ENCE EXAM QUESTIONS WITH 100%
VERIFIED ANSWERS
117 QUESTIONS AND ANSWERS
Data in each data block is verified by a CRC when no compression is used. True
or false? - ANSWER True
A case file can contain any number of hard drives or removable media. True or
False? - ANSWER True
What does a plus sign after a character do, GREP. - ANSWER A plus sign after
a character matches any number of occurrences of that character except zero.
For example "john,+smith" would match "john,smith" or "john,,smith," but
would NOT match "johnsmith."
What does a # sign after a character do, GREP. - ANSWER A pound / hash
sign matches any numeric character [0-9]. For example ###-#### matches any
phone number in the form 327-4323.
Grep parentheses: (ab) - ANSWER The parentheses allow the examiner to
group individual characters together as an AND statement.
Grep curly brackets: {m,n} - ANSWER The curly braces state number of times
to repeat, i.e., m to n times
Grep pipe: | - ANSWER The pipe is an OR statement and can be used with the
parentheses, i.e., (com)|(net)|(org) for the end of an email address.
Grep brackets: [ ] - ANSWER Characters in brackets match any one character
that appears in the brackets. For example "smit[hy]" would match "smith" and
"smity."
, Grep up carrot: [^] - ANSWER A circumflex at the start of the string in
brackets means NOT. Hence [^hy] matches any characters except h and y.
Grep dash: [-] - ANSWER A dash within the brackets signifies a range of
characters. For example, [a-e] matches any character from a through e,
inclusive.
Grep backslash : [\] - ANSWER A backslash before a character indicates that
the character is to be treated literally and not as a GREP character.
Where are file signatures stored in encase - ANSWER Stored in the EnCase
configuration file FileTypes.ini
How many hash libraries can you have in a case? - ANSWER You can have
two Hash Libraries for each case
How is a hash value computed? - ANSWER The hash value of a file is
computed only from the logical file independent of the file name, time/date
stamps, and the slack space of the physical file
Nibble - ANSWER 4 bit: binary 0000
Byte - ANSWER 8 Bit: binary 0000 0000
Word - ANSWER 16 bits: 0000 0000 0000 0000
What is the ASCII table built on - ANSWER 7-bit system
What does ASCII stand for? - ANSWER American Standard Code for
Information Interchange
How many bytes does unicode use for each character? - ANSWER Unicode
uses two bytes for each character, allowing the representation of 65,536
characters
Encase search hit colors - ANSWER Foreground: Black with white letters
Background: Yellow with black letters
VERIFIED ANSWERS
117 QUESTIONS AND ANSWERS
Data in each data block is verified by a CRC when no compression is used. True
or false? - ANSWER True
A case file can contain any number of hard drives or removable media. True or
False? - ANSWER True
What does a plus sign after a character do, GREP. - ANSWER A plus sign after
a character matches any number of occurrences of that character except zero.
For example "john,+smith" would match "john,smith" or "john,,smith," but
would NOT match "johnsmith."
What does a # sign after a character do, GREP. - ANSWER A pound / hash
sign matches any numeric character [0-9]. For example ###-#### matches any
phone number in the form 327-4323.
Grep parentheses: (ab) - ANSWER The parentheses allow the examiner to
group individual characters together as an AND statement.
Grep curly brackets: {m,n} - ANSWER The curly braces state number of times
to repeat, i.e., m to n times
Grep pipe: | - ANSWER The pipe is an OR statement and can be used with the
parentheses, i.e., (com)|(net)|(org) for the end of an email address.
Grep brackets: [ ] - ANSWER Characters in brackets match any one character
that appears in the brackets. For example "smit[hy]" would match "smith" and
"smity."
, Grep up carrot: [^] - ANSWER A circumflex at the start of the string in
brackets means NOT. Hence [^hy] matches any characters except h and y.
Grep dash: [-] - ANSWER A dash within the brackets signifies a range of
characters. For example, [a-e] matches any character from a through e,
inclusive.
Grep backslash : [\] - ANSWER A backslash before a character indicates that
the character is to be treated literally and not as a GREP character.
Where are file signatures stored in encase - ANSWER Stored in the EnCase
configuration file FileTypes.ini
How many hash libraries can you have in a case? - ANSWER You can have
two Hash Libraries for each case
How is a hash value computed? - ANSWER The hash value of a file is
computed only from the logical file independent of the file name, time/date
stamps, and the slack space of the physical file
Nibble - ANSWER 4 bit: binary 0000
Byte - ANSWER 8 Bit: binary 0000 0000
Word - ANSWER 16 bits: 0000 0000 0000 0000
What is the ASCII table built on - ANSWER 7-bit system
What does ASCII stand for? - ANSWER American Standard Code for
Information Interchange
How many bytes does unicode use for each character? - ANSWER Unicode
uses two bytes for each character, allowing the representation of 65,536
characters
Encase search hit colors - ANSWER Foreground: Black with white letters
Background: Yellow with black letters
