Multiple Choice
How does EnCase verify that the case information (Case Number, Evidence Number, Investigator Name, etc) in an evidence file has not been damaged or changed, after the evidence file has been written?
A) EnCase writes a CRC value of the case information and verifies the CRC value when the evidence is added to a case.
B) EnCase does not verify the case information and case information can be changed by the user as it becomes necessary.
C) The .case file writes a CRC value for the case information and verifies it when the case is opened.
D) EnCase writes an MD5 hash value for the entire evidence file, which includes the case information, and verifies the MD5 hash when the evidence is added to a case.
Correct Answer:

Verified
Correct Answer:
Verified
Q4: You are conducting an investigation and have
Q5: The first sector on a volume is
Q6: The FAT in the File Allocation Table
Q7: Searches and bookmarks are stored in the
Q8: When a drive letter is assigned to
Q10: How many copies of the FAT are
Q11: The EnCase methodology dictates that _ be
Q12: A hard drive has been formatted as
Q13: A standard DOS 6.22 boot disk is
Q14: When a file is deleted in the