Question 1

Consider the following path in a FAT file system: C : \ My Documents\My Pictures\Bikes. Where does the directory Bikes receive its name?

Accepted Answer

A)  From the root directory C : \ 
B)  From itself 
C)  From the My Pictures directory 
D)  From the My Documents directory

Question 2

You are assigned to assist with the search and seizure of several computers.  The magistrate ordered that the computers cannot be seized unless they are found to contain any one of ten previously identified images.  You currently have the ten images in JPG format. Using the EnCase methodology, how would you best handle this situation?

Accepted Answer

A)  Use FastBloc or a network/parallel port cable to acquire forensic images of the hard drives, then search the evidence files for the previously identified images. 
B)  Use FastBloc or a network/parallel port cable to preview the hard drives.  Go to the Gallery view and search for the previously identified images. 
C)  Use FastBloc or a network/parallel port cable to preview the hard drives.  Conduct a hash analysis of the files on the hard drives, using a hash library containing the hash values of the previously identified images. 
D)  Use an EnCase DOS boot disk to conduct a text search for child porn.

Question 3

You are investigating a case involving fraud. You seized a computer from a suspect who stated that the computer is not used by anyone other than himself. The computer has Windows 98 installed on the hard drive. You find the filename C : \ downloads\check01. jpg that EnCase shows as being moved. The starting extent is 0C4057. You find another filename C : \ downloads\chk1.dll with the starting extent 0C4057, which EnCase also shows as being moved. In the C : \ windows\System folder you find an allocated file named chk1.dll with the starting extent 0C4057. The chk1.dll file is a JPEG image of a counterfeit check. Could this information be used to refute the suspect claim that he never knew it was on the computer?

Accepted Answer

A)  Yes, because the chk1.dll file was moved and renamed. 
B)  No, because the Windows operating system likely moved and renamed the chk1.dll file during disk maintenance. 
C)  No, because the chk1.dll file has no evidentiary value. 
D)  Yes, because the ch1.dll is all the evidence required to prove the case.

Question 4

The case number in an evidence file can be changed without causing the verification feature to report an error, if:

Accepted Answer

A)  The user utilizes a text editor. 
B)  The user utilizes the case information editor within EnCase. 
C)  The evidence file is reacquired. 
D)  The case information cannot be changed in an evidence file, without causing the verification feature to report an error.

Question 5

The EnCase methodology dictates that ________ be created prior to acquiring evidence.

Accepted Answer

A)  a text file for notes 
B)  a unique directory on the lab drive for case management 
C)  an .E01 file on the lab drive 
D)  All of the above

Question 6

Which of the following is found in the FileSignatures.ini configuration file?

Accepted Answer

A)  The information contained in the signature table 
B)  The results of a signature analysis 
C)  Pointers to an evidence file 
D)  The results of a hash analysis

Question 7

The BIOS chip on an IBM clone computer is most commonly located on:

Accepted Answer

A)  The RAM chip 
B)  The microprocessor 
C)  The controller card 
D)  The motherboard

Question 8

Which is the proper formula for determining the size in bytes of a hard drive that uses cylinders (C), heads (H), and sectors (S) geometry?

Accepted Answer

A)  C X H X S 
B)  C X H X S + 512 
C)  C X H + S 
D)  C X H X S X 512

Question 9

A hard drive was imaged using EnCase.  The original drive was placed into evidence.  The restore feature was used to make a copy of the original hard drive.  EnCase verifies the restored copy using:

Accepted Answer

A)  Nothing.  Restored volumes are not verified. 
B)  A running log 
C)  An MD5 hash 
D)  A 32 bit CRC

Question 10

RAM is tested during which phase of the power-up sequence?

Accepted Answer

A)  None of the above. 
B)  During POST 
C)  After POST 
D)  Pre-POST

Question 11

Select the appropriate name for the highlighted area of the binary numbers.

Accepted Answer

A)  Bit 
B)  Nibble 
C)  Word 
D)  Byte 
E)  Dword

Question 12

EnCase is able to read and examine which of the following file systems?

Accepted Answer

A)  HFS 
B)  FAT 
C)  NTFS 
D)  EXT3 
E)  None of the above

Question 13

To undelete a file in the FAT file system, EnCase computes the number of _______ the file will use based on the file ______.

Accepted Answer

A)  Clusters; file size 
B)  Sectors; file size 
C)  Clusters; starting extent 
D)  Sectors; starting extent

Question 14

An EnCase evidence file of a hard drive ________ be restored to another hard drive of equal or greater size.

Accepted Answer

A)  cannot 
B)  can

Question 15

When a file is deleted in the FAT file system, what happens to the FAT?

Accepted Answer

A)  It is deleted as well. 
B)  The FAT entries for that file are marked as allocated. 
C)  Nothing. 
D)  The FAT entries for that file are marked as available.

Question 16

You are an investigator and have encountered a computer that is running at the home of a suspect.  The computer does not appear to be a part of a network. The operating system is Windows XP Home.  No programs are visibly running.  You should:

Accepted Answer

A)  Pull the plug from the back of the computer. 
B)  Shut it down with the start menu. 
C)  Pull the plug from the wall. 
D)  Turn it off with the power button.

Question 17

The following GREP expression was typed in exactly as shown.  Choose the answer(s) that would result. [^a-z]Tom[^a-z]

Accepted Answer

A)  Tom 
B)  Toms 
C)  Tomato 
D)  Stomp

Question 18

When Unicode is selected for a search keyword, EnCase:

Accepted Answer

A)  Will only find the keyword if it is Unicode. 
B)  None of the above. 
C)  Unicode is not a search option for EnCase. 
D)  Will find the keyword if it is either Unicode or ASCII.

Question 19

When undeleting a file in the FAT file system, EnCase will check the _____________ to see if it has already been overwritten.

Accepted Answer

A)  directory entry 
B)  data on the hard drive 
C)  deletion table 
D)  FAT

Question 20

RAM is used by the computer to:

Accepted Answer

A)  Establish a connection with external devices. 
B)  Temporarily store electronic data that is being processed. 
C)  Execute the POST during start-up. 
D)  Permanently store electronic data.

Exam 2: Certification for EnCE Outside North America