Question 1

An evidence file can be moved to another directory without changing the file verification.

Accepted Answer

Moving a file to another directory does not alter its contents, so the file's hash value, used for verification, remains unchanged.

Question 2

The EnCase evidence file is best described as:

Accepted Answer

The EnCase evidence file is a bit stream image of the source hard drive that is written to a file or several file segments, allowing for forensic analysis without altering the original data.

Question 3

The Windows 98 Start Menu has a selection called documents which displays a list of recently used files. Which of the following folders contain those files?

Accepted Answer

The "Documents" section in the Windows 98 Start Menu displays recently used files, which are stored as shortcuts in the "C:\Windows\Recent" folder.

Question 4

In the FAT file system, the size of a deleted file can be found:

Accepted Answer

In the FAT file system, the size of a deleted file is stored in the directory entry, which retains information about the file even after deletion.

Question 5

EnCase uses the _________________ to conduct a signature analysis.

Accepted Answer

EnCase uses the file signature table to conduct a signature analysis, which helps in identifying file types based on their headers.

Question 6

An evidence file was archived onto five CD-Rom disks with the third file segment on disk number three.  Can the contents of the third file segment be verified by itself while still on the CD?

Accepted Answer

The third file segment can be verified by re-computing and comparing the CRCs, even if it is on a CD.

Question 7

A hard drive was imaged using EnCase.  The original drive was placed into evidence.  The restore feature was used to make a copy of the original hard drive.  EnCase verifies the restored copy using:

Accepted Answer

EnCase uses an MD5 hash to verify the integrity of the restored copy by comparing it to the hash of the original drive to ensure data integrity and authenticity.

Exam 2: Certification for EnCE Outside North America

An evidence file can be moved to another directory without changing the file verification.

The EnCase evidence file is best described as:

The Windows 98 Start Menu has a selection called documents which displays a list of recently used files. Which of the following folders contain those files?

In the FAT file system, the size of a deleted file can be found:

EnCase uses the _________________ to conduct a signature analysis.

An evidence file was archived onto five CD-Rom disks with the third file segment on disk number three. Can the contents of the third file segment be verified by itself while still on the CD?

A hard drive was imaged using EnCase. The original drive was placed into evidence. The restore feature was used to make a copy of the original hard drive. EnCase verifies the restored copy using: