Assume that an evidence file is added to a case, the case is saved, and the case is closed. What happens if the evidence file is moved, and the case is then opened?
A) EnCase reports that the file integrity has been compromised and renders the file useless.
B) EnCase opens the case, excluding the moved evidence.
C) EnCase asks for the location of the evidence file the next time the case is opened.
D) EnCase reports a different hash value for the evidence file.
Correct Answer:
Verified
Q92: GREP terms are automatically recognized as GREP
Q93: You are working in a computer forensic
Q94: In DOS acquisition mode, if a physical
Q95: The FAT in the File Allocation Table
Q96: RAM is an acronym for:
A) Random Addressable
Q97: How does EnCase verify that the case
Q98: The term signature and header as they
Q99: By default, what color does EnCase use
Q100: A hard drive has been formatted as
Q102: To undelete a file in the FAT
Unlock this Answer For Free Now!
View this answer and more for free by performing one of the following actions
Scan the QR code to install the App and get 2 free unlocks
Unlock quizzes for free by uploading documents