Encase Exam Review UPDATED ACTUAL
Exam Questions and CORRECT Answers
The _____ is the folder where the case file is stored - CORRECT ANSWER base case
folder
Which of the following are not part of the forensic readiness structure - CORRECT
ANSWER examinations
Clicking the ______ symbol displays all items below that in the Table pane, regardless of type -
CORRECT ANSWER home plate
A physical search will look at data cluster by cluster, and if the file is not stored contiguously, it
may not find the match. - CORRECT ANSWER True
A _____ search will miss a keyword if it is fragmented between noncontiguous clusters -
CORRECT ANSWER physical
Link Files, Recycle Bin Files, MFT Transactions, and ShellBags parsing options are located
under which Module? - CORRECT ANSWER Windows Artifact Parser
When acquiring a smartphone, "Acquire from Device" opens the Import Wizard, which allows
you to import a backup file from a mobile device - CORRECT ANSWER False
Filters can be shared from outside of EnCase? - CORRECT ANSWER True
Which of the following is not an Investigation Phase - CORRECT ANSWER throwing
your hands up in the air and yelling "I Can't Do This"
.PST files are associated with what email system - CORRECT ANSWER Outlook
, If you try to open a case where one or more of the evidence file locations has changed you can
re-associate the evidence with the new location? - CORRECT ANSWER True
In the evidence gathering phase, data sources are acquired in a forensically sound manner and
working copies made (and their integrity verified) for further analysis and processing -
CORRECT ANSWER True
Which toolbar contains menus and buttons specific to the selected tab - CORRECT
ANSWER tab toolbar
Which of the following is not included in the case report template - CORRECT
ANSWER Reporting templates you can use as is or modify to suit your needs.
Which of the following is not a method to perform a case save - CORRECT
ANSWER using the keyboard shortcut of CTRL-E
Which of the following is not an EnCase Template - CORRECT ANSWER e-discovery
The "Index Slack and Unallocated" option is found under which processor option - CORRECT
ANSWER index text and metadata
The hash value is commonly represented as _____ written in hexadecimal notation - CORRECT
ANSWER binary data
The ______ will search unallocated space and file slack to see if there are fragments or entire
files that match our specifications to be found on the image - CORRECT ANSWER file
carver
This policy determines how an computers on the organization's network are allowed to be
utilized - CORRECT ANSWER AUP
Exam Questions and CORRECT Answers
The _____ is the folder where the case file is stored - CORRECT ANSWER base case
folder
Which of the following are not part of the forensic readiness structure - CORRECT
ANSWER examinations
Clicking the ______ symbol displays all items below that in the Table pane, regardless of type -
CORRECT ANSWER home plate
A physical search will look at data cluster by cluster, and if the file is not stored contiguously, it
may not find the match. - CORRECT ANSWER True
A _____ search will miss a keyword if it is fragmented between noncontiguous clusters -
CORRECT ANSWER physical
Link Files, Recycle Bin Files, MFT Transactions, and ShellBags parsing options are located
under which Module? - CORRECT ANSWER Windows Artifact Parser
When acquiring a smartphone, "Acquire from Device" opens the Import Wizard, which allows
you to import a backup file from a mobile device - CORRECT ANSWER False
Filters can be shared from outside of EnCase? - CORRECT ANSWER True
Which of the following is not an Investigation Phase - CORRECT ANSWER throwing
your hands up in the air and yelling "I Can't Do This"
.PST files are associated with what email system - CORRECT ANSWER Outlook
, If you try to open a case where one or more of the evidence file locations has changed you can
re-associate the evidence with the new location? - CORRECT ANSWER True
In the evidence gathering phase, data sources are acquired in a forensically sound manner and
working copies made (and their integrity verified) for further analysis and processing -
CORRECT ANSWER True
Which toolbar contains menus and buttons specific to the selected tab - CORRECT
ANSWER tab toolbar
Which of the following is not included in the case report template - CORRECT
ANSWER Reporting templates you can use as is or modify to suit your needs.
Which of the following is not a method to perform a case save - CORRECT
ANSWER using the keyboard shortcut of CTRL-E
Which of the following is not an EnCase Template - CORRECT ANSWER e-discovery
The "Index Slack and Unallocated" option is found under which processor option - CORRECT
ANSWER index text and metadata
The hash value is commonly represented as _____ written in hexadecimal notation - CORRECT
ANSWER binary data
The ______ will search unallocated space and file slack to see if there are fragments or entire
files that match our specifications to be found on the image - CORRECT ANSWER file
carver
This policy determines how an computers on the organization's network are allowed to be
utilized - CORRECT ANSWER AUP
