ENCE Study Guide UPDATED Actual
Exam Questions and CORRECT Answers
Encase Evidence File - CORRECT ANSWER- ✔✔bit stream image of evidence written to a
file
Encase Evidence File - CORRECT ANSWER- ✔✔contains case data that cannot be changed
after evidence file is created, contains case number, examiner name, evidence number, unique
descriptions, date/time of computer system clock, acquisition notes, serial number of physical
hard drive
Cyclical Redundancy Check - CORRECT ANSWER- ✔✔32 bit CRC for 64 sectors of data
only if no compression is used
CRC - CORRECT ANSWER- ✔✔calculated when evidence file is added to a case and
rechecked every time the data block is accessed
Verification Hash - CORRECT ANSWER- ✔✔digital signature of all data in evidence file
MD5 - CORRECT ANSWER- ✔✔128-bit/32 characters hash
SHA1 - CORRECT ANSWER- ✔✔160-bit hash
Standard Error Granularity - CORRECT ANSWER- ✔✔size of data blocks when a read error
on the media occurs
Exhaustive Error Granularity - CORRECT ANSWER- ✔✔sector by sector when a read error
on the media occurs
compression algorithm - CORRECT ANSWER- ✔✔when compression is used, this is used
to verify data blocks
, MD5,SHA1,CRC - CORRECT ANSWER- ✔✔These three must match for the evidence file
to be verified
.case - CORRECT ANSWER- ✔✔case file extension
case file - CORRECT ANSWER- ✔✔compound file containing booksmarks, investigators
notes, results of file signature and hash analysis, pointers to the locations of evidence files on
forensic workstations
configuration .ini files - CORRECT ANSWER- ✔✔contains global options used for all cases
filetypes.ini - CORRECT ANSWER- ✔✔organizes files into groups by entension, determines
which viewer to use, file signature table
local.ini - CORRECT ANSWER- ✔✔global configuration settings
viewers.ini - CORRECT ANSWER- ✔✔installed viewers associated to Encase
Wipe harddrive - CORRECT ANSWER- ✔✔do this to eliminate any claims or arguments of
cross contamination
give unique label - CORRECT ANSWER- ✔✔do this prior to acquisitons to differentiate
your drives from that of the suspect
separate folders - CORRECT ANSWER- ✔✔are recommended for each separate case
Export,Temp,EvidenceCache - CORRECT ANSWER- ✔✔each case requires these three
folders
evidencecache - CORRECT ANSWER- ✔✔sotring cache files and containers for processed
evidence
Exam Questions and CORRECT Answers
Encase Evidence File - CORRECT ANSWER- ✔✔bit stream image of evidence written to a
file
Encase Evidence File - CORRECT ANSWER- ✔✔contains case data that cannot be changed
after evidence file is created, contains case number, examiner name, evidence number, unique
descriptions, date/time of computer system clock, acquisition notes, serial number of physical
hard drive
Cyclical Redundancy Check - CORRECT ANSWER- ✔✔32 bit CRC for 64 sectors of data
only if no compression is used
CRC - CORRECT ANSWER- ✔✔calculated when evidence file is added to a case and
rechecked every time the data block is accessed
Verification Hash - CORRECT ANSWER- ✔✔digital signature of all data in evidence file
MD5 - CORRECT ANSWER- ✔✔128-bit/32 characters hash
SHA1 - CORRECT ANSWER- ✔✔160-bit hash
Standard Error Granularity - CORRECT ANSWER- ✔✔size of data blocks when a read error
on the media occurs
Exhaustive Error Granularity - CORRECT ANSWER- ✔✔sector by sector when a read error
on the media occurs
compression algorithm - CORRECT ANSWER- ✔✔when compression is used, this is used
to verify data blocks
, MD5,SHA1,CRC - CORRECT ANSWER- ✔✔These three must match for the evidence file
to be verified
.case - CORRECT ANSWER- ✔✔case file extension
case file - CORRECT ANSWER- ✔✔compound file containing booksmarks, investigators
notes, results of file signature and hash analysis, pointers to the locations of evidence files on
forensic workstations
configuration .ini files - CORRECT ANSWER- ✔✔contains global options used for all cases
filetypes.ini - CORRECT ANSWER- ✔✔organizes files into groups by entension, determines
which viewer to use, file signature table
local.ini - CORRECT ANSWER- ✔✔global configuration settings
viewers.ini - CORRECT ANSWER- ✔✔installed viewers associated to Encase
Wipe harddrive - CORRECT ANSWER- ✔✔do this to eliminate any claims or arguments of
cross contamination
give unique label - CORRECT ANSWER- ✔✔do this prior to acquisitons to differentiate
your drives from that of the suspect
separate folders - CORRECT ANSWER- ✔✔are recommended for each separate case
Export,Temp,EvidenceCache - CORRECT ANSWER- ✔✔each case requires these three
folders
evidencecache - CORRECT ANSWER- ✔✔sotring cache files and containers for processed
evidence
