Multiple Choice
Assume that MyNote.txt was allocated to clusters 5, 9, and 11. Cluster 6, 7, and 8 belong to MyResume.doc. Both files have been deleted and the directory entry in the FAT file system for MyResume.doc has been overwritten. What clusters would EnCase use to undelete MyNote.txt?
A) 5,9,11
B) 5,6,7
C) 7,8,9
D) 6,7,8
Correct Answer:
Verified
Correct Answer:
Verified
Q30: In DOS acquisition mode, if a physical
Q31: When handling computer evidence, an investigator should:<br>A)
Q32: The case number in an evidence file
Q33: When a non-compressed evidence file is reacquired
Q34: For an EnCase evidence file acquired with
Q36: All investigators using EnCase should run tests
Q37: A CPU is:<br>A) A chip that would
Q38: EnCase can build a hash set of
Q39: If cases are worked on a lab
Q40: The EnCase evidence file logical filename can