How does EnCase verify that the case information (Case Number, Evidence Number, Investigator Name, etc) in an evidence file has not been damaged or changed, after the evidence file has been written?
A) The .case file writes a CRC value for the case information and verifies it when the case is opened.
B) EnCase does not verify the case information and case information can be changed by the user as it becomes necessary.
C) EnCase writes a CRC value of the case information and verifies the CRC value when the evidence is added to a case.
D) EnCase writes an MD5 hash value for the entire evidence file, which includes the case information, and verifies the MD5 hash when the evidence is added to a case.
Correct Answer:
Verified
Q71: A file extension and signature can be
Q72: Calls to the C : \ volume
Q73: Creating an image of a hard drive
Q74: In Windows 98 and ME, Internet based
Q75: A hash set would most accurately be
Q77: The following GREP expression was typed in
Q78: The acronym ASCII stands for:
A) American Standard
Q79: How does EnCase verify that the evidence
Q80: Which statement would most accurately describe a
Q81: The first sector on a hard drive
Unlock this Answer For Free Now!
View this answer and more for free by performing one of the following actions
Scan the QR code to install the App and get 2 free unlocks
Unlock quizzes for free by uploading documents