Question 1

Will EnCase allow a user to write data into an acquired evidence file

Accepted Answer

A)  Yes, but only bookmarks. 
B)  Yes, but only to resize the partitions. 
C)  No. Data cannot be added to the evidence file after the acquisition is made. 
D)  Yes, but only case information. 
E)  No, unless the user established a writing privilege when the evidence was acquired.

Question 2

In the FAT file system, the size of a deleted file can be found:

Accepted Answer

A)  In the FAT 
B)  In the directory entry 
C)  In the file footer 
D)  In the file header

Question 3

Within EnCase, what is purpose of the default export folder?

Accepted Answer

A)  This is the folder that will be automatically selected when the copy/unerase feature is used. 
B)  This is the folder that will automatically store an evidence file when the acquisition is made in DOS. 
C)  This is the folder that temporarily stores all bookmark and search results. 
D)  This is the folder used to hold copies of files that are sent to external viewers.

Question 4

By default, what color does EnCase use for the contents of a logical file

Accepted Answer

A)  Red 
B)  Red on black 
C)  Black 
D)  Black on red

Question 5

To undelete a file in the FAT file system, EnCase computes the number of _______ the file will use based on the file ______.

Accepted Answer

A)  Clusters;starting extent 
B)  Sectors;starting extent 
C)  Clusters;file size 
D)  Sectors;file size

Question 6

The term signature and header as they relate to a signature analysis are

Accepted Answer

A)  None of the above 
B)  The signature is the file extension. The header is a standard pattern normally found at the beginning of a file. 
C)  Synonymous. 
D)  Areas compared with each other to verify the correct file type.

Question 7

A hash set would most accurately be described as:

Accepted Answer

A)  A group of hash libraries organized by category. 
B)  A group of hash values that can be added to the hash library. 
C)  A table of file headers and extensions. 
D)  Both a and b.

Question 8

The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. 800[) \-]+555-1212

Accepted Answer

A)  (800) 555-1212 
B)  800-555 1212 
C)  8005551212 
D)  800.555.1212

Question 9

In Windows, the file MyNote.txt is deleted from C Drive and is automatically sent to the Recycle Bin. The long filename was MyNote.txt and the short filename was MYNOTE.TXT. When viewing the Recycle Bin with EnCase, how will the long filename and MyNote.txt and the short filename was MYNOTE.TXT?

Accepted Answer

A)  MyNote.txt, CD0.txt 
B)  MyNote.txt, DC0.txt 
C)  MyNote.del, DC1.del 
D)  MyNote.del, DC0.del

Question 10

You are assigned to assist with the search and seizure of several computers. The magistrate ordered that the computers cannot be seized unless they are found to contain any one of ten previously identified images. You currently have the ten images in JPG format. Using the EnCase methodology, how would you best handle this situation?

Accepted Answer

A)  UseFastBloc or a network/parallel port cable to preview the hard drives. Go to the Gallery view and search for the previously identified images. 
B)  UseFastBloc or a network/parallel port cable to acquire forensic images of the hard drives, then search the evidence files for the previously identified images. 
C)  UseFastBloc or a network/parallel port cable to preview the hard drives. Conduct a hash analysis of the files on the hard drives, using a hash library containing the hash values of the previously identified images. 
D)  Use an EnCase DOS boot disk to conduct a text search for child porn. Use an EnCase DOS boot disk to conduct a text search for child porn?

Question 11

Which of the following items could contain digital evidence?

Accepted Answer

A)  Credit card readers 
B)  Personal assistant devices 
C)  Cellular phones 
D)  Digital cameras 
E)  None of the above

Question 12

4 bits allows what number of possibilities?

Accepted Answer

A)  16 
B)  4 
C)  2 
D)  8

Question 13

The EnCase methodology dictates that the lab drive for evidence have a __________ prior to making an image.

Accepted Answer

A)  FAT 16 partition 
B)  NTFS partition 
C)  unique volume label 
D)  bare, unused partition

Question 14

The MD5 hash algorithm produces a _____ number.

Accepted Answer

A)  32 bit 
B)  256 bit 
C)  64 bit 
D)  128 bit

Question 15

A hash library would most accurately be described as:

Accepted Answer

A)  A master table of file headers and extensions. 
B)  A file containing hash values from one or more selected hash sets. 
C)  Both a and b. 
D)  A list of the all the MD5 hash values used to verify the evidence files.

Question 16

The results of a hash analysis on an evidence file that has been added to a case will be stored in which of the following files?

Accepted Answer

A)  The evidence file 
B)  The case file 
C)  The configuration HashAnalysis.ini file 
D)  All of the above

Question 17

Assume that an evidence file is added to a case, the case is saved, and the case is closed. What happens if the evidence file is moved, and the case is then opened?

Accepted Answer

A)  EnCase reports that the file integrity has been compromised and renders the file useless. 
B)  EnCase opens the case, excluding the moved evidence. 
C)  EnCase asks for the location of the evidence file the next time the case is opened. 
D)  EnCase reports a different hash value for the evidence file.

Question 18

A signature analysis has been run on a case. The result "Bad Signature " means

Accepted Answer

A)  The file signature is known and does not match a known file header. 
B)  The file signature is known and the file extension is known. 
C)  The file signature is known and does not match a known file extension. 
D)  The file signature is unknown and the file extension is known.

Question 19

When undeleting a file in the FAT file system, EnCase will check the _____________ to see if it has already been overwritten.

Accepted Answer

A)  data on the hard drive 
B)  deletion table 
C)  directory entry 
D)  FAT

Question 20

The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. [\x00-\x05]\x00\x00\x00

Accepted Answer

A)  FF 0000 00 00 FF BA 
B)  0000 00 01 FF FF BA 
C)  04 06 0000 00 FF FF BA 
D)  04 0000 00 FF FF BA

Exam 1: Certification For ENCE North America