You are working in a computer forensic lab. A law enforcement investigator brings you a computer and a valid search warrant. You have legal authority to search the computer. The investigator hands you a piece of paper that has three printed checks on it. All three checks have the same check and account number. You image the suspect's computer and open the evidence file with EnCase. You perform a text search for the account number and check number. Nothing returns on the search results. You perform a text search for all other information found on the printed checks and there is still nothing returned in the search results. You run a signature analysis and check the gallery. You cannot locate any graphical copies of the printed checks in the gallery. At this point, is it safe to say that the checks are not located on the suspect computer?
A) No. The images could be located a compressed file.
B) No. The images could be in unallocated clusters.
C) No. The images could be embedded in a document.
D) All of the above.
E) No. The images could be in an image format not viewable inside EnCase.
Correct Answer:
Verified
Q45: When an EnCase user double-clicks on a
Q46: Select the appropriate name for the highlighted
Q47: During the power-up sequence, which of the
Q48: If cluster number 10 in the FAT
Q49: Which of the following selections is NOT
Q51: To undelete a file in the FAT
Q52: By default, what color does EnCase use
Q53: You are investigating a case involving fraud.
Q54: A SCSI host adapter would most likely
Q55: To later verify the contents of an
Unlock this Answer For Free Now!
View this answer and more for free by performing one of the following actions
Scan the QR code to install the App and get 2 free unlocks
Unlock quizzes for free by uploading documents