00

You are examining a hard drive that has Windows XP installed as the operating system. You see a file that has a date and time in the deleted column. Where does that date and time come from?

In DOS acquisition mode, if a physical drive is detected, but no partition information is displayed, what would be the cause:

Within EnCase, what is the purpose of the temp folder?

A CPU is:

Certification For ENCE North America

Filters