Encase Chapter 10 Review UPDATED
ACTUAL Exam Questions and CORRECT
Answers
How many sector(s) on a hard drive are reserved for the master boot record (MBR)? -
CORRECT ANSWER 63
The very first sector of a formatted hard drive that contains an operating system is referred to as
which of the following? - CORRECT ANSWER All of the above
How many logical partitions does the partition table in the master boot record allow for a
physical drive? - CORRECT ANSWER 4.
The very first sector of a partition is referred to as which of the following? - CORRECT
ANSWER Volume boot record
If a hard drive has been fdisked, EnCase can still recover the deleted partition(s), if you point to
the ___, right click, and select Add Partition. - CORRECT ANSWER Volume boot record
In an NTFS partition, where is the backup copy of the volume boot record (VBR) stored? -
CORRECT ANSWER The last sector of the partition.
EnCase can mount a compound file, which can then be viewed in a hierarchical format. Select an
example of a compound file. - CORRECT ANSWER All of the above
Windows 7 contains two master keys in its registry. They are HKEY_LOCAL_MACHINE and
which of the following? - CORRECT ANSWER HKEY_USERS
In Windows 7, information about a specific user's preference is stored in the NTUSER.DAT
file. This compound file can be found where? - CORRECT ANSWER C:\Users\username
ACTUAL Exam Questions and CORRECT
Answers
How many sector(s) on a hard drive are reserved for the master boot record (MBR)? -
CORRECT ANSWER 63
The very first sector of a formatted hard drive that contains an operating system is referred to as
which of the following? - CORRECT ANSWER All of the above
How many logical partitions does the partition table in the master boot record allow for a
physical drive? - CORRECT ANSWER 4.
The very first sector of a partition is referred to as which of the following? - CORRECT
ANSWER Volume boot record
If a hard drive has been fdisked, EnCase can still recover the deleted partition(s), if you point to
the ___, right click, and select Add Partition. - CORRECT ANSWER Volume boot record
In an NTFS partition, where is the backup copy of the volume boot record (VBR) stored? -
CORRECT ANSWER The last sector of the partition.
EnCase can mount a compound file, which can then be viewed in a hierarchical format. Select an
example of a compound file. - CORRECT ANSWER All of the above
Windows 7 contains two master keys in its registry. They are HKEY_LOCAL_MACHINE and
which of the following? - CORRECT ANSWER HKEY_USERS
In Windows 7, information about a specific user's preference is stored in the NTUSER.DAT
file. This compound file can be found where? - CORRECT ANSWER C:\Users\username
