Question 1

A case file can contain ____ hard drive images?

Accepted Answer

A case file can contain any number of hard drive images, as it is designed to handle multiple pieces of evidence for comprehensive analysis.

Question 2

Bookmarks are stored in which of the following files?

Accepted Answer

The answer of Bookmarks are stored in which of the...

Question 3

Within EnCase, what is purpose of the default export folder?

Accepted Answer

The answer of Within EnCase, what is purpose of the...

Question 4

In Unicode, one printed character is composed of ____ bytes of data.

Accepted Answer

Unicode characters are typically represented using UTF-16 encoding, which uses 2 bytes (16 bits) for most common characters.

Question 5

What information in a FAT file system directory entry refers to the location of a file on the hard drive?

Accepted Answer

The starting cluster in a FAT file system directory entry indicates the location of the first cluster of the file on the hard drive, which is used to find the rest of the file.

Question 6

In the EnCase environment, the term external viewers is best described as?

Accepted Answer

External viewers in EnCase are programs associated with it to open specific file types that EnCase itself cannot natively view.

Question 7

What files are reconfigured or deleted by EnCase during the creation of an EnCase boot disk?

Accepted Answer

The answer of What files are reconfigured or deleted by...

Question 8

The boot partition table found at the beginning of a hard drive is located in what sector?

Accepted Answer

The boot partition table is located in the Master Boot Record (MBR), which is found in the first sector of a hard drive.

Question 9

By default, EnCase will display the data from the end of a logical file, to the end of the cluster, in what color:

Accepted Answer

The answer of By default, EnCase will display the data...

Question 10

Will EnCase allow a user to write data into an acquired evidence file?

Accepted Answer

EnCase does not allow writing data into an acquired evidence file to maintain the integrity of the evidence.

Question 11

The signature table data is found in which of the following files?

Accepted Answer

The signature table data is typically found in the configuration FileSignatures.ini file, which contains information about file signatures used for identifying file types.

Question 12

In DOS acquisition mode, if a physical drive is detected, but no partition information is displayed, what would be the cause:

Accepted Answer

If no partition information is displayed, it could be because there are no partitions present or because the partition scheme is not recognized by DOS.

Question 13

The following keyword was typed in exactly as shown.  Choose the answer(s) that would result.  All search criteria have default settings. credit card

Accepted Answer

The search criteria have default settings, so the keyword "credit card" will match both "Credit Card" and "credit card".

Question 14

This question addresses the EnCase for Windows search process.  If a target word is within a logical file, and it begins in cluster 10 and ends in cluster 15 (the word is fragmented), the search

Accepted Answer

EnCase performs a logical search, which means it can find fragmented words within logical files.

Question 15

ROM is an acronym for:

Accepted Answer

ROM stands for Read Only Memory, which is a type of non-volatile memory used in computers and other electronic devices to store data that does not change.

Question 16

What does the acronym BIOS stand for?

Accepted Answer

BIOS stands for Basic Input/Output System, which is firmware used to perform hardware initialization during the booting process and to provide runtime services for operating systems and programs.

Question 17

The temporary folder of a case cannot be changed once it has been set.

Accepted Answer

The temporary folder of a case can be changed if the system or application allows for such modifications.

Question 18

What information should be obtained from the BIOS during computer forensic investigations?

Accepted Answer

The date and time (A) and the boot sequence (D) are both important pieces of information to obtain from the BIOS during computer forensic investigations. The date and time can help to establish a timeline of events, while the boot sequence can help to identify any unauthorized changes that have been made to the computer.

Question 19

Consider the following path in a FAT file system: C : \ My Documents\My Pictures\Bikes. Where does the directory Bikes receive its name?

Accepted Answer

The directory "Bikes" receives its name from the "My Pictures" directory, as it is a subdirectory within "My Pictures".

Question 20

Select the appropriate name for the highlighted area of the binary numbers.

Accepted Answer

The answer of Select the appropriate name for the highlighted...

Exam 2: Certification for EnCE Outside North America