Question 1

You are examining a hard drive that has Windows XP installed as the operating system. You see a file that has a date and time in the deleted column. Where does that date and time come from?

Accepted Answer

The date and time in the deleted column for a file on a Windows XP system typically comes from the Info2 file, which is used by the Recycle Bin to track deleted files.

Question 2

If a hash analysis is run on a case, EnCase:

Accepted Answer

EnCase will compare the hash value of the files in the case to the hash library to identify known files, such as system files or known contraband.

Question 3

Which of the following is found in the FileSignatures.ini configuration file?

Accepted Answer

The FileSignatures.ini configuration file contains information related to the signature table, which is used to identify file types based on their signatures.

Question 4

When a file is deleted in the FAT file system, what happens to the FAT?

Accepted Answer

When a file is deleted in the FAT file system, the FAT entries for that file are marked as available, indicating that the space can be reused.

Question 5

If an evidence file has been added to a case and completely verified, what happens if the data area within the evidence file is later changed?

Accepted Answer

EnCase will detect the error both when the evidence file is manually re-verified and when the altered area is accessed, and it will allow access to the unchanged parts of the evidence file.

Question 6

The following keyword was typed in exactly as shown.  Choose the answer(s) that would be found.  All search criteria have default settings. Tom

Accepted Answer

The answer of The following keyword was typed in exactly...

Question 7

You are assigned to assist with the search and seizure of several computers.  The magistrate ordered that the computers cannot be seized unless they are found to contain any one of ten previously identified images.  You currently have the ten images in JPG format. Using the EnCase methodology, how would you best handle this situation?

Accepted Answer

Conducting a hash analysis using a hash library with the hash values of the identified images is the most efficient and accurate method to determine if the specific images are present on the hard drives.

Question 8

Search terms are stored in what .ini configuration file?

Accepted Answer

Search terms are typically stored in a configuration file named Keywords.ini.

Question 9

The following keyword was typed in exactly as shown.  Choose the answer(s) that would result.  All search criteria have default settings. Tom Jones

Accepted Answer

The answer of The following keyword was typed in exactly...

Question 10

An EnCase evidence file of a hard drive ________ be restored to another hard drive of equal or greater size.

Accepted Answer

An EnCase evidence file can be restored to another hard drive of equal or greater size, as it is a bit-by-bit copy of the original drive.

Question 11

When a document is printed using EMF in Windows, what file(s) are generated in the spooling process?

Accepted Answer

The .SHD file contains the job settings, and the .SPL file contains the actual print data. Both are generated during the spooling process when using EMF in Windows.

Question 12

Using good forensic practices, when seizing a computer at a business running Windows 2000 Server you should:

Accepted Answer

The answer of Using good forensic practices, when seizing a...

Question 13

Assume that an evidence file is added to a case, the case is saved, and the case is closed. What happens if the evidence file is moved, and the case is then opened?

Accepted Answer

EnCase will prompt for the new location of the evidence file when the case is reopened, as it needs to access the file to continue the investigation.

Question 14

To undelete a file in the FAT file system, EnCase obtains the starting extent from the:

Accepted Answer

EnCase retrieves the starting extent of a deleted file from the directory entry in the FAT file system, as this entry contains the necessary metadata to locate the file's data clusters.

Question 15

RAM is tested during which phase of the power-up sequence?

Accepted Answer

RAM is tested during the Power-On Self-Test (POST) phase, which is a diagnostic testing sequence run by a computer's firmware upon startup.

Question 16

A sector on a floppy disk is the same size as a sector on a NTFS formatted hard drive.

Accepted Answer

The answer of A sector on a floppy disk is...

Question 17

How are the results of a signature analysis examined?

Accepted Answer

Signature analysis results are examined by sorting on the signature column in the table view, as this column contains the relevant signature data for analysis.

Question 18

You are an investigator and have encountered a computer that is running at the home of a suspect.  The computer does not appear to be a part of a network. The operating system is Windows XP Home.  No programs are visibly running.  You should:

Accepted Answer

The answer of You are an investigator and have encountered...

Question 19

The BIOS chip on an IBM clone computer is most commonly located on:

Accepted Answer

The BIOS chip is typically located on the motherboard of an IBM clone computer, as it is integral to the system's boot process and hardware initialization.

Question 20

Search terms are case sensitive by default.

Accepted Answer

Search terms are case sensitive by default, meaning that "apple" and "Apple" will be treated as two different search terms.

Exam 2: Certification for EnCE Outside North America