encase 8 study guide UPDATED ACTUAL
Exam Questions and CORRECT Answers
What is the encase evidence file - CORRECT ANSWER Bit Stream Image of evidence
written to a file
what are examples of computer based evidence in encase - CORRECT ANSWER encase
evidence file, encase concepts, encase environment, encase evidence processor, index query and
raw keyword searching, file signature and hash analysis
what encase case data can not be changed - CORRECT ANSWER case number, examiner
name, evidence number, unique description, date/time of computer clock, acquisition notes,
serial number of hard drive.
CRC (Cyclic Redundancy Check) - CORRECT ANSWER An error detection method that
can be applied to blocks of data
How does EnCase verify the contents of an evidence file, using the default segments -
CORRECT ANSWER encase writes a 32 bit CRC value for every 64 sectors copied.
when is a CRC calculated - CORRECT ANSWER When an evidence file is added to a
case and rechecked every time the data block is accessed
verification hash - CORRECT ANSWER digital signature of all data in evidence file
MD5 Hash - CORRECT ANSWER hash algorithm produces a 128 bit/32 value
SHA1 - CORRECT ANSWER 160 bits value
, characteristics of encase evidence file - CORRECT ANSWER logical file that can be
renamed and moved
can be broken into multiple segments, can be compressed during acquisition/reacquired for
archive without changing the hash value
can be password protected/encryption - can remove/change password/encryption
can be verified by CRC when compression is NOT used, if compression used - uses
decompression algorithm
Error granularity is often used to - CORRECT ANSWER adjust the writing of data to an
evidence file when a read error of the subject media occurs
error granularity - standard - CORRECT ANSWER size of the data blocks
error granularity - exhaustive - CORRECT ANSWER sector by sector
data in the entire evidence file is verified by - CORRECT ANSWER verification hash
compared to the acquisition hash value of the original evidence
data in each block is verified by - CORRECT ANSWER CRC when NO compression is
used
decompression algorithm when compression is used
T or F: both the MD5 and/or SHA-01 hash and CRC must match for the evidence file to be
verified - CORRECT ANSWER TRUE
what is the encase case file extension - CORRECT ANSWER .case
what does the encase CASE file contain - CORRECT ANSWER -pointers to locations of
evidence files on forensic workstation
- results of file signature and hash analysis
Exam Questions and CORRECT Answers
What is the encase evidence file - CORRECT ANSWER Bit Stream Image of evidence
written to a file
what are examples of computer based evidence in encase - CORRECT ANSWER encase
evidence file, encase concepts, encase environment, encase evidence processor, index query and
raw keyword searching, file signature and hash analysis
what encase case data can not be changed - CORRECT ANSWER case number, examiner
name, evidence number, unique description, date/time of computer clock, acquisition notes,
serial number of hard drive.
CRC (Cyclic Redundancy Check) - CORRECT ANSWER An error detection method that
can be applied to blocks of data
How does EnCase verify the contents of an evidence file, using the default segments -
CORRECT ANSWER encase writes a 32 bit CRC value for every 64 sectors copied.
when is a CRC calculated - CORRECT ANSWER When an evidence file is added to a
case and rechecked every time the data block is accessed
verification hash - CORRECT ANSWER digital signature of all data in evidence file
MD5 Hash - CORRECT ANSWER hash algorithm produces a 128 bit/32 value
SHA1 - CORRECT ANSWER 160 bits value
, characteristics of encase evidence file - CORRECT ANSWER logical file that can be
renamed and moved
can be broken into multiple segments, can be compressed during acquisition/reacquired for
archive without changing the hash value
can be password protected/encryption - can remove/change password/encryption
can be verified by CRC when compression is NOT used, if compression used - uses
decompression algorithm
Error granularity is often used to - CORRECT ANSWER adjust the writing of data to an
evidence file when a read error of the subject media occurs
error granularity - standard - CORRECT ANSWER size of the data blocks
error granularity - exhaustive - CORRECT ANSWER sector by sector
data in the entire evidence file is verified by - CORRECT ANSWER verification hash
compared to the acquisition hash value of the original evidence
data in each block is verified by - CORRECT ANSWER CRC when NO compression is
used
decompression algorithm when compression is used
T or F: both the MD5 and/or SHA-01 hash and CRC must match for the evidence file to be
verified - CORRECT ANSWER TRUE
what is the encase case file extension - CORRECT ANSWER .case
what does the encase CASE file contain - CORRECT ANSWER -pointers to locations of
evidence files on forensic workstation
- results of file signature and hash analysis
