Multiple Choice
How does EnCase verify that the case information (Case Number, Evidence Number, Investigator Name, etc) in an evidence file has not been damaged or changed, after the evidence file has been written?
A) The .case file writes a CRC value for the case information and verifies it when the case is opened.
B) EnCase does not verify the case information and case information can be changed by the user as it becomes necessary.
C) EnCase writes a CRC value of the case information and verifies the CRC value when the evidence is added to a case.
D) EnCase writes an MD5 hash value for the entire evidence file, which includes the case information, and verifies the MD5 hash when the evidence is added to a case.
Correct Answer:

Verified
Correct Answer:
Verified
Q26: RAM is an acronym for:<br>A) Random Addressable
Q27: Search terms are stored in what .ini
Q28: The end of a logical file to
Q29: Will EnCase allow a user to write
Q30: A SCSI host adapter would most likely
Q32: In hexadecimal notation, one byte is represented
Q33: During the power-up sequence, which of the
Q34: A physical file size is:<br>A) The total
Q35: A FAT directory has as a logical
Q36: Which of the following selections would be