Deck 1: Certification For ENCE North America

Question 1

A signature analysis has been run on a case. The result "Bad Signature " means

A) The file signature is known and does not match a known file header.
B) The file signature is known and the file extension is known.
C) The file signature is known and does not match a known file extension.
D) The file signature is unknown and the file extension is known.

Answer 1

The file signature is unknown and the file extension is known.

Question 2

When can an evidence file containing a NTFS partition be logically restored to a FAT 32 partition?

A) Never
B) When the FAT 32 has the same number of sectors / clusters.
C) When the FAT 32 is the same size or bigger.
D) Both B and C

Answer 2

Never

Question 3

Temp files created by EnCase are deleted when EnCase is properly closed.

Answer 3

True

Question 4

If cases are worked on a lab drive in a secure room, without any cleaning of the contents of the drive, which of the following areas would be of most concern?

A) There is no concern
B) Cross-contamination
C) Chain-of-custody
D) Storage

Question 5

Which of the following is commonly used to encode e-mail attachments?

A) GIF
B) EMF
C) JPEG
D) Base64

Question 6

What files are reconfigured or deleted by EnCase during the creation of an EnCase boot disk?

A) command.com
B) autoexec.bat
C) drvspace.bin
D) io.sys

Question 7

Which of the following statements is more accurate?

A) The Recycle Bin increases the chance of locating the existence of a file on a computer.
B) The Recycle Bin reduces the chance of locating the existence of a file on a computer.

Question 8

The EnCase methodology dictates that ________ be created prior to acquiring evidence.

A) a unique directory on the lab drive for case management
B) a text file for notes
C) an .E01 file on the lab drive
D) All of the above

Question 9

Which of the following selections would be used to keep track of a fragmented file in the FAT file system?

A) The directory entry for the fragmented file
B) The partition table of extents
C) The File Allocation Table
D) All of the above

Question 10

You are conducting an investigation and have encountered a computer that is running in the field. The operating system is Windows XP. A software program is currently running and is visible on the screen. You should:

A) Navigate through the program and see what the program is all about, then pull the plug.
B) Pull the plug from the back of the computer.
C) Photograph the screen and pull the plug from the back of the computer.
D) Pull the plug from the wall.

Question 11

A file extension and signature can be manually added by:

A) Using the new library feature under hash libraries.
B) Right-clicking on a file and selecting add.
C) Using the new set feature under hash sets.
D) Using the new file signature feature under file signatures.

Question 12

A standard DOS 6.22 boot disk is acceptable for booting a suspect drive.

Question 13

The case file should be archived with the evidence files at the termination of a case.

Question 14

What information in a FAT file system directory entry refers to the location of a file on the hard drive?

A) The file size
B) The file attributes
C) The starting cluster
D) The fragmentation settings

Question 15

A signature analysis has been run on a case. The result "JPEG" in the signature column means

A) The file signature is unknown and the header is a JPEG.
B) The file signature is a JPEG signature and the file extension is incorrect.
C) The file signature is unknown and the file extension is JPEG.
D) None of the above.

Question 16

Using good forensic practices, when seizing a computer at a business running Windows 2000 Server you should:

A) Pull the plug from the back of the computer.
B) Press the power button and hold it in.
C) Shut it down normally.
D) Pull the plug from the wall.

Question 17

An evidence file was archived onto five CD-Rom disks with the third file segment on disk number three. Can the contents of the third file segment be verified by itself while still on the CD?

A) No. Archived files are compressed and cannot be verified until un-archived.
B) No. All file segments must be put back together.
C) Yes. Any segment of an evidence file can be verified through re-computing and comparing the CRCs, even if it is on a CD.
D) No. EnCase cannot verify files on CDs.

Question 18

EnCase can build a hash set of a selected group of files.

Question 19

The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. [\x00-\x05]\x00\x00\x00

A) FF 0000 00 00 FF BA
B) 0000 00 01 FF FF BA
C) 04 06 0000 00 FF FF BA
D) 04 0000 00 FF FF BA

Question 20

Which of the following items could contain digital evidence?

A) Credit card readers
B) Personal assistant devices
C) Cellular phones
D) Digital cameras
E) None of the above

Question 21

A restored floppy diskette will have the same hash value as the original diskette.

Question 22

The EnCase evidence file logical filename can be changed without affecting the verification of the acquired evidence.

