You are assigned to assist with the search and seizure of several computers. The magistrate ordered that the computers cannot be seized unless they are found to contain any one of ten previously identified images. You currently have the ten images in JPG format. Using the EnCase methodology, how would you best handle this situation?
A) UseFastBloc or a network/parallel port cable to preview the hard drives. Go to the Gallery view and search for the previously identified images.
B) UseFastBloc or a network/parallel port cable to acquire forensic images of the hard drives, then search the evidence files for the previously identified images.
C) UseFastBloc or a network/parallel port cable to preview the hard drives. Conduct a hash analysis of the files on the hard drives, using a hash library containing the hash values of the previously identified images.
D) Use an EnCase DOS boot disk to conduct a text search for child porn. Use an EnCase DOS boot disk to conduct a text search for child porn?
Correct Answer:
Verified
Q19: The following GREP expression was typed in
Q20: Which of the following items could contain
Q21: A restored floppy diskette will have the
Q22: The EnCase evidence file logical filename can
Q23: A suspect typed a file on his
Q25: Assume that MyNote.txt has been deleted. The
Q26: A sector on a floppy disk is
Q27: An Enhanced Metafile would best be described
Q28: In the FAT file system, the size
Q29: The EnCase methodology dictates that the lab
Unlock this Answer For Free Now!
View this answer and more for free by performing one of the following actions
Scan the QR code to install the App and get 2 free unlocks
Unlock quizzes for free by uploading documents