EnCase Certified Examiner (EnCE) Practice Test

These questions are part of the practice quiz. Start practicing

• When unplugging a desktop computer, from where is it best to pull the plug?
• What must one do to create a new case in EnCase 7?
• When a text file is sent to a pre-Windows Vista Recycle Bin, Windows changes the short filename of the deleted file to DC0.txt. What does the 'D' in DC0.txt represent?
• How many bytes is each directory entry in a FAT file system?
• What does the Tools menu in EnCase primarily facilitate?
• What is the primary purpose of the Table pane in EnCase?
• If there is a discrepancy between the sectors reported by EnCase and the manufacturer, what should be suspected?
• What role does the master boot record (MBR) play in a hard drive's partitioning?
• What is the best method to shut down a notebook computer?
• In a FAT file system, the FAT tracks the ________ while the directory entry tracks the ________.
• The smallest area on a drive that data can be written to is a _______, while the smallest area on a drive that a file can be written to is a ________.
• Does the Ex01 evidence file format consist of three parts, including the Ev2 Header, Data, and CRC record block?
• Which term refers to the practice of organizing fragmented files to improve access time?
• In EnCase, which component allows a user to know the exact location of selected data in the evidence file?
• What is the maximum partition size supported by FAT32?
• If the FAT lists cluster number 2749 with a value of 0, what does this indicate about this specific cluster?
• What does LinEn contain to protect the target media during acquisition?
• Is the information contained on a computer's RAM chip accessible after a proper shutdown?
• Which of the following is not acceptable for "bagging" a computer workstation?
• What is contained in the Temporary Internet Files directory?
• Which method would NOT affect the verification of an evidence file in EnCase?
• When called to a large office complex with numerous networked machines, is it a good idea to request assistance from the network administrator?
• What is an important factor when gathering evidence from a live system?
• How is the Disk view launched in EnCase?
• How can a user reverse-sort on a column in the Table view?
• Where is the configuration list of external viewers located in EnCase?
• Which EnCase feature is most useful for searching specific keywords in data?
• Where are most of a user's desktop items located in a Windows 7 operating system?
• What is a critical reason for not leaving digital evidence unattended in an unsecured area?
• What information do index.dat files typically store?
• How does EnCase recover a deleted file in a FAT file system?
• Which of the following can be determined about the capabilities of the EnCase Decryption Suite (EDS)?
• Which component of the FAT file system maintains a record of file fragmentation?
• Which of the following is an example of a compound file that EnCase can mount?
• What is one way to hide a column in the Table view?
• Which is true regarding the EnCase backup process for versions 7.04 and newer?
• Where can the NTUSER.DAT file be found in Windows 7?
• If an evidence file has been added to a case and verified, what happens if the data area is altered later?
• Which option applies to an HPA?
• When a document is opened, a link file bearing the document's filename is created in the ____ folder.
• Information contained in RAM memory, which is located on the motherboard, is _________.
• In an NTFS file system, where are date and time stamps in the registry stored?
• When EnCase sends a file to an external viewer, which folder is the file sent to?
• In computer systems, what does the abbreviation "RAM" stand for?
• A file's physical size is defined as which of the following?
• What is a good practice regarding documenting evidence during an investigation?
• In Linux, what does hdb2 refer to?
• What utility would you use in Windows to restore files from the Recycle Bin?
• Must an examiner create a new case before adding a device to examine in the EnCase Windows environment?
• What should you do when creating a storage volume to hold an EnCase evidence file with LinEn?
• Which of the following methods can be utilized to access emails in EnCase 7?
• In an NTFS partition, where is the backup copy of the volume boot record (VBR) stored?
• Which of the following aspects of the EnCase evidence file can be changed during a reacquire of the evidence file?
• What is the function of the Temp folder in an EnCase case?
• What is the area between the end of a file's logical size and the file's physical size called?
• What is one reason for creating hash sets in EnCase?
• Where was the log file evidence stored that was recovered during the forensic examination?
• What type of value does the MD5 hash algorithm produce?
• Which type of file extension is NOT typically associated with compound files?
• EnCase 7 is capable of processing which type of web-based email?
• When examining evidence related to printing, which file contains an image of the actual print job?
