Multiple Choice
The EnCase evidence file is best described as:
A) A clone of the source hard drive.
B) A sector-by-sector copy of the source hard drive written to the corresponding sectors of the target hard drive.
C) A bit stream image of the source hard drive written to a file, or several file segments.
D) A bit stream image of the source hard drive written to the corresponding sectors of the target hard drive.
Correct Answer:

Verified
Correct Answer:
Verified
Q58: Within EnCase, what is the purpose of
Q59: A suspect typed a file on his
Q60: Which of the following statements is more
Q61: A SCSI host adapter would most likely
Q62: The Windows 98 Start Menu has a
Q64: During the power-up sequence, which of the
Q65: What information should be obtained from the
Q66: The maximum file segment size for an
Q67: A file extension and signature can be
Q68: Which of the following would most likely