Multiple Choice
All investigators using EnCase should run tests on the evidence file acquisition and verification process to:
A) Insure that the investigator is using the proper method of acquisition.
B) Further the investigator understanding of the evidence file.
C) Give more weight to the investigator testimony in court.
D) All of the above.
Correct Answer:
Verified
Correct Answer:
Verified
Q31: When handling computer evidence, an investigator should:<br>A)
Q32: The case number in an evidence file
Q33: When a non-compressed evidence file is reacquired
Q34: For an EnCase evidence file acquired with
Q35: Assume that MyNote.txt was allocated to clusters
Q37: A CPU is:<br>A) A chip that would
Q38: EnCase can build a hash set of
Q39: If cases are worked on a lab
Q40: The EnCase evidence file logical filename can
Q41: The EnCase signature analysis is used to