THE OFFICIAL ENCE :ENCASE CERTIFIED EXAMINER
STUDY GUIDE SECOND EDITION CHAPTER 5 REVIEW
QUESTIONS
There is a setup program contained within the BIOS that accesses data stored in CMOS
(RTC/NVRAM). Among other data, two particular settings are of special interest to the
computer forensics examiner. Which ones are they? A. RAM size and hard drive
capacity B. System date/time and boot order (sequence) C.System date/time and hard
drive capacity D. IDE settings and boot order (sequence) - Answer -B. System
date/time and boot order (sequence)
Which of the following are true of a motherboard? (Choose all that apply.) A.t is the
main circuit board that has sockets or slots for the CPU, RAM, and add-in cards. B. It is
a term used to describe any circuit board housed within the computer case. C. It may
have onboard video, SATA controllers, and audio. D. It receives power from a separate
power supply. - Answer -A C D
What does the acronym RAM stand for? A .Random , Addressable Memory B. Random
Access Memory . C. Relative Addressable Memory D. None of the above - Answer -B.
Random Access Memory
What does a computer use RAM for? A. Permanent memory storage that persists after
the computer is powered down B .temporary storage of data that persists only when the
computer is powered on C. Permanent storage of system time and other settings
requiring storage after the system is powered down D. None of the above - Answer -B
.temporary storage of data that persists only when the computer is powered on
Of the steps or processes listed here, which occurs first when a PC computer system is
first powered on? A. The first device in the boot sequence is booted. B. The available
drives are searched for an operating system. C.POST occurs. D. None of the above. -
Answer -C . POST occurs.
In a FAT file system, what does the file allocation table track? (Choose all that apply.) A.
Logical size of the file B. Cluster size C. File fragmentation D. Cluster usage of all
addressable clusters in the partition - Answer -C D
What field name or attribute of a FAT directory entry describes the location where a file
begins on a logical volume? A. The Cluster or Data Run field B. The Begin File At
Sector field C. The Starting Cluster field D. The Starting Sector field - Answer -C . The
Starting Cluster field
, By default, how many file allocation table entries are located on a FAT16 or FAT32 file
system that has been formatted with Windows? A. 1 B.2 C. 3 D. 4 - Answer -B. 2
In the file allocation table, if cluster number 36,345 contained a value of 36,346, what
would this mean? A. The file ends in cluster 36,346. B. The file ends in cluster 36,345
C. The file is fragmented, and the next segment of the file is located in cluster 36,346.
D. The next segment of the file is located in cluster 36,346. E. None of the above -
Answer -D. The next segment of the file is located in cluster 36,346.
In the file allocation table, if a cluster entry contained a value of 0, what would this
mean? A. The cluster is allocated to a file. B. The cluster is being marked as bad or null
and can't be used for data. C. The cluster is unallocated and can be used to hold data.
D. None of the above - Answer -C. The cluster is unallocated and can be used to hold
data.
A partition is formatted so that it contains 16 sectors per cluster. A file named myfile.txt
has a logical size of 26,000 bytes. How many clusters will be used by this file? A.1 B. 2
C. 3 D . 4 - Answer -D. 4
A physical file is described as what? (Choose all that apply.) A. The logical file plus all
slack space measured in bytes B. The total size of all the clusters used by the file
measured in bytes C. The data from the beginning of the starting cluster out to the
length of the file, excluding all slack space D. None of the above - Answer -A B
In the file allocation table, the entry for cluster 125 contains the value 250. What does
this mean? A. The two files that start in clusters 125 and 250, respectively, are cross-
linked. B. Cluster 125 is marked as bad. C. Cluster 125 is allocated to a file, and that
file's data continues in cluster number 250. D. Cluster 125 is the end of an allocated file.
- Answer -C. Cluster 125 is allocated to a file, and that file's data continues in cluster
number 250.
In a FAT file system, what happens when a file is deleted? (Choose all that apply.) A.
