Multiple Choice
A hard drive was imaged using EnCase. The original drive was placed into evidence. The restore feature was used to make a copy of the original hard drive. EnCase verifies the restored copy using:
A) Nothing. Restored volumes are not verified.
B) A running log
C) An MD5 hash
D) A 32 bit CRC
Correct Answer:
Verified
Correct Answer:
Verified
Related Questions
Q44: The case number in an evidence file
Q45: The EnCase methodology dictates that _ be
Q46: Which of the following is found in
Q47: The BIOS chip on an IBM clone
Q48: Which is the proper formula for determining
Q50: RAM is tested during which phase of
Q51: Select the appropriate name for the highlighted
Q52: EnCase is able to read and examine
Q53: To undelete a file in the FAT
Q54: An EnCase evidence file of a hard