ENCASE EXAM QUESTIONS & ANSWERS
Searches using keywords are stored in files with the file extension . - Answer -
.keywords
When a noncompressed evidence file is reacquired in a compressed mode, the
acquisition MD5 hash value remains the same. True or false? - Answer -True
If you attempt to change the case information within an EnCase evidence file, the
verification feature will report an error. True or false? - Answer -True
If you add a partition to an EnCase evidence file, the added partition is stored in the
metadata portion of the EnCase evidence file. True or false? - Answer -False
The examiner can change the logical name of the EnCase evidence file, but the file will
no longer successfully verify. True or false? - Answer -False
The examiner can move the evidence file to another directory, and the file will still
successfully verify. True or false? - Answer -True
and are two algorithms available within EnCase to verify the integrity of an entire
evidence file. - Answer -MD5, SHA1
The file contains the external viewers installed within EnCase 7. - Answer -Viewers.ini
Text styles in EnCase 7 are stored in two locations, one location for text styles that ship
with EnCase and another for user-created text styles. True or false? - Answer -True
An EnCase case file can contain how many evidence or image files? - Answer -Any
EnCase case files should be archived after the examination is completed, using the
Create Package feature. True or false? - Answer -True
Searches using keywords are stored in files with the file extension . - Answer -
.keywords
The files contain pointers to the evidence files. - Answer -case
Search results are sent to the view. - Answer -Results
Bookmarks are stored in the file. - Answer -Case
Using standard EnCase methodology or best practices, you should create a unique
directory on the lab or storage drive for case management before you acquire evidence.
True or false? - Answer -True
, Using standard EnCase methodology or best practices, you should give the volume a
unique label or name prior to using it as a target drive on which to store an EnCase
evidence files. True or false? - Answer -True
The default export folder, created by EnCase 7, is global and is the same for all cases.
True or false? - Answer -False
The Temp folder is used to temporarily store files sent from EnCase to the Windows
environment. True or false? - Answer -True
By default, search terms or keywords are case sensitive. True or false? - Answer -
False
By default, GREP terms are automatically recognized as GREP operators by EnCase.
True or false? - Answer -False
If Unicode is selected for a search keyword, EnCase will find the keyword only when it
appears in Unicode. True or false? - Answer -False
A hash set is a collection of hash values for a group of files. True or false? - Answer -
True
A hash library is a collection of hash sets selected by the examiner for inclusion in the
hash library. True or false? - Answer -True
Changing a file's name or extension does not change the file's MD5 or SHA1 hash
value. True or false? - Answer -True
When discussing file signature analysis in the EnCase environment, the file signature
and file header are synonymous and can be used interchangeably. True or false? -
Answer -True
To analyze the results of a file signature analysis, the examiner should sort on the
Signature Analysis column in the Table view of the Table pane. True or false? - Answer
-True
The acronym ASCII stands for American Standard Code for Information Interchange.
True or false? - Answer -True
In hexadecimal notation, one byte is represented by one character. True or false? -
Answer -False
In ASCII, one printed character is composed of one byte of data. True or false? -
Answer -True
Searches using keywords are stored in files with the file extension . - Answer -
.keywords
When a noncompressed evidence file is reacquired in a compressed mode, the
acquisition MD5 hash value remains the same. True or false? - Answer -True
If you attempt to change the case information within an EnCase evidence file, the
verification feature will report an error. True or false? - Answer -True
If you add a partition to an EnCase evidence file, the added partition is stored in the
metadata portion of the EnCase evidence file. True or false? - Answer -False
The examiner can change the logical name of the EnCase evidence file, but the file will
no longer successfully verify. True or false? - Answer -False
The examiner can move the evidence file to another directory, and the file will still
successfully verify. True or false? - Answer -True
and are two algorithms available within EnCase to verify the integrity of an entire
evidence file. - Answer -MD5, SHA1
The file contains the external viewers installed within EnCase 7. - Answer -Viewers.ini
Text styles in EnCase 7 are stored in two locations, one location for text styles that ship
with EnCase and another for user-created text styles. True or false? - Answer -True
An EnCase case file can contain how many evidence or image files? - Answer -Any
EnCase case files should be archived after the examination is completed, using the
Create Package feature. True or false? - Answer -True
Searches using keywords are stored in files with the file extension . - Answer -
.keywords
The files contain pointers to the evidence files. - Answer -case
Search results are sent to the view. - Answer -Results
Bookmarks are stored in the file. - Answer -Case
Using standard EnCase methodology or best practices, you should create a unique
directory on the lab or storage drive for case management before you acquire evidence.
True or false? - Answer -True
, Using standard EnCase methodology or best practices, you should give the volume a
unique label or name prior to using it as a target drive on which to store an EnCase
evidence files. True or false? - Answer -True
The default export folder, created by EnCase 7, is global and is the same for all cases.
True or false? - Answer -False
The Temp folder is used to temporarily store files sent from EnCase to the Windows
environment. True or false? - Answer -True
By default, search terms or keywords are case sensitive. True or false? - Answer -
False
By default, GREP terms are automatically recognized as GREP operators by EnCase.
True or false? - Answer -False
If Unicode is selected for a search keyword, EnCase will find the keyword only when it
appears in Unicode. True or false? - Answer -False
A hash set is a collection of hash values for a group of files. True or false? - Answer -
True
A hash library is a collection of hash sets selected by the examiner for inclusion in the
hash library. True or false? - Answer -True
Changing a file's name or extension does not change the file's MD5 or SHA1 hash
value. True or false? - Answer -True
When discussing file signature analysis in the EnCase environment, the file signature
and file header are synonymous and can be used interchangeably. True or false? -
Answer -True
To analyze the results of a file signature analysis, the examiner should sort on the
Signature Analysis column in the Table view of the Table pane. True or false? - Answer
-True
The acronym ASCII stands for American Standard Code for Information Interchange.
True or false? - Answer -True
In hexadecimal notation, one byte is represented by one character. True or false? -
Answer -False
In ASCII, one printed character is composed of one byte of data. True or false? -
Answer -True