• In which circumstance is pulling the plug to shut down a computer system considered the best practice?
• When is it acceptable to navigate through a live system?
• How many characters can be addressed by the 7-bit ASCII character table and 16-bit Unicode?
• How can you verify that an image is an exact forensic duplicate of the original?
• What type of files typically remains in the Temporary Internet Files after multiple browsing sessions?
• What binary term describes the amount of data that represents a single character in a file?
• In the context of Windows file systems, what does NTFS stand for?
• At which level can the VFS module NOT mount objects in the Windows environment?
• What is the definition of a CPU?
• On a production Linux/Unix server, which user must you generally be to shut down the system?
• By default, what color does EnCase use to display directory entries within a directory structure?
• To identify Microsoft Office documents renamed with image extensions, what EnCase process should be used?
• Which files are created automatically in the case folder when a new case is initiated in EnCase 7?
• Which of the following is true about a volume boot record?
• When using LinEn, the support level for devices is determined by what?
• When reacquiring an image, is it permissible to change the evidence name?
• What mechanism does EnCase use to verify that case information has not been altered after writing?
• Is LinEn compatible with both Windows and DOS operating systems?
• How should CDs be acquired using EnCase?
• Which aspect is NOT adjustable during a reacquisition of an EnCase evidence file?
• What does the Gallery view tab use to determine graphics files?
• What is the purpose or function of a computer's ROM chip?
• What items should be left behind after a search warrant where evidence is seized?
• Will adding compression when reacquiring an image change the MD5 value of the acquisition hash?
• What type of data is primarily stored in the volume boot record?
• A user can manually add new file headers and extensions by doing which of the following?
• On a Windows 98 machine, the swap or page file is contained in which file?
• What is the smallest file size that an EnCase evidence file can be saved as?
• Which type of storage device uses jumper settings to configure connections?
• What file will hold the contents of RAM when the machine is powered off, and will be approximately the size of the system RAM?
• IDE, SCSI, and SATA are interfaces that describe which type of device?
• What is the best description of an EnCase evidence file?
• What influences the action resulting from double-clicking a file in EnCase?
• How many logical partitions can the partition table in the master boot record accommodate on a physical drive?
• By default, how many recently opened documents are displayed in the My Recent Documents or Recent Items folder in Windows XP, Windows Vista, or Windows 7?
• How does a corrupted sector in the data area of a hard drive affect the corresponding cluster number on a FAT?
• What is located at Cylinder 0, Head 0, Sector 1 on a hard drive?
• Which system file is responsible for storing index references to both deleted and active files on a system?
• How many copies of the FAT does each FAT32 volume maintain in its default configuration?
• What does it indicate if a hard drive is pinned as CS?
• What is one of the functions of a write blocker in digital forensics?
• Which selection keeps track of a fragmented file in a FAT (not exFAT) file system?
• Which component serves as the primary circuit board for a computer?
• What is the very first sector of a formatted hard drive that contains an operating system called?
• When a noncompressed evidence file is reacquired with compression, will the acquisition and verification hash values remain the same?
• What must be done before using a target drive to write evidence files with LinEn?
• With EnCase 7, how many hash libraries can be applied at one time to any case?
• Which selection displays the incorrect method for shutting down a computer?
• A hash _______ is comprised of hash _______, which is comprised of hash _______.
• With regard to hash categories, evidentiary files or files of interest are categorized as which of the following?
• By default, search terms are case sensitive.
• Data about Internet cookies, including URL names and date/time stamps, is stored where?
• A byte consists of ___ bits.
• What is the purpose of CRC values when verifying file segments?
• In Windows 7, the date and time of when a file was sent to the Recycle Bin can be found where?
• Can information stored in the BIOS ever change?
• What is the name of the electrical pathway used to transport data between computer components?
• To whom should you report if evidence has been tampered with?
• If a hard drive has been fdisked, where must you point in EnCase to recover the deleted partition(s) using the Add Partition feature?
• EnCase can create a hash value for which of the following?
• In NTFS, information unique to a specific user is stored in the ______ file.
• What is typically required before reacquiring an evidence file in EnCase?
• How can the contents of a PST file be viewed in EnCase 7?
