Question 1

In the EnCase environment, the term external viewers is best described as?

Accepted Answer

A)   Programs that are exported out of an evidence file.
B)   Programs that are associated with EnCase to open specific file types.
C)   Any program that will work with EnCase.
D)   Any program that is loaded on the lab hard drive. B

Question 2

A personal data assistant was placed in a evidence locker until an examiner has time to examine it.  Which of the following areas would require special attention?

Accepted Answer

A)   Chain-of-custody
B)   Cross-contamination
C)   Storage
D)   There is no concern C

Question 3

The EnCase default export folder is:

Accepted Answer

A)   A global setting that cannot be changed.
B)   A case-specific setting that can be changed.
C)   A global setting that can be changed.
D)   A case-specific setting that cannot be changed. B

Question 4

A file extension and signature can be manually added by:

Accepted Answer

A)   Right-clicking on a file and selecting add  
B)   Using the new file signature feature under file signatures.
C)   Using the new library feature under hash libraries.
D)   Using the new set feature under hash sets.

Question 5

You are investigating a case of child pornography on a hard drive containing Windows XP. In the C : \ Documents and Settings\Bad Guy\Local Settings\Temporary Internet Files folder you find three images of child pornography. You find no other copies of the images on the suspect hard drive, and you find no other copies of the filenames. What can be deduced from your findings?

Accepted Answer

A)   The presence and location of the images is strong evidence of possession.
B)   The presence and location of the images is not strong evidence of possession.
C)   The presence and location of the images proves the images were intentionally downloaded.
D)   Both a and c

Question 6

What information should be obtained from the BIOS during computer forensic investigations?

Accepted Answer

A)   The date and time
B)   The video caching information
C)   The port assigned to the serial port
D)   The boot sequence

Question 7

An evidence file was archived onto five CD-Rom disks with the third file segment on disk number three.  Can the contents of the third file segment be verified by itself while still on the CD?

Accepted Answer

A)   No.  EnCase cannot verify files on CDs.
B)   Yes.  Any segment of an evidence file can be verified through re-computing and comparing the CRCs, even if it is on a CD.
C)   No.  Archived files are compressed and cannot be verified until un-archived.
D)   No.  All file segments must be put back together.

Question 8

If an evidence file has been added to a case and completely verified, what happens if the data area within the evidence file is later changed?

Accepted Answer

A)   EnCase detect the error if the evidence file is manually re-verified.
B)   All of the above.
C)   EnCase will detect the error when that area of the evidence file is accessed by the user.
D)   EnCase will allow the examiner to continue to access the rest of the evidence file that has not been changed.

Question 9

Calls to the C : \ volume of the hard drive are not made by DOS when a computer is booted with a standard DOS 6.22 boot disk.

Accepted Answer

A) True 
 B)False

Question 10

The following GREP expression was typed in exactly as shown.  Choose the answer(s) that would result. Bob@[a-z]+.com

Accepted Answer

A)   Bob@a-z.com
B)   Bob@My-Email.com
C)   Bob@New zealand.com
D)   Bob@America.com

Question 11

Which of the following selections is NOT found in the case file?

Accepted Answer

A)   Signature analysis results
B)   Search results
C)   Pointers to evidence files
D)   External viewers

Question 12

To generate an MD5 hash value for a file, EnCase:

Accepted Answer

A)   Computes the hash value based on the physical file.
B)   Computes the hash value including the physical file and filename.
C)   Computes the hash value including the logical file and filename.
D)   Computes the hash value based on the logical file.

Question 13

Which of the following items could contain digital evidence?

Accepted Answer

A)   Cellular phones
B)   Credit card readers
C)   Digital cameras
D)   Personal assistant devices
E)   None of the above

Question 14

A sector on a floppy disk is the same size as a sector on a NTFS formatted hard drive.

Accepted Answer

A) True 
 B)False

Question 15

The following keyword was typed in exactly as shown.  Choose the answer(s) that would result.  All search criteria have default settings. credit card

Accepted Answer

A)   Credit Card
B)   credit card
C)   Card
D)   Credit

Question 16

How are the results of a signature analysis examined?

Accepted Answer

A)   By sorting on the hash sets column in the table view.
B)   By sorting on the category column in the table view.
C)   By sorting on the signature column in the table view.
D)   By sorting on the hash library column in the table view.

Question 17

Which of the following aspects of the EnCase evidence file can be changed during a reacquire of the evidence file?

Accepted Answer

A)   The investigator name
B)   The acquisition notes
C)   None of the above
D)   The evidence number

Question 18

Which of the following directories contain the information that is found on a Windows 98 Desktop?

Accepted Answer

A)   C : \ Program files\Programs\Desktop
B)   C : \ Startup\Desktop\Items
C)   C : \ Windows\Desktop
D)   C : \ Desktop

Question 19

A hard drive has been formatted as NTFS and Windows XP was installed.  The user used fdisk to remove all partitions from that drive. Nothing else was done.  You have imaged the drive and have opened the evidence file with EnCase.  What would be the best way to examine this hard drive?

Accepted Answer

A)   EnCase will not see a drive that has been fdisked.
B)   Use the recovered Deleted Partitions feature and then examine the system.
C)   Conduct a physical search of the hard drive and bookmark any evidence.
D)   Use the add Partition feature to rebuild the partition and then examine the system.

Question 20

The EnCase case file can be best described as:

Accepted Answer

A)   A file contain configuration settings for cases.
B)   The file that runs EnCase for Windows.
C)   A file that contains information specific to one case.
D)   None of the above.

Exam 2: Certification for EnCE Outside North America