Multiple Choice
You are investigating a case involving fraud. You seized a computer from a suspect who stated that the computer is not used by anyone other than himself. The computer has Windows 98 installed on the hard drive. You find the filename C : \ downloads\check01. jpg that EnCase shows as being moved. The starting extent is 0C4057. You find another filename :\downloads\chk1.dll with the starting extent 0C4057, which EnCase also shows as being moved. In the C : \ Windows\System folder you find an allocated file named chk1.dll with the starting extent 0C4057. The chk1.dll file is a JPEG image of a counterfeit check. What can be deduced from your findings?
A) The presence and location of the files is strong evidence the suspect committed the crime.
B) The presence and location of the files is not strong evidence the suspect committed the crime.
Correct Answer:
Verified
Correct Answer:
Verified
Q49: A signature analysis has been run on
Q50: Which of the following selections would be
Q51: The following keyword was typed in exactly
Q52: Temp files created by EnCase are deleted
Q53: Assume that MyNote.txt has been deleted. The
Q55: Within EnCase, you highlight a range of
Q56: You are at an incident scene and
Q57: Search terms are stored in what .ini
Q58: Within EnCase, what is the purpose of
Q59: A suspect typed a file on his