Question 1

A signature analysis has been run on a case. The result "Bad Signature " means

Accepted Answer

D

Question 2

When can an evidence file containing a NTFS partition be logically restored to a FAT 32 partition?

Accepted Answer

NTFS and FAT32 are different file systems with different structures and capabilities, so an NTFS partition cannot be logically restored to a FAT32 partition.

Question 3

Temp files created by EnCase are deleted when EnCase is properly closed.

Accepted Answer

EnCase is designed to clean up temporary files it creates during its operation when the program is closed properly to ensure no unnecessary data is left behind.

Question 4

If cases are worked on a lab drive in a secure room, without any cleaning of the contents of the drive, which of the following areas would be of most concern?

Accepted Answer

Cross-contamination is a concern because working on a lab drive without cleaning its contents can lead to the mixing of data from different cases, potentially compromising the integrity of the evidence.

Question 5

Which of the following is commonly used to encode e-mail attachments?

Accepted Answer

Base64 is commonly used to encode e-mail attachments to ensure that binary data is transmitted over protocols that only support text.

Question 6

What files are reconfigured or deleted by EnCase during the creation of an EnCase boot disk?

Accepted Answer

The answer of What files are reconfigured or deleted by...

Question 7

Which of the following statements is more accurate?

Accepted Answer

The Recycle Bin temporarily stores deleted files, making it easier to locate and recover them if needed.

Question 8

The EnCase methodology dictates that ________ be created prior to acquiring evidence.

Accepted Answer

A unique directory on the lab drive for case management should be created to organize and manage the evidence properly before acquisition.

Question 9

Which of the following selections would be used to keep track of a fragmented file in the FAT file system?

Accepted Answer

The File Allocation Table (FAT) is used to keep track of the clusters that make up a file, including fragmented files, by maintaining a linked list of clusters.

Question 10

You are conducting an investigation and have encountered a computer that is running in the field. The operating system is Windows XP. A software program is currently running and is visible on the screen. You should:

Accepted Answer

Photographing the screen captures the current state of the program, which is crucial for evidence preservation. Pulling the plug ensures the system is powered down without altering data.

Question 11

A file extension and signature can be manually added by:

Accepted Answer

The correct method to manually add a file extension and signature is by using the new file signature feature under file signatures.

Question 12

A standard DOS 6.22 boot disk is acceptable for booting a suspect drive.

Accepted Answer

A standard DOS 6.22 boot disk may not be suitable for booting a suspect drive as it could alter or damage the data on the drive, which is critical in forensic investigations.

Question 13

The case file should be archived with the evidence files at the termination of a case.

Accepted Answer

The case file, which contains all relevant documentation and information about a case, should be archived along with the evidence files to ensure that all materials are preserved for future reference or legal requirements.

Question 14

What information in a FAT file system directory entry refers to the location of a file on the hard drive?

Accepted Answer

The starting cluster in a FAT file system directory entry indicates the location of the first cluster of the file on the hard drive, allowing the system to locate and access the file's data.

Question 15

A signature analysis has been run on a case. The result "JPEG" in the signature column means

Accepted Answer

The result "JPEG" in the signature column indicates that the file has a JPEG signature, but the file extension does not match this signature, suggesting the extension is incorrect.

Question 16

Using good forensic practices, when seizing a computer at a business running Windows 2000 Server you should:

Accepted Answer

Shutting down the computer normally ensures that all processes are properly terminated and data is not corrupted, which is crucial for maintaining the integrity of evidence.

Question 17

An evidence file was archived onto five CD-Rom disks with the third file segment on disk number three. Can the contents of the third file segment be verified by itself while still on the CD?

Accepted Answer

The contents of a file segment can be verified by re-computing and comparing the CRCs (Cyclic Redundancy Checks) even if it is on a CD.

Question 18

EnCase can build a hash set of a selected group of files.

Accepted Answer

EnCase forensic software allows users to create hash sets for selected files, which can be used for file identification and verification purposes.

Question 19

The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. [\x00-\x05]\x00\x00\x00

Accepted Answer

The GREP expression [\x00-\x05]\x00\x00\x00 matches a sequence where the first byte is any value from 00 to 05, followed by three 00 bytes. Option D matches this pattern with "04 0000 00".

Question 20

Which of the following items could contain digital evidence?

Accepted Answer

All listed items can contain digital evidence as they are capable of storing or processing digital data.

Exam 1: Certification For ENCE North America