Question 1

A SCSI drive is pinned as a master when it is:

Accepted Answer

A)  The only drive on the computer. 
B)  A SCSI drive is not pinned as a master. 
C)  Whenever another drive is on the same cable and is pinned as a slave. 
D)  The primary of two drives connected to one cable.

Question 2

By default, what color does EnCase use for slack?

Accepted Answer

A)  Red 
B)  Black 
C)  Black on red 
D)  Red on black

Question 3

Search results are found in which of the following files?

Accepted Answer

A)  All of the above 
B)  The evidence file 
C)  The configuration Searches.ini file 
D)  The case file

Question 4

The Windows 98 Start Menu has a selection called documents which displays a list of recently used files. Which of the following folders contain those files?

Accepted Answer

A)  C : \ Windows\History 
B)  C : \ Windows\Documents 
C)  C : \ Windows\Start menu\Documents 
D)  C : \ Windows\Recent

Question 5

Creating an image of a hard drive that was seized as evidence:

Accepted Answer

A)  Should be done by the user, as they are most familiar with the hard drive. 
B)  May only be done by trained personnel because the process has the potential to alter the original evidence. 
C)  May be done by anyone because it is a relatively simple procedure. 
D)  May only be done by computer scientists.

Question 6

To undelete a file in the FAT file system, EnCase obtains the starting extent from the:

Accepted Answer

A)  Directory entry 
B)  Operating system 
C)  File header 
D)  FAT

Question 7

EnCase uses the _________________ to conduct a signature analysis.

Accepted Answer

A)  file signature table 
B)  hash library 
C)  Both a and b 
D)  file Viewers

Exam 2: Certification for EnCE Outside North America