• Filenames with the .url extension that direct web browsers to a specific website are typically located in which folder?
• An MD5 or SHA1 hash of a specific media generated by EnCase will yield the same hash value as an independent third-party MD5 or SHA1 hashing utility.
• Which of the following describes a partition table?
• Which statement is true regarding the Gallery view in EnCase?
• What does the term "volatile data" refer to in live system acquisitions?
• Usually a hash value found in a hash set named Windows 7 would be reported in the Hash Category column as which of the following?
• Which hashing algorithm is commonly used for data integrity validation?
• What is the name given to the very first sector of a partition?
• What is the main role of the root user when utilizing LinEn?
• How many clusters can a FAT32 file system manage?
• What determines the maximum number of partitions on a physical drive in a partition table?
• Is the information stored on a computer's ROM chip lost during a proper shutdown?
• What part of the computer system is most likely to contain data of evidentiary value?
• Which of the following statements is untrue with regard to the EnCase Evidence Processor?
• What is the first consideration when responding to a scene?
• Which feature in EnCase would you use to perform a binary analysis of files?
• How should you take down a Macintosh computer?
• Where is the date and time information about a file deletion in a Windows 7 Recycle Bin stored?
• What is a requirement when using the EnCase Portable Boot CD?
• Which folder does not contain an index.dat file?
• What type of files can link files point to?
• From where in Windows 7 can user-specific preference data be accessed?
• What is the role of the operating system?
• To filter out known good or system files, which EnCase process do you apply?
• What does a computer's power supply do?
• To completely verify the integrity of an EnCase evidence file, which statement is true?
• A bit can have a binary value of which of the following?
• What is one key function of a hash library in EnCase?
• True or False: The Windows operating system deletes the EMF file upon successful printing, but it can still be recovered by searching for its unique header information.
• Which type of file can potentially contain data about previously printed documents?
• What is the decimal integer value for the binary code 0000-1001?
• Which component is essential for analyzing file types in EnCase?
• Is it always safe to pull the plug on a Windows 7 Enterprise operating system?
• For an EnCase evidence file to successfully pass the verification process, what must be true?
• On which operating system will the EnCase Decryption Suite not decrypt Microsoft's Encrypting File System (EFS)?
• How is the chain of custody maintained?
• What does the Physical Disk Emulator (PDE) module mount data as?
• What numbering system do computers primarily use?
• Which of the following is not true regarding the NTFS file system?
• Which EnCase pane is used to view the names of the files in a specific folder?
• Which of the following is not true regarding the exFAT file system?
• A console prompt that displayed backslashes (\) is most likely which operating system?
• Which statement accurately describes the functionality of EnCase filters?
• At what user level must an examiner operate when using LinEn?
• What type of media can the Physical Disk Emulator (PDE) module not mount?
• How does EnCase verify the contents of an evidence file with default settings?
• What does the FAT indicate about a cluster marked with a value of 0?
• What is the function of the cookies folder in a web browser?
• What is true regarding EnCase Portable?
• What information is typically lost when shutting down a computer?
• Which statement about LinEn is true?
• What is the implication of suspecting Hidden Protected Area (HPA) in a drive?
• What is the role of RAID in storage technology?
• What three actions occur when a file is created in a FAT32 file system?
• True or False: EnScript is a proprietary programming language developed to work exclusively within the EnCase environment.
• In EnCase, which pane would you access to run scripts for automating tasks?
• Is it possible to move an evidence file to another directory without changing the file verification?
• Which type of analysis is necessary to correct the File Category of a renamed .jpeg file?
• What occurs when EnCase attempts to reopen a case after the evidence file has been moved?
• What is the best practice for "taking down" a Linux server for collection?
• What should you do if in doubt about how to handle electronic evidence?
• What essential component connects the CPU, memory chips, and other internal devices?
• How can a user change the default colors and text fonts within EnCase?
• A FAT file system stores date and time stamps in _______, whereas the NTFS file system stores date and time stamps in _______.
• Why should investigators using EnCase run tests on the evidence file acquisition and verification process?
• What term describes the binary numbering system?
• During reacquisition, which of the following can be changed?
• Which type of email cannot EnCase 6 recover?
