Question 1

The first sector on a hard drive is called the:

Accepted Answer

The first sector on a hard drive is called the Master Boot Record (MBR), which contains the boot loader and partition table.

Question 2

Which is the proper formula for determining the size in bytes of a hard drive that uses cylinders (C), heads (H), and sectors (S) geometry?

Accepted Answer

The size in bytes of a hard drive is calculated by multiplying the number of cylinders (C), heads (H), and sectors (S) by the size of each sector, which is typically 512 bytes.

Question 3

The EnCase methodology dictates that the lab drive for evidence have a __________ prior to making an image.

Accepted Answer

The answer of The EnCase methodology dictates that the lab...

Question 4

A SCSI drive is pinned as a master when it is:

Accepted Answer

SCSI drives do not use master/slave settings like IDE drives. Instead, they use unique SCSI IDs to differentiate between devices on the same bus.

Question 5

Which of the following aspects of the EnCase evidence file can be changed during a reacquire of the evidence file?

Accepted Answer

The answer of Which of the following aspects of the...

Question 6

Searches and bookmarks are stored in the evidence file.

Accepted Answer

The answer of Searches and bookmarks are stored in the...

Question 7

How many clusters can a FAT 16 system address?

Accepted Answer

FAT16 can address up to 65,536 clusters, as it uses a 16-bit field to store cluster numbers.

Question 8

Search results are found in which of the following files?

Accepted Answer

The answer of Search results are found in which of...

Question 9

The spool files that are created during a print job are __________ after the print job is completed.

Accepted Answer

Spool files are typically deleted after a print job is completed to free up space and maintain system efficiency.

Question 10

Select the appropriate name for the highlighted area of the binary numbers.

Accepted Answer

The answer of Select the appropriate name for the highlighted...

Question 11

EnCase marks a file as overwritten when _____________ has been allocated to another file.

Accepted Answer

EnCase marks a file as overwritten when the starting cluster of the file has been allocated to another file, indicating that the original file's data has been partially or fully replaced.

Question 12

A standard Windows 98 boot disk is acceptable for booting a suspect drive.

Accepted Answer

A standard Windows 98 boot disk is acceptable for booting a suspect drive because it contains the necessary files to load the operating system and access the drive's contents.

Question 13

How many partitions can be found in the boot partition table found at the beginning of the drive?

Accepted Answer

The boot partition table, specifically in the Master Boot Record (MBR) format, can contain up to 4 primary partitions.

Question 14

The EnCase case file can be best described as:

Accepted Answer

The EnCase case file contains information specific to one case, including evidence, bookmarks, and other case-related data.

Question 15

The EnCase methodology dictates that ________ be created prior to acquiring evidence.

Accepted Answer

A unique directory on the lab drive for case management should be created to organize and manage the evidence files properly.

Question 16

Within EnCase, what is the purpose of the temp folder?

Accepted Answer

The temp folder in EnCase is used to hold copies of files that are sent to external viewers.

Question 17

The FAT in the File Allocation Table file system keeps track of:

Accepted Answer

The FAT file system keeps track of every addressable cluster on the partition, clusters marked as bad, and file fragmentation, making "All of the above" the correct choice.

Question 18

Which of the following items could contain digital evidence?

Accepted Answer

All listed items are capable of storing or processing digital information, which can be used as digital evidence in investigations.

Question 19

The following GREP expression was typed in exactly as shown.  Choose the answer(s) that would result. Bob@[a-z]+.com

Accepted Answer

The GREP expression "Bob@[a-z]+.com" matches any email address starting with "Bob@" followed by one or more lowercase letters (a-z) and ending with ".com". Only option D fits this pattern.

Question 20

To generate an MD5 hash value for a file, EnCase:

Accepted Answer

EnCase computes the MD5 hash value based on the logical file, which includes the file's content but not the filename.

Exam 2: Certification for EnCE Outside North America