Question 23

A suspect typed a file on his computer and saved it to a floppy diskette. The filename was MyNote.txt. You receive the floppy and the suspect computer. The suspect denies that the floppy disk belongs to him. You search the suspect computer an d locate only the filename within a .LNK file. The .LNK file is located in the folder C : \ Windows\Recent. How you would use the .LNK file to establish a connection between the file on the floppy diskette and the suspect computer?

A) The file signature found in the .LNK file
B) The dates and time of the file found in the .LNK file, at file offset 28
C) Both a and b
D) The full path of the file, found in the .LNK file

Question 24

You are assigned to assist with the search and seizure of several computers. The magistrate ordered that the computers cannot be seized unless they are found to contain any one of ten previously identified images. You currently have the ten images in JPG format. Using the EnCase methodology, how would you best handle this situation?

A) UseFastBloc or a network/parallel port cable to preview the hard drives. Go to the Gallery view and search for the previously identified images.
B) UseFastBloc or a network/parallel port cable to acquire forensic images of the hard drives, then search the evidence files for the previously identified images.
C) UseFastBloc or a network/parallel port cable to preview the hard drives. Conduct a hash analysis of the files on the hard drives, using a hash library containing the hash values of the previously identified images.
D) Use an EnCase DOS boot disk to conduct a text search for child porn. Use an EnCase DOS boot disk to conduct a text search for child porn?

Question 25

Assume that MyNote.txt has been deleted. The FAT file system directory entry for that file has been overwritten. The data for MyNote.txt is now:

A) Overwritten
B) Allocated
C) Cross-linked
D) Unallocated

Question 26

A sector on a floppy disk is the same size as a sector on a NTFS formatted hard drive.

Question 27

An Enhanced Metafile would best be described as:

A) A compressed zip file.
B) A graphics file attached to an e-mail message.
C) A compound e-mail attachment.
D) A file format used in the printing process by Windows.

Question 28

In the FAT file system, the size of a deleted file can be found:

A) In the FAT
B) In the directory entry
C) In the file footer
D) In the file header

Question 29

The EnCase methodology dictates that the lab drive for evidence have a __________ prior to making an image.

A) FAT 16 partition
B) NTFS partition
C) unique volume label
D) bare, unused partition

Question 30

When undeleting a file in the FAT file system, EnCase will check the _____________ to see if it has already been overwritten.

A) data on the hard drive
B) deletion table
C) directory entry
D) FAT

Question 31

The EnCase case file can be best described as:

A) The file that runs EnCase for Windows.
B) A filecontain configuration settings for cases.
C) A file that contains information specific to one case.
D) None of the above.

Question 32

When a non-compressed evidence file is reacquired with compression, the acquisition and verification hash values for the evidence will remain the same for both files.

Question 33

Consider the following path in a FAT file system:

A) From the My Pictures directory
B) From the My Documents directory
C) From the root directory C : \
D) From itself

Question 34

EnCase marks a file as overwritten when _____________ has been allocated to another file.

A) all of the file
B) the starting cluster of the file
C) the directory entry for the file
D) any part of the file

Question 35

To later verify the contents of an evidence file 7RODWHUYHULI\WKHFRQWHQWVRIDQHYLGHQFHILOH

A) EnCase writes a CRC value for every 64 sectors copied.
B) EnCase writes a CRC value for every 128 sectors copied.
C) EnCase writes an MD5 hash value every 64 sectors copied.
D) EnCase writes an MD5 hash value for every 32 sectors copied.

Question 36

During the power-up sequence, which of the following happens first?

A) The boot sector is located on the hard drive.
B) The Power On Self-Test (POST) 
C) The floppy drive is checked for a diskette.
D) The BIOS on an add-in card is executed.

Question 37

When a file is deleted in the FAT file system, what happens to the FAT?

A) The FAT entries for that file are marked as allocated.
B) Nothing.
C) It is deleted as well.
D) The FAT entries for that file are marked as available.

Question 38

A personal data assistant was placed in an evidence locker until an examiner has time to examine it. Which of the following areas would require special attention?

A) Chain-of-custody
B) Storage
C) There is no concern
D) Cross-contamination

Question 39

A hard drive has 8 sectors per cluster. File Mystuff.doc has a logical file size of 13,000 bytes. How many clusters will be used by Mystuff.doc?

A) 4
B) 1
C) 2
D) 3

Question 40

The maximum file segment size for an EnCase evidence file is:

A) 1500 MB
B) 1000 MB
C) 2000 MB
D) There is no limit.
E) 500 MB

Question 41

The EnCase signature analysis is used to perform which of the following actions?

A) Analyzing the relationship of a file signature to its file extension.
B) Analyzing the relationship of a file signature to its file header.
C) Analyzing the relationship of a file signature to a list of hash sets.
D) Analyzing the relationship of a file signature to its computed MD5 hash value.

Question 42

Changing the filename of a file will change the hash value of the file.

Question 43

Which of the following aspects of the EnCase evidence file can be changed during a reacquire of the evidence file

A) The evidence number
B) The acquisition notes
C) The investigator name
D) None of the above

Question 44

When a file is deleted in the FAT file system, what happens to the filename?

A) It is zeroed out.
B) The first character of the directory entry is marked with a hex 00.
C) It is wiped from the directory.
D) The first character of the directory entry is marked with a hex E5.

Question 45

Bookmarks are stored in which of the following files?

A) The case file
B) The evidence file
C) The configuration Bookmarks.ini file
D) All of the above

Question 46

A CPU is:

A) A chip that would be considered the brain of a computer, which is installed on a motherboard.
B) A Central Programming Unit.
C) A motherboard with all required devices connected.
D) An entire computer box, not including the monitor and other attached peripheral devices.

Question 47

The following keyword was typed in exactly as shown. Choose the answer(s) that would result. All search criteria have default settings. Tom Jones

A) tom jones
B) Tom
C) Jones
D) Tom Jones

Question 48

Within EnCase, you highlight a range of data within a file. The length indicator displays the value 30. How many bytes have you actually selected?

A) 30
B) 3
C) 60
D) 15

Question 49

Which of the following would most likely be an add-in card?

A) A video card that is connected to the motherboard in the AGP slot
B) Anything plugged into socket 7
C) A motherboard
D) The board that connects to the power supply

Question 50

The Windows 98 Start Menu has a selection called documents which displays a list of recently used files. Which of the following The Windows 98 Start Menu has a selection called documents which displays a list of recently used files. Which of the following folders contain those files?

A) C : \ Windows\History
B) C : \ Windows\Start menu\Documents
C) C : \ Windows\Documents
D) C : \ Windows\Recent

Question 51

Which of the following would be a true statement about the function of the BIOS?

A) The BIOS integrates compressed executable files with memory addresses for faster execution.
B) The BIOS is responsible for checking and configuring the system after the power is turned on.
C) The BIOS is responsible for swapping out memory pages when RAM fills up.
D) Both a and c.

Question 52

To undelete a file in the FAT file system, EnCase computes the number of _______ the file will use based on the file ______.

A) Clusters;starting extent
B) Sectors;starting extent
C) Clusters;file size
D) Sectors;file size

Question 53

For an EnCase evidence file acquired with a hash value to pass verification, which of the following must be true?

A) The MD5 hash value must verify.
B) The CRC values must verify.
C) The CRC values and the MD5 hash value both must verify.
D) Either the CRC or MD5 hash values must verify.

Question 54

Will EnCase allow a user to write data into an acquired evidence file

A) Yes, but only bookmarks.
B) Yes, but only to resize the partitions.
C) No. Data cannot be added to the evidence file after the acquisition is made.
D) Yes, but only case information.
E) No, unless the user established a writing privilege when the evidence was acquired.

Question 55

When a drive letter is assigned to a logical volume, that information is temporarily written the volume boot record on the hard drive.

Question 56

A SCSI host adapter would most likely perform which of the following tasks?

A) Configure the motherboard settings to the BIOS.
B) Set up the connection of IDE hard drives.
C) Make SCSI hard drives and other SCSI devices accessible to the operating system.
D) None of the above.

Question 57

In Windows, the file MyNote.txt is deleted from C Drive and is automatically sent to the Recycle Bin. The long filename was MyNote.txt and the short filename was MYNOTE.TXT. When viewing the Recycle Bin with EnCase, how will the long filename and MyNote.txt and the short filename was MYNOTE.TXT?

A) MyNote.txt, CD0.txt
B) MyNote.txt, DC0.txt
C) MyNote.del, DC1.del
D) MyNote.del, DC0.del

Question 58

A case file can contain ____ hard drive images?

A) 5
B) 1
C) any number of
D) 10

Question 59

Creating an image of a hard drive that was seized as evidence:

A) May be done by anyone because it is a relatively simple procedure.
B) May only be done by trained personnel because the process has the potential to alter the original evidence.
C) May only be done by computer scientists.
D) Should be done by the user, as they are most familiar with the hard drive.