• Will EnCase Gallery view display a .jpeg file if its file extension was renamed to .txt?
• What is the logical size of a directory entry in a FAT file system?
• What action does EnCase take when a deleted file's starting cluster number is assigned to another file?
• In terms of drive formatting options, what is true about LinEn?
• What happens when a column is hidden in the Table view?
• Why is it advisable to wipe a forensic drive before reusing it?
• What is the maximum number of columns that can be sorted simultaneously in the Table view tab?
• Which of the following best explains file signatures?
• When performing a keyword search in Windows, EnCase searches which of the following?
• Select the correct answer that completes the following statement: An MD5 hash __________.
• What is the maximum value represented by a single byte?
• What do the terms master, slave, and Cable Select refer to in hardware?
• Which of the following is not considered exclusively an output device?
• What is the definition of POST?
• What is the primary function of the Volume Boot Record (VBR)?
• What are the two modes for printing in Windows?
• To find evidence of user file opening activity, which folder should you check?
• Can the logical filename of the EnCase evidence file be changed without affecting the verification of the acquired evidence?
• Can the contents of the third file segment be verified independently while still on the CD-ROM?
• What does it indicate if EnCase prompts for the location of the evidence file?
• What type of files typically launches the Disk view in EnCase?
• What process is used to start a computer?
• To view the contents of a file within a folder in EnCase, which pane should be utilized?
• How should you take down a Unix/Linux machine?
• What does "Boot Sector" refer to on a hard drive?
• In Windows 7, which two master keys are present in the registry?
• On a FAT file system, FAT is defined as which of the following?
• The Virtual File System (VFS) module mounts data as what?
• What type of device is commonly associated with the term 'sequential access'?
• What is the largest file segment size that an EnCase evidence file can be saved as?
• What is the purpose of a hash value in digital forensics?
• Which statement is incorrect regarding the Master Boot Record (MBR) and Volume Boot Record (VBR)?
• What is the first sector on a volume commonly referred to as?
• What capability does EnCase 6 provide regarding email recovery?
• What kind of analysis can reveal data hidden within legitimate file types?
• Which of the following formats uses a character for each byte in binary representation?
• Which of the following accurately describes sdb in Linux?
• How many unique possibilities exist in 8 bits (2^8)?
• In what scenario would cross-contamination be a concern during evidence acquisition?
• How should you take down a computer running Windows 2008 Server?
• Which type of hard drive interface is known for higher data transfer rates?
• Will changing a file's name affect the file's MD5 or SHA1 hash value?
• What is the default extension for files moved to the Recycle Bin in systems prior to Windows Vista?
• To ascertain how many times a program was executed on a system, where would you typically look?
• What could prevent EnCase from detecting partition information during a hard drive acquisition using a Linux boot disk?
• What should an examiner do if sectors are found to be missing during an acquisition?
• Which statement is true regarding the disk structures used by Windows?
• How should you take down a desktop computer running Windows 7?
• Where does Windows store the time zone offset?
• What is the maximum number of drive letters assigned to hard drive partitions on a system?
• Which of the following is a characteristic of hexadecimal format?
• What methods can be used to write-protect USB flash memory during acquisition?
• Is it true that EnScripts can only be created and obtained from Guidance Software?
• True or False: The right-side menu contains a collection of the menus and tools found on the toolbar.
• How is the concept of external viewers in EnCase best described?
• What is a characteristic of filters in EnScript?
• What features do EE and FIM provide regarding live system data?
• What does DCO stand for?
• Which feature does the NTFS file system support?
• Which folder is NOT typically found within the automatically created folders of a new case in EnCase 7?
• Is the statement "The results of conditions and filters are seen immediately in the Table pane of the Evidence tab Entries view" true or false?
• How does EnCase ensure that the evidence file is an exact copy of the source device?
• In EnCase, what does it mean when a file is categorized as "Notable"?
• Which type of memory is typically faster, RAM or ROM?
• Which menu path do you follow to adjust how often a backup file (.cbak) is saved?
• In the context of media mounting, how does the PDE module differ from VFS?
• When the letter A is represented as 41h, it is displayed in which of the following?
• What does BIOS stand for?