Encase chapter 8 UPDATED ACTUAL Exam Questions and CORRECT Answers

Encase chapter 8 UPDATED ACTUAL
Exam Questions and CORRECT Answers
When running a signature analysis, Encase will do which of the following - CORRECT
ANSWER D. Compare a file's header to its file extension



A file header is which of the following? - CORRECT ANSWER A. A unique set of
characters at the beginning of a file that identifies the file type


The Windows operating system uses a filename's ___ to associate files with the proper
application - CORRECT ANSWER C. Extension


Unix operating system use a file's ______ to associate file types to specific applications -
CORRECT ANSWER B. Header


The Mac OS X operating system uses which of the following information to associate a file to a
specific application - CORRECT ANSWER D. Metadata (creator code)


Information regarding a file's header information and extension is saved by EnCase in the
_________ file - CORRECT ANSWER A. FileTypes.ini


When a file's signature is unknown and a valid file extension exists, EnCase will display the
following result after a signature analysis is performed - CORRECT ANSWER B. Bad
Signature


When a file's signature is known and the file extension does not match, Encase will display the
following result after a signature analysis is performed - CORRECT ANSWER A. Alias
(Signature match)


When a file's signature is known and the file extension matches, Encase will display the
following result after a signature analysis is performed - CORRECT ANSWER D. Match