Question 1

A restored floppy diskette will have the same hash value as the original diskette.

Accepted Answer

The answer of A restored floppy diskette will have the...

Question 2

The EnCase evidence file logical filename can be changed without affecting the verification of the acquired evidence.

Accepted Answer

The logical filename of an EnCase evidence file can be changed without affecting the hash value or integrity of the evidence, as the verification process relies on the hash of the data, not the filename.

Question 3

A suspect typed a file on his computer and saved it to a floppy diskette. The filename was MyNote.txt. You receive the floppy and the suspect computer. The suspect denies that the floppy disk belongs to him. You search the suspect computer an d locate only the filename within a .LNK file. The .LNK file is located in the folder C : \ Windows\Recent. How you would use the .LNK file to establish a connection between the file on the floppy diskette and the suspect computer?

Accepted Answer

The file signature and the dates and time of the file found in the .LNK file can be used to establish a connection between the file on the floppy diskette and the suspect computer.

Question 4

You are assigned to assist with the search and seizure of several computers. The magistrate ordered that the computers cannot be seized unless they are found to contain any one of ten previously identified images. You currently have the ten images in JPG format. Using the EnCase methodology, how would you best handle this situation?

Accepted Answer

Conducting a hash analysis using a hash library with the hash values of the identified images is the most efficient and accurate method to determine if the images are present on the hard drives.

Question 5

Assume that MyNote.txt has been deleted. The FAT file system directory entry for that file has been overwritten. The data for MyNote.txt is now:

Accepted Answer

When a file is deleted in a FAT file system and its directory entry is overwritten, the data clusters are marked as unallocated, meaning the data is still present but available to be overwritten by new files.

Question 6

A sector on a floppy disk is the same size as a sector on a NTFS formatted hard drive.

Accepted Answer

The answer of A sector on a floppy disk is...

Question 7

An Enhanced Metafile would best be described as:

Accepted Answer

An Enhanced Metafile (EMF) is a graphics file format used by Windows for printing and displaying vector graphics.

Question 8

In the FAT file system, the size of a deleted file can be found:

Accepted Answer

In the FAT file system, the size of a deleted file is stored in the directory entry, which retains the file's metadata even after deletion.

Question 9

The EnCase methodology dictates that the lab drive for evidence have a __________ prior to making an image.

Accepted Answer

The answer of The EnCase methodology dictates that the lab...

Question 10

When undeleting a file in the FAT file system, EnCase will check the _____________ to see if it has already been overwritten.

Accepted Answer

The answer of When undeleting a file in the FAT...

Question 11

The EnCase case file can be best described as:

Accepted Answer

The EnCase case file contains information specific to one case, such as evidence, bookmarks, and other case-related data.

Question 12

When a non-compressed evidence file is reacquired with compression, the acquisition and verification hash values for the evidence will remain the same for both files.

Accepted Answer

The answer of When a non-compressed evidence file is reacquired...

Question 13

Consider the following path in a FAT file system:

Accepted Answer

The answer of Consider the following path in a FAT...

Question 14

EnCase marks a file as overwritten when _____________ has been allocated to another file.

Accepted Answer

The answer of EnCase marks a file as overwritten when...

Question 15

To later verify the contents of an evidence file 7RODWHUYHULI\WKHFRQWHQWVRIDQHYLGHQFHILOH

Accepted Answer

EnCase writes a CRC value for every 64 sectors copied to ensure data integrity and allow for later verification of the evidence file's contents.

Question 16

During the power-up sequence, which of the following happens first?

Accepted Answer

The Power On Self-Test (POST) is the first step in the power-up sequence. It checks the hardware to make sure it is functioning properly.

Question 17

When a file is deleted in the FAT file system, what happens to the FAT?

Accepted Answer

When a file is deleted in the FAT file system, the FAT entries for that file are marked as available, indicating that the space can be reused for new files.

Question 18

A personal data assistant was placed in an evidence locker until an examiner has time to examine it. Which of the following areas would require special attention?

Accepted Answer

The answer of A personal data assistant was placed in...

Question 19

A hard drive has 8 sectors per cluster. File Mystuff.doc has a logical file size of 13,000 bytes. How many clusters will be used by Mystuff.doc?

Accepted Answer

13,000 bytes / 8 sectors per cluster = 1,625 clusters. Since a file must use at least one cluster, Mystuff.doc will use 2 clusters.

Question 20

The maximum file segment size for an EnCase evidence file is:

Accepted Answer

The maximum file segment size for an EnCase evidence file is 2000 MB, which is the largest size that can be set for a segment of an evidence file in EnCase.

Exam 1: Certification For ENCE North America