Question 1

The end of a logical file to the end of the cluster that the file ends in is called:

Accepted Answer

Slack space is the unused space in a cluster from the end of a file to the end of the cluster.

Question 2

When undeleting a file in the FAT file system, EnCase will check the _____________ to see if it has already been overwritten.

Accepted Answer

The answer of When undeleting a file in the FAT...

Question 3

When does the POST operation occur?

Accepted Answer

The answer of When does the POST operation occur?
...

Question 4

Which of the following directories contain the information that is found on a Windows 98 Desktop?

Accepted Answer

In Windows 98, the Desktop directory is located at C:\Windows\Desktop.

Question 5

When an EnCase user double-clicks on a file within EnCase what determines the action that will result?

Accepted Answer

The FileTypes.ini file in EnCase determines how files are handled when double-clicked, specifying the default action based on file type.

Question 6

Select the appropriate name for the highlighted area of the binary numbers.

Accepted Answer

A nibble is a group of four bits in binary numbers.

Question 7

During the power-up sequence, which of the following happens first?

Accepted Answer

The Power On Self-Test (POST) is the first step in the power-up sequence, where the system checks the hardware components before proceeding to other steps.

Question 8

If cluster number 10 in the FAT contains the number 55, this means

Accepted Answer

The FAT (File Allocation Table) entry for cluster 10 pointing to cluster 55 indicates that cluster 10 is used and the file continues in cluster number 55.

Question 9

Which of the following selections is NOT found in the case file?

Accepted Answer

External viewers are tools used to view files but are not part of the case file itself, which typically contains analysis results, search results, and pointers to evidence files.

Question 10

You are working in a computer forensic lab. A law enforcement investigator brings you a computer and a valid search warrant. You have legal authority to search the computer. The investigator hands you a piece of paper that has three printed checks on it. All three checks have the same check and account number. You image the suspect's computer and open the evidence file with EnCase. You perform a text search for the account number and check number. Nothing returns on the search results. You perform a text search for all other information found on the printed checks and there is still nothing returned in the search results. You run a signature analysis and check the gallery. You cannot locate any graphical copies of the printed checks in the gallery. At this point, is it safe to say that the checks are not located on the suspect computer?

Accepted Answer

The checks could be in compressed files, unallocated clusters, embedded in documents, or in an unsupported image format.

Question 11

To undelete a file in the FAT file system, EnCase computes the number of _______ the file will use based on the file ______.

Accepted Answer

EnCase computes the number of clusters the file will use based on the file size to undelete a file in the FAT file system. Clusters are the allocation units in FAT, and the file size determines how many clusters are needed.

Question 12

By default, what color does EnCase use for slack?

Accepted Answer

The answer of By default, what color does EnCase use...

Question 13

You are investigating a case involving fraud. You seized a computer from a suspect who stated that the computer is not used by anyone other than himself. The computer has Windows 98 installed on the hard drive. You find the filename C : \ downloads\check01. jpg that EnCase shows as being moved. The starting extent is 0C4057. You find another filename C : \ downloads\chk1.dll with the starting extent 0C4057, which EnCase also shows as being moved. In the C : \ windows\System folder you find an allocated file named chk1.dll with the starting extent 0C4057. The chk1.dll file is a JPEG image of a counterfeit check. Could this information be used to refute the suspect claim that he never knew it was on the computer?

Accepted Answer

The chk1.dll file being moved and renamed suggests user activity, contradicting the suspect's claim of ignorance.

Question 14

A SCSI host adapter would most likely perform which of the following tasks?

Accepted Answer

A SCSI host adapter is designed to connect SCSI devices, such as hard drives, to a computer, making them accessible to the operating system.

Question 15

To later verify the contents of an evidence file?  7RODWHUYHULI\WKHFRQWHQWVRIDQHYLGHQFHILOH

Accepted Answer

EnCase writes a CRC value for every 64 sectors copied to ensure data integrity and to verify the contents of an evidence file.

Question 16

Assume that MyNote.txt has been deleted.  The FAT file system directory entry for that file has been overwritten.  The data for MyNote.txt is now:

Accepted Answer

When a file is deleted and its directory entry is overwritten in a FAT file system, the space it occupied is marked as unallocated, meaning it is available for new data to be written.

Question 17

When Unicode is selected for a search keyword, EnCase:

Accepted Answer

EnCase is designed to search for keywords in both Unicode and ASCII formats when Unicode is selected, ensuring comprehensive search results.

Question 18

Select the appropriate name for the highlighted area of the binary numbers.

Accepted Answer

The answer of Select the appropriate name for the highlighted...

Question 19

You are investigating a case of child pornography on a hard drive containing Windows XP. In the C : \ Documents and Settings\Bad Guy\Local Settings\Temporary Internet Files folder you find three images of child pornography. You find no other copies of the images on the suspect hard drive, and you find no other copies of the filenames. What can be deduced from your findings?

Accepted Answer

The presence of images in the Temporary Internet Files folder suggests they may have been cached by a web browser, which does not necessarily indicate intentional possession or downloading by the user.

Question 20

You are at an incident scene and determine that a computer contains evidence as described in the search warrant.  When you seize the computer, you should:

Accepted Answer

It is important to document the identity of the person(s) involved, the location from which the computer was recovered, and the date and time of seizure to maintain a clear chain of custody and ensure the evidence is admissible in court.

Exam 2: Certification for EnCE Outside North America

The end of a logical file to the end of the cluster that the file ends in is called:

When undeleting a file in the FAT file system, EnCase will check the _____________ to see if it has already been overwritten.

When does the POST operation occur?

Which of the following directories contain the information that is found on a Windows 98 Desktop?

When an EnCase user double-clicks on a file within EnCase what determines the action that will result?

Select the appropriate name for the highlighted area of the binary numbers.

During the power-up sequence, which of the following happens first?

If cluster number 10 in the FAT contains the number 55, this means

Which of the following selections is NOT found in the case file?

To undelete a file in the FAT file system, EnCase computes the number of _ the file will use based on the file .

By default, what color does EnCase use for slack?

A SCSI host adapter would most likely perform which of the following tasks?

To later verify the contents of an evidence file? 7RODWHUYHULI\WKHFRQWHQWVRIDQHYLGHQFHILOH

Assume that MyNote.txt has been deleted. The FAT file system directory entry for that file has been overwritten. The data for MyNote.txt is now:

When Unicode is selected for a search keyword, EnCase:

Select the appropriate name for the highlighted area of the binary numbers.

You are at an incident scene and determine that a computer contains evidence as described in the search warrant. When you seize the computer, you should: