Question 1

All investigators using EnCase should run tests on the evidence file acquisition and verification process to:

Accepted Answer

Running tests on the evidence file acquisition and verification process ensures proper methods are used, enhances understanding, and strengthens testimony credibility.

Question 2

When handling computer evidence, an investigator should:

Accepted Answer

Avoid making any changes to the original evidence.

Question 3

When a file is deleted in the FAT or NTFS file systems, what happens to the data on the hard drive?

Accepted Answer

When a file is deleted in the FAT or NTFS file systems, the data on the hard drive is not immediately overwritten. Instead, the file header is marked as deleted, and the space that the file occupied is marked as free. This means that the data is still present on the hard drive, but it is no longer accessible to the operating system.

Question 4

Search terms are stored in what .ini configuration file

Accepted Answer

Search terms are typically stored in the Keywords.ini configuration file.

Question 5

Within EnCase, what is the purpose of the temp folder?

Accepted Answer

The temp folder in EnCase is used to hold copies of files that are sent to external viewers.

Question 6

What information should be obtained from the BIOS during computer forensic investigations?

Accepted Answer

The date and time are crucial for establishing timelines, and the boot sequence can provide insights into potential tampering or unauthorized access.

Question 7

A hash library would most accurately be described as:

Accepted Answer

A hash library is a file containing hash values from one or more selected hash sets, used to identify known files, such as system files or known malicious files.

Question 8

The end of a logical file to the end of the cluster that the file ends in is called:

Accepted Answer

Slack space is the unused space in a cluster from the end of a file to the end of the cluster.

Question 9

Assume that MyNote.txt was allocated to clusters 5, 9, and 11. Cluster 6, 7, and 8 belong to MyResume.doc. Both files have been deleted and the directory entry in the FAT file system for MyResume.doc has been overwritten. What clusters would EnCase use to undelete MyNote.txt?

Accepted Answer

The answer of Assume that MyNote.txt was allocated to clusters...

Question 10

How many copies of the FAT are located on a FAT 32, Windows 98-formatted partition?

Accepted Answer

FAT32, like its predecessors FAT12 and FAT16, typically maintains two copies of the File Allocation Table (FAT) for redundancy and recovery purposes.

Question 11

Within EnCase for Windows, the search process is:

Accepted Answer

EnCase for Windows searches both the physical disk, including unallocated clusters and unused areas, and logical files.

Question 12

GREP terms are automatically recognized as GREP by EnCase.

Accepted Answer

EnCase does not automatically recognize GREP terms; users must specify when they want to use GREP (regular expressions) for searching.

Question 13

You are working in a computer forensic lab. A law enforcement investigator brings you a computer and a valid search warrant. You have legal authority to search the computer. The investigator hands you a piece of paper that has three printed checks on it. All three checks have the same check and account number. You image the suspect computer and open the evidence file with EnCase. You checks have the same check and account number. You image the suspect's computer and open the evidence file with EnCase. You perform a text search for the account number and check number. Nothing returns on the search results. You perform a text search for all other information found on the printed checks and there is still nothing returned in the search results. You run a signature analysis and check the gallery. You cannot locate any graphical copies of the printed checks in the gallery. At this point, is it safe to say that the checks are not located on the suspect computer?

Accepted Answer

The checks could be hidden in various ways such as within compressed files, embedded in documents, in unallocated space, or in an unsupported image format.

Question 14

In DOS acquisition mode, if a physical drive is detected, but no partition information is displayed, what would be the cause:

Accepted Answer

If DOS does not recognize the partition scheme or if there are no partitions present, it would not display partition information.

Question 15

The FAT in the File Allocation Table file system keeps track of:

Accepted Answer

The FAT file system uses the File Allocation Table to keep track of file fragmentation, clusters marked as bad, and every addressable cluster on the partition, making all options correct.

Question 16

RAM is an acronym for:

Accepted Answer

RAM stands for Random Access Memory, which is a type of computer memory that can be accessed randomly.

Question 17

How does EnCase verify that the case information (Case Number, Evidence Number, Investigator Name, etc) in an evidence file has not been damaged or changed, after the evidence file has been written?

Accepted Answer

EnCase writes a CRC value of the case information and verifies the CRC value when the evidence is added to a case to ensure integrity.

Question 18

The term signature and header as they relate to a signature analysis are

Accepted Answer

The answer of The term signature and header as they...

Question 19

By default, what color does EnCase use for slack?

Accepted Answer

The answer of By default, what color does EnCase use...

Question 20

A hard drive has been formatted as NTFS and Windows XP was installed. The user used fdisk to remove all partitions from that drive. Nothing else was done. You have imaged the drive and have opened the evidence file with EnCase. What would be the best way to examine this hard drive?

Accepted Answer

The answer of A hard drive has been formatted as...

Exam 1: Certification For ENCE North America