Question 1

A CPU is:

Accepted Answer

The CPU, or Central Processing Unit, is a chip that acts as the brain of the computer, processing instructions and managing tasks. It is installed on the motherboard.

Question 2

The EnCase default export folder is:

Accepted Answer

The EnCase default export folder is a case-specific setting that can be changed according to the needs of each individual case.

Question 3

If cases are worked on a lab drive in a secure room, without any cleaning of the contents of the drive, which of the following areas would be of most concern?

Accepted Answer

Without cleaning the contents of the drive, there is a risk of cross-contamination between different cases or data sets.

Question 4

EnCase is able to read and examine which of the following file systems?

Accepted Answer

EnCase is a forensic tool that can read and examine multiple file systems, including HFS (used by macOS), FAT and NTFS (used by Windows), and EXT3 (used by Linux).

Question 5

A personal data assistant was placed in a evidence locker until an examiner has time to examine it.  Which of the following areas would require special attention?

Accepted Answer

The answer of A personal data assistant was placed in...

Question 6

When an EnCase user double-clicks on a valid . jpg file, that file is:

Accepted Answer

The answer of When an EnCase user double-clicks on a...

Question 7

What are the EnCase configuration .ini files used for?

Accepted Answer

EnCase configuration .ini files are used to store settings and information that are consistent across all sessions of EnCase, regardless of the specific case being worked on.

Question 8

Which of the following would be a true statement about the function of the BIOS?

Accepted Answer

The BIOS (Basic Input/Output System) is responsible for performing the POST (Power-On Self-Test) and configuring system settings when the computer is powered on. It does not handle memory management or execution of compressed files.

Question 9

A FAT directory has as a logical size of:

Accepted Answer

A FAT directory has a logical size of 0 bytes because it does not have a fixed size; it grows as files are added.

Question 10

In Windows, the file MyNote.txt is deleted from C Drive and is automatically sent to the Recycle Bin. The long filename was MyNote.txt and the short filename was MYNOTE.TXT. When viewing the Recycle Bin with EnCase, how will the long filename and MyNote.txt and the short filename was MYNOTE.TXT?

Accepted Answer

When a file is deleted in Windows and sent to the Recycle Bin, it is renamed with a unique identifier like DC0, DC1, etc., while retaining its original extension. The long filename remains the same, so it will be MyNote.txt, and the short filename will be renamed to something like DC0.txt.

Question 11

Which of the following selections would be used to keep track of a fragmented file in the FAT file system?

Accepted Answer

The File Allocation Table (FAT) is used to keep track of the clusters used by files, including fragmented files, in the FAT file system.

Question 12

A hard drive has been formatted as NTFS and Windows XP was installed.  The user used fdisk to remove all partitions from that drive. Nothing else was done.  You have imaged the drive and have opened the evidence file with EnCase.  What would be the best way to examine this hard drive?

Accepted Answer

The add Partition feature in EnCase can be used to rebuild the partition and then examine the system.

Question 13

Within EnCase for Windows, the search process is:

Accepted Answer

EnCase for Windows conducts searches on both logical files and the physical disk, including unallocated clusters and other unused disk areas, making both A and B correct.

Question 14

Hash libraries are commonly used to:

Accepted Answer

Hash libraries are used to identify files by comparing their hash values against a database of known hash values, helping to recognize files that are already known.

Question 15

RAM is an acronym for:

Accepted Answer

RAM stands for Random Access Memory, which is a type of computer memory that can be accessed randomly.

Question 16

In hexadecimal notation, one byte is represented by _____ character(s).

Accepted Answer

In hexadecimal notation, each character represents 4 bits, so one byte (8 bits) is represented by 2 characters.

Question 17

In DOS and Windows, how many bytes are in one FAT directory entry?

Accepted Answer

In DOS and Windows, a FAT directory entry is 32 bytes in size, which includes information such as the file name, extension, attributes, and other metadata.

Question 18

The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. [\x00-\x05]\x00\x00\x00[\x00-\x05]\x00\x00\x00

Accepted Answer

The GREP expression matches a pattern where the first and last bytes are in the range \x00 to \x05, and there are three \x00 bytes in between. Option C matches this pattern with "04 00 00 00" and the last byte "04" within the specified range.

Question 19

For an EnCase evidence file acquired with a hash value to pass verification, which of the following must be true?

Accepted Answer

Both the CRC values and the MD5 hash value must verify to ensure the integrity and authenticity of the EnCase evidence file.

Question 20

Which of the following would most likely be an add-in card?

Accepted Answer

A video card connected to the motherboard in the AGP slot is an example of an add-in card, which is a hardware component added to a computer to expand its capabilities.

Exam 2: Certification for EnCE Outside North America