Question 1

If cluster number 10 in the FAT contains the number 55, this means

Accepted Answer

A)  That the file starts in cluster number 55 and continues to cluster number 10. 
B)  The cluster number 55 is the end of an allocated file. 
C)  That there is a cross-linked file. 
D)  That cluster 10 is used and the file continues in cluster number 55.

Question 2

The boot partition table found at the beginning of a hard drive is located in what sector?

Accepted Answer

A)  Master boot record 
B)  Volume boot sector 
C)  Master file table 
D)  Volume boot record

Question 3

How many clusters can a FAT 16 system address?

Accepted Answer

A)  4,294,967,296 
B)  65,536 
C)  268,435,456 
D)  4,096

Question 4

The following keyword was typed in exactly as shown.  Choose the answer(s) that would be found.  All search criteria have default settings. Tom

Accepted Answer

A)  TomJ@hotmail.com 
B)  Tomorrow 
C)  Tom 
D)  Stomp 
E)  None of the above

Question 5

You are at an incident scene and determine that a computer contains evidence as described in the search warrant.  When you seize the computer, you should:

Accepted Answer

A)  Record the identity of the person(s) involved in the seizure. 
B)  Record the location that the computer was recovered from. 
C)  Record nothing to avoid inaccuracies that might jeopardize the use of the evidence. 
D)  Record the date and time the computer was seized.

Question 6

How many partitions can be found in the boot partition table found at the beginning of the drive?

Accepted Answer

A)  4 
B)  2 
C)  8 
D)  6

Question 7

ROM is an acronym for:

Accepted Answer

A)  Random Open Memory 
B)  Read Open Memory 
C)  Relative Open Memory 
D)  Read Only Memory

Question 8

You are conducting an investigation and have encountered a computer that is running in the field.  The operating system is Windows XP.  A software program is currently running and is visible on the screen.  You should:

Accepted Answer

A)  Pull the plug from the wall. 
B)  Photograph the screen and pull the plug from the back of the computer. 
C)  Pull the plug from the back of the computer. 
D)  Navigate through the program and see what the program is all about, then pull the plug.

Question 9

A standard Windows 98 boot disk is acceptable for booting a suspect drive.

Accepted Answer

A) True 
 B)False

Question 10

When a document is printed using EMF in Windows, what file(s) are generated in the spooling process?

Accepted Answer

A)  The .SHD file 
B)  The .SPL file 
C)  Both a and b 
D)  Neither a or b

Question 11

If a floppy diskette is in the a drive, the computer will always boot to that drive before any other device.

Accepted Answer

A) True 
 B)False

Question 12

What information in a FAT file system directory entry refers to the location of a file on the hard drive?

Accepted Answer

A)  The starting cluster 
B)  The fragmentation settings 
C)  The file attributes 
D)  The file size

Question 13

In DOS and Windows, how many bytes are in one FAT directory entry?

Accepted Answer

A)  16 
B)  8 
C)  32 
D)  Variable 
E)  64

Question 14

Before utilizing an analysis technique on computer evidence, the investigator should:

Accepted Answer

A)  Test the technique on simulated evidence in a controlled environment to confirm that the results are consistent. 
B)  Be trained in the employment of the technique. 
C)  Neither a or b. 
D)  Both a and b.

Question 15

Which statement would most accurately describe a motherboard?

Accepted Answer

A)  The main circuit board that has slots for the microprocessor, RAM, ROM, and add-in cards. 
B)  Any circuit board, regardless of its function. 
C)  An add-in card that controls all hard drive activity. 
D)  An add-in card that handles all RAM.

Question 16

EnCase marks a file as overwritten when _____________ has been allocated to another file.

Accepted Answer

A)  any part of the file 
B)  the directory entry for the file 
C)  the starting cluster of the file 
D)  all of the file

Question 17

The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. [\x00-\x05]\x00\x00\x00[\x00-\x05]\x00\x00\x00

Accepted Answer

A)  00 00 00 01 FF FF BA 
B)  FF 00 00 00 00 FF BA 
C)  04 00 00 00 FF FF BA 
D)  04 06 00 00 00 FF FF BA

Question 18

If a hash analysis is run on a case, EnCase:

Accepted Answer

A)  Will create a hash set to the user specifications. Will create a hash set to the user specifications. 
B)  Will compare the hash value of the files in the case to the hash library. 
C)  Will compute a hash value of the evidence file and begin a verification process. 
D)  Will generate a hash set for every file in the case.

Question 19

What are the EnCase configuration .ini files used for?

Accepted Answer

A)  Storing information that will be available to EnCase each time it is opened, regardless of the active case(s). 
B)  Storing the results of a signature analysis. 
C)  Storing pointers to acquired evidence. 
D)  Storing information that is specific to a particular case.

Question 20

The EnCase methodology dictates that the lab drive for evidence have a __________ prior to making an image.

Accepted Answer

A)  NTFS partition 
B)  unique volume label 
C)  FAT 16 partition 
D)  bare, unused partition

Exam 2: Certification for EnCE Outside North America