Multiple Choice
If an evidence file has been added to a case and completely verified, what happens if the data area within the evidence file is later changed?
A) EnCase detect the error if the evidence file is manually re-verified.
B) All of the above.
C) EnCase will detect the error when that area of the evidence file is accessed by the user.
D) EnCase will allow the examiner to continue to access the rest of the evidence file that has not been changed.
Correct Answer:

Verified
Correct Answer:
Verified
Q3: The EnCase default export folder is:<br>A) A
Q4: A file extension and signature can be
Q5: You are investigating a case of child
Q6: What information should be obtained from the
Q7: An evidence file was archived onto five
Q9: Calls to the C : \ volume
Q10: The following GREP expression was typed in
Q11: Which of the following selections is NOT
Q12: To generate an MD5 hash value for
Q13: Which of the following items could contain