How does EnCase verify that the case information (Case Number, Evidence Number, Investigator Name, etc) in an evidence file has not been damaged or changed, after the evidence file has been written?
A) EnCase writes a CRC value of the case information and verifies the CRC value when the evidence is added to a case.
B) EnCase does not verify the case information and case information can be changed by the user as it becomes necessary.
C) The .case file writes a CRC value for the case information and verifies it when the case is opened.
D) EnCase writes an MD5 hash value for the entire evidence file, which includes the case information, and verifies the MD5 hash when the evidence is added to a case.
Correct Answer:
Verified
Q92: GREP terms are automatically recognized as GREP
Q93: You are working in a computer forensic
Q94: In DOS acquisition mode, if a physical
Q95: The FAT in the File Allocation Table
Q96: RAM is an acronym for:
A) Random Addressable
Q98: The term signature and header as they
Q99: By default, what color does EnCase use
Q100: A hard drive has been formatted as
Q101: Assume that an evidence file is added
Q102: To undelete a file in the FAT
Unlock this Answer For Free Now!
View this answer and more for free by performing one of the following actions
Scan the QR code to install the App and get 2 free unlocks
Unlock quizzes for free by uploading documents