ENCE QUESTIONS AND ANSWERS
Computers use a numbering system with only two digits, 0 and 1. This system is
referred to as which of the following?
A. Hexadecimal
B. ASCII
C. Binary
D. FAT - Answer -C. Binary is a numbering system consisting of 0 and 1 used by
computers to process information.
A bit can have a binary value of which of the following?
A. 0 or 1
B. 0-9
C. 0-9 and A-F
D. On or Off - Answer -A. Bi refers to two; therefore, a bit can have only two values, 0
or 1.
Which of the following are untrue with regard to the EnCase Evidence Processor?
A. A device must be acquired first before processing or be acquired as a requisite first
step within the EnCase Evidence Processor.
B. A live device can be subjected to normal processing by the EnCase Evidence
Processor and does not have to be acquired first.
C. Items marked with red flags denote items that are not applicable to the file system
being processed.
D. Items marked with red flags denote items that must be run during the first or initial
run of the EnCase Evidence Processor and can't be run in any subsequent run
thereafter.
E. A raw keyword search can be conducted during processing by the EnCase Evidence
Processor. - Answer -C. A device must be an image or be acquired first by the EnCase
Evidence Processor. Live devices can be subjected to direct processing by the EnCase
Evidence Processor. Red flags denote items that must be run during the first run of the
processor. If you don't run them then, you can't run them later. It's now or never, so to
speak.
When performing a keyword search in Windows, EnCase searches which of the
following?
A. The logical files
B. The physical disk in unallocated clusters and other unused disk areas
C. Both A and B
D. None of the above - Answer -C. EnCase performs a search not only of logical files
but of the entire disk to include unallocated clusters and unused disk areas outside the
logical partition.
By default, search terms are case sensitive.
Computers use a numbering system with only two digits, 0 and 1. This system is
referred to as which of the following?
A. Hexadecimal
B. ASCII
C. Binary
D. FAT - Answer -C. Binary is a numbering system consisting of 0 and 1 used by
computers to process information.
A bit can have a binary value of which of the following?
A. 0 or 1
B. 0-9
C. 0-9 and A-F
D. On or Off - Answer -A. Bi refers to two; therefore, a bit can have only two values, 0
or 1.
Which of the following are untrue with regard to the EnCase Evidence Processor?
A. A device must be acquired first before processing or be acquired as a requisite first
step within the EnCase Evidence Processor.
B. A live device can be subjected to normal processing by the EnCase Evidence
Processor and does not have to be acquired first