Question 1

Assume that an evidence file is added to a case, the case is saved, and the case is closed. What happens if the evidence file is moved, and the case is then opened?

Accepted Answer

EnCase will prompt for the new location of the evidence file when the case is reopened, as it relies on the file path to access the evidence.

Question 2

To undelete a file in the FAT file system, EnCase obtains the starting extent from the:

Accepted Answer

The starting extent of a file in the FAT file system is stored in the directory entry, which EnCase uses to undelete a file.

Exam 1: Certification For ENCE North America

Assume that an evidence file is added to a case, the case is saved, and the case is closed. What happens if the evidence file is moved, and the case is then opened?

To undelete a file in the FAT file system, EnCase obtains the starting extent from the: