The Official EnCE:Encase Certified
Examiner Study Guide Second Edition
Chapter 8 Review UPDATED ACTUAL
Exam Questions and CORRECT Answers
When running a signature analysis, EnCase will do which of the following? - CORRECT
ANSWER A signature analysis will compare a file's header or signature to its file
extension.
A file header is which of the following? - CORRECT ANSWER A file header identifies
the type of file and is located in the beginning of the file's data.
The Windows operating system uses a file name's ___ to associate files with the proper
applications. - CORRECT ANSWER The Windows operating system uses a file's
extension to associate the file with the proper application.
Unix (including Linux) operating systems use a file's ___ to associate file types to specific
applications. - CORRECT ANSWER Unix (including Linux) operating systems use a file's
header information to associate file types to specific applications.
The Mac OS X operating systems uses which of the following file information to associate a file
to a specific application? - CORRECT ANSWER When determining which application to
use to open a file, Mac OS X gives first precedence to user defined settings, second preference to
creator code metadata, and third precedence to file name extensions. If none of these are present,
other rules come into play.
Information regarding a file's header information and extension is saved by EnCase in the ___
file. - CORRECT ANSWER Information about a file's header and extension is saved in the
FileSignature.ini file.
When a file's signature is unknown and a valid file extension exists, EnCase will display the
following result after a signature analysis is performed: - CORRECT ANSWER When a
Examiner Study Guide Second Edition
Chapter 8 Review UPDATED ACTUAL
Exam Questions and CORRECT Answers
When running a signature analysis, EnCase will do which of the following? - CORRECT
ANSWER A signature analysis will compare a file's header or signature to its file
extension.
A file header is which of the following? - CORRECT ANSWER A file header identifies
the type of file and is located in the beginning of the file's data.
The Windows operating system uses a file name's ___ to associate files with the proper
applications. - CORRECT ANSWER The Windows operating system uses a file's
extension to associate the file with the proper application.
Unix (including Linux) operating systems use a file's ___ to associate file types to specific
applications. - CORRECT ANSWER Unix (including Linux) operating systems use a file's
header information to associate file types to specific applications.
The Mac OS X operating systems uses which of the following file information to associate a file
to a specific application? - CORRECT ANSWER When determining which application to
use to open a file, Mac OS X gives first precedence to user defined settings, second preference to
creator code metadata, and third precedence to file name extensions. If none of these are present,
other rules come into play.
Information regarding a file's header information and extension is saved by EnCase in the ___
file. - CORRECT ANSWER Information about a file's header and extension is saved in the
FileSignature.ini file.
When a file's signature is unknown and a valid file extension exists, EnCase will display the
following result after a signature analysis is performed: - CORRECT ANSWER When a