Question 60

You are at an incident scene and determine that a computer contains evidence as described in the search warrant. When you seize the computer, you should:

A) Record nothing to avoid inaccuracies that might jeopardize the use of the evidence.
B) Record the location that the computer was recovered from.
C) Record the identity of the person(s) involved in the seizure.
D) Record the date and time the computer was seized.

Question 61

The spool files that are created during a print job are __________ after the print job is completed.

A) moved
B) wiped
C) deleted and wiped
D) deleted

Question 62

In Windows 2000 and XP, which of the following directories contain user personal folders?

A) C : \ Personnel Folders
B) C : \ WINNT\Profiles
C) C : \ Windows\Users
D) C : \ Documents and Settings

Question 63

Within EnCase, what is purpose of the default export folder?

A) This is the folder that will be automatically selected when the copy/unerase feature is used.
B) This is the folder that will automatically store an evidence file when the acquisition is made in DOS.
C) This is the folder that temporarily stores all bookmark and search results.
D) This is the folder used to hold copies of files that are sent to external viewers.

Question 64

The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. 800[) \-]+555-1212

A) [phone]
B) 800-555 1212
C) 8005551212
D) 800.555.1212

Question 65

Which of the following selections is NOT found in the case file

A) External viewers
B) Pointers to evidence files
C) Signature analysis results
D) Search results

Question 66

The following keyword was typed in exactly as shown. Choose the answer(s) that would be found. All search criteria have default settings. Tom

A) Tomorrow
B) [e-mail]
C) Tom
D) Stomp
E) None of the above

Question 67

By default, what color does EnCase use for the contents of a logical file

A) Red
B) Red on black
C) Black
D) Black on red

Question 68

A hash set would most accurately be described as:

A) A group of hash libraries organized by category.
B) A group of hash values that can be added to the hash library.
C) A table of file headers and extensions.
D) Both a and b.

Question 69

If a hash analysis is run on a case, EnCase:

A) Will compute a hash value of the evidence file and begin a verification process.
B) Will generate a hash set for every file in the case.
C) Will compare the hash value of the files in the case to the hash library.
D) Will create a hash set to the user specifications.

Question 70

The MD5 hash algorithm produces a _____ number.

A) 32 bit
B) 256 bit
C) 64 bit
D) 128 bit

Question 71

The following keyword was typed in exactly as shown. Choose the answer(s) that would result. All search criteria have default settings. Speed and Meth

A) Meth
B) Meth Speed
C) Speed and Meth
D) Speed

Question 72

You are investigating a case involving fraud. You seized a computer from a suspect who stated that the computer is not used by anyone other than himself. The computer has Windows 98 installed on the hard drive. You find the filename C : \ downloads\check01. jpg that EnCase shows as being moved. The starting extent is 0C4057. You find another filename :\downloads\chk1.dll with the starting extent 0C4057, which EnCase also shows as being moved. In the C : \ Windows\System folder you find an allocated file named chk1.dll with the starting extent 0C4057. The chk1.dll file is a JPEG image of a counterfeit check. What can be deduced from your findings?

A) The presence and location of the files is strong evidence the suspect committed the crime.
B) The presence and location of the files is not strong evidence the suspect committed the crime.

Question 73

The results of a hash analysis on an evidence file that has been added to a case will be stored in which of the following files?

A) The evidence file
B) The case file
C) The configuration HashAnalysis.ini file
D) All of the above

Question 74

The case number in an evidence file can be changed without causing the verification feature to report an error, if:

A) The user utilizes a text editor.
B) The case information cannot be changed in an evidence file, without causing the verification feature to report an error.
C) The user utilizes the case information editor within EnCase.
D) The evidence file is reacquired.

Question 75

An EnCase evidence file of a hard drive ________ be restored to another hard drive of equal or greater size.

A) can
B) cannot

Question 76

4 bits allows what number of possibilities?

A) 16
B) 4
C) 2
D) 8

Question 77

The EnCase evidence file is best described as:

A) A clone of the source hard drive.
B) A sector-by-sector copy of the source hard drive written to the corresponding sectors of the target hard drive.
C) A bit stream image of the source hard drive written to a file, or several file segments.
D) A bit stream image of the source hard drive written to the corresponding sectors of the target hard drive.

Question 78

Searches and bookmarks are stored in the evidence file.

Question 79

The first sector on a volume is called the:

A) Master file table
B) Volume boot device
C) Volume boot sector or record
D) Master boot record

Question 80

RAM is used by the computer to:

A) Execute the POST during start-up.
B) Temporarily store electronic data that is being processed.
C) Permanently store electronic data.
D) Establish a connection with external devices.