Question 1

A SCSI drive is pinned as a master when it is:

Accepted Answer

A)  The only drive on the computer. 
B)  A SCSI drive is not pinned as a master. 
C)  Whenever another drive is on the same cable and is pinned as a slave. 
D)  The primary of two drives connected to one cable. 
A)  The only drive on the computer. 
B)  A SCSI drive is not pinned as a master. 
C)  Whenever another drive is on the same cable and is pinned as a slave. 
D)  The primary of two drives connected to one cable.

Question 2

By default, what color does EnCase use for slack?

Accepted Answer

A)  Red 
B)  Black 
C)  Black on red 
D)  Red on black 
A)  Red 
B)  Black 
C)  Black on red 
D)  Red on black

Question 3

Search results are found in which of the following files?

Accepted Answer

A)  All of the above 
B)  The evidence file 
C)  The configuration Searches.ini file 
D)  The case file 
A)  All of the above 
B)  The evidence file 
C)  The configuration Searches.ini file 
D)  The case file

Question 4

The Windows 98 Start Menu has a selection called documents which displays a list of recently used files. Which of the following folders contain those files?

Accepted Answer

A)  C : \ Windows\History 
B)  C : \ Windows\Documents 
C)  C : \ Windows\Start menu\Documents 
D)  C : \ Windows\Recent 
A)  C : \ Windows\History 
B)  C : \ Windows\Documents 
C)  C : \ Windows\Start menu\Documents 
D)  C : \ Windows\Recent

Question 5

Creating an image of a hard drive that was seized as evidence:

Accepted Answer

A)  Should be done by the user, as they are most familiar with the hard drive. 
B)  May only be done by trained personnel because the process has the potential to alter the original evidence. 
C)  May be done by anyone because it is a relatively simple procedure. 
D)  May only be done by computer scientists. 
A)  Should be done by the user, as they are most familiar with the hard drive. 
B)  May only be done by trained personnel because the process has the potential to alter the original evidence. 
C)  May be done by anyone because it is a relatively simple procedure. 
D)  May only be done by computer scientists.

Question 6

To undelete a file in the FAT file system, EnCase obtains the starting extent from the:

Accepted Answer

A)  Directory entry 
B)  Operating system 
C)  File header 
D)  FAT 
A)  Directory entry 
B)  Operating system 
C)  File header 
D)  FAT

Question 7

EnCase uses the _________________ to conduct a signature analysis.

Accepted Answer

A)  file signature table 
B)  hash library 
C)  Both a and b 
D)  file Viewers 
A)  file signature table 
B)  hash library 
C)  Both a and b 
D)  file Viewers

A SCSI drive is pinned as a master when it is:

By default, what color does EnCase use for slack?

Search results are found in which of the following files?

The Windows 98 Start Menu has a selection called documents which displays a list of recently used files. Which of the following folders contain those files?

Creating an image of a hard drive that was seized as evidence:

To undelete a file in the FAT file system, EnCase obtains the starting extent from the:

EnCase uses the _________________ to conduct a signature analysis.

Certification For ENCE North America

Filters

Exam 2: Certification for EnCE Outside North America

A SCSI drive is pinned as a master when it is:

By default, what color does EnCase use for slack?

Search results are found in which of the following files?

The Windows 98 Start Menu has a selection called documents which displays a list of recently used files. Which of the following folders contain those files?

Creating an image of a hard drive that was seized as evidence:

To undelete a file in the FAT file system, EnCase obtains the starting extent from the:

EnCase uses the _________________ to conduct a signature analysis.

Certification For ENCE North America

Filters