Question 1

The spool files that are created during a print job are __________ after the print job is completed.

Accepted Answer

After a print job is completed, spool files are typically deleted to free up system resources.

Question 2

In Windows 2000 and XP, which of the following directories contain user personal folders?

Accepted Answer

In Windows 2000 and XP, user personal folders are stored in the "C:\Documents and Settings" directory.

Question 3

Within EnCase, what is purpose of the default export folder?

Accepted Answer

The default export folder in EnCase is used to automatically select the destination when using the copy/unerase feature.

Question 4

The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. 800[) \-]+555-1212

Accepted Answer

The expression matches a string that starts with "800", followed by any number of "[" or ")" characters, followed by a hyphen, followed by "555-1212". The expression will match the string "(800) 555-1212".

Question 5

Which of the following selections is NOT found in the case file

Accepted Answer

External viewers are not typically part of a case file; they are separate tools used to view or analyze data.

Question 6

The following keyword was typed in exactly as shown. Choose the answer(s) that would be found. All search criteria have default settings. Tom

Accepted Answer

The answer of The following keyword was typed in exactly...

Question 7

By default, what color does EnCase use for the contents of a logical file

Accepted Answer

EnCase uses black by default for the contents of a logical file.

Question 8

A hash set would most accurately be described as:

Accepted Answer

A hash set is a collection of hash values, typically used to identify known files, such as in digital forensics or data deduplication.

Question 9

If a hash analysis is run on a case, EnCase:

Accepted Answer

The answer of If a hash analysis is run on...

Question 10

The MD5 hash algorithm produces a _____ number.

Accepted Answer

The MD5 hash algorithm produces a 128-bit hash value.

Question 11

The following keyword was typed in exactly as shown. Choose the answer(s) that would result. All search criteria have default settings. Speed and Meth

Accepted Answer

The search will return results containing both "Speed" and "Meth" due to the use of "and" which is a logical operator.

Question 12

You are investigating a case involving fraud. You seized a computer from a suspect who stated that the computer is not used by anyone other than himself. The computer has Windows 98 installed on the hard drive. You find the filename C : \ downloads\check01. jpg that EnCase shows as being moved. The starting extent is 0C4057. You find another filename :\downloads\chk1.dll with the starting extent 0C4057, which EnCase also shows as being moved. In the C : \ Windows\System folder you find an allocated file named chk1.dll with the starting extent 0C4057. The chk1.dll file is a JPEG image of a counterfeit check. What can be deduced from your findings?

Accepted Answer

The presence and location of the files, along with the suspect's statement that he is the sole user of the computer, strongly suggest that the suspect is responsible for the files, indicating potential involvement in the crime.

Question 13

The results of a hash analysis on an evidence file that has been added to a case will be stored in which of the following files?

Accepted Answer

The results of a hash analysis are typically stored in the case file, which keeps track of all the analysis and findings related to the evidence in a digital forensic investigation.

Question 14

The case number in an evidence file can be changed without causing the verification feature to report an error, if:

Accepted Answer

The answer of The case number in an evidence file...

Question 15

An EnCase evidence file of a hard drive ________ be restored to another hard drive of equal or greater size.

Accepted Answer

An EnCase evidence file can be restored to another hard drive of equal or greater size because it is a bit-by-bit copy of the original drive, allowing for exact duplication.

Question 16

4 bits allows what number of possibilities?

Accepted Answer

4 bits can represent 2^4 = 16 different possibilities.

Question 17

The EnCase evidence file is best described as:

Accepted Answer

An EnCase evidence file is a bit stream image of the source hard drive written to a file or several file segments, preserving the exact data for forensic analysis.

Question 18

Searches and bookmarks are stored in the evidence file.

Accepted Answer

Searches and bookmarks are typically stored in the browser or application data, not in an evidence file, unless specifically exported or saved as evidence.

Question 19

The first sector on a volume is called the:

Accepted Answer

The first sector on a volume is typically called the Volume Boot Sector or Record, which contains the boot loader code and information about the volume.

Question 20

RAM is used by the computer to:

Accepted Answer

RAM (Random Access Memory) is used to temporarily store data that is being processed by the CPU, allowing for quick access and manipulation.

Exam 1: Certification For ENCE North America