The first character of the directory entry is changed to hex E5. B. In the file allocation
table, all clusters entries that were allocated to the file are changed to 0, making them
unallocated and available for use by the operating system. C. The operating system
immediately overwrites the data in the clusters where the data resided. D. All of the
above - Answer -A B
When EnCase undeletes a file in a FAT file system, it must obtain the starting extent or
starting cluster for the file. Where is the information found? - Answer -
When EnCase undeletes a file in a FAT file system, it must obtain the starting extent or
starting cluster for the file. Where is the information found? A. FAT1 B.FAT2 C. Within
the 32-byte FAT directory entry . D. In the backup FAT hidden in the volume slack
space - Answer -C. Within the 32-byte FAT directory entry
STUDY GUIDE SECOND EDITION CHAPTER 5 REVIEW
QUESTIONS
There is a setup program contained within the BIOS that accesses data stored in CMOS
(RTC/NVRAM). Among other data, two particular settings are of special interest to the
computer forensics examiner. Which ones are they? A. RAM size and hard drive
capacity B. System date/time and boot order (sequence) C.System date/time and hard
drive capacity D. IDE settings and boot order (sequence) - Answer -B. System
date/time and boot order (sequence)
Which of the following are true of a motherboard? (Choose all that apply.) A.t is the
main circuit board that has sockets or slots for the CPU, RAM, and add-in cards. B. It is
a term used to describe any circuit board housed within the computer case. C. It may
have onboard video, SATA controllers, and audio. D. It receives power from a separate
power supply. - Answer -A C D
What does the acronym RAM stand for? A .Random , Addressable Memory B. Random
Access Memory . C. Relative Addressable Memory D. None of the above - Answer -B.
Random Access Memory
What does a computer use RAM for? A. Permanent memory storage that persists after
the computer is powered down B .temporary storage of data that persists only when the
computer is powered on C. Permanent storage of system time and other settings
requiring storage after the system is powered down D. None of the above - Answer -B
.temporary storage of data that persists only when the computer is powered on
Of the steps or processes listed here, which occurs first when a PC computer system is
first powered on? A. The first device in the boot sequence is booted. B. The available
drives are searched for an operating system. C.POST occurs. D. None of the above. -
Answer -C . POST occurs.
In a FAT file system, what does the file allocation table track? (Choose all that apply.) A.
Logical size of the file B. Cluster size C. File fragmentation D. Cluster usage of all
addressable clusters in the partition - Answer -C D
What field name or attribute of a FAT directory entry describes the location where a file
begins on a logical volume? A. The Cluster or Data Run field B. The Begin File At
Sector field C. The Starting Cluster field D. The Starting Sector field - Answer -C . The
Starting Cluster field
, By default, how many file allocation table entries are located on a FAT16 or FAT32 file
system that has been formatted with Windows? A. 1 B.2 C. 3 D. 4 - Answer -B. 2
In the file allocation table, if cluster number 36,345 contained a value of 36,346, what
would this mean? A. The file ends in cluster 36,346. B. The file ends in cluster 36,345
C. The file is fragmented, and the next segment of the file is located in cluster 36,346.
D. The next segment of the file is located in cluster 36,346. E. None of the above -
Answer -D. The next segment of the file is located in cluster 36,346.
In the file allocation table, if a cluster entry contained a value of 0, what would this
mean? A. The cluster is allocated to a file. B. The cluster is being marked as bad or null
and can't be used for data. C. The cluster is unallocated and can be used to hold data.
D. None of the above - Answer -C. The cluster is unallocated and can be used to hold
data.
A partition is formatted so that it contains 16 sectors per cluster. A file named myfile.txt
has a logical size of 26,000 bytes. How many clusters will be used by this file? A.1 B. 2
C. 3 D . 4 - Answer -D. 4
A physical file is described as what? (Choose all that apply.) A. The logical file plus all
slack space measured in bytes B. The total size of all the clusters used by the file
measured in bytes C. The data from the beginning of the starting cluster out to the
length of the file, excluding all slack space D. None of the above - Answer -A B
In the file allocation table, the entry for cluster 125 contains the value 250. What does
this mean? A. The two files that start in clusters 125 and 250, respectively, are cross-
linked. B. Cluster 125 is marked as bad. C. Cluster 125 is allocated to a file, and that
file's data continues in cluster number 250. D. Cluster 125 is the end of an allocated file.
- Answer -C. Cluster 125 is allocated to a file, and that file's data continues in cluster
number 250.
In a FAT file system, what happens when a file is deleted? (Choose all that apply.) A.
The first character of the directory entry is changed to hex E5. B. In the file allocation
table, all clusters entries that were allocated to the file are changed to 0, making them
unallocated and available for use by the operating system. C. The operating system
immediately overwrites the data in the clusters where the data resided. D. All of the
above - Answer -A B
When EnCase undeletes a file in a FAT file system, it must obtain the starting extent or
starting cluster for the file. Where is the information found? - Answer -
When EnCase undeletes a file in a FAT file system, it must obtain the starting extent or
starting cluster for the file. Where is the information found? A. FAT1 B.FAT2 C. Within
the 32-byte FAT directory entry . D. In the backup FAT hidden in the volume slack
space - Answer -C. Within the 32-byte FAT directory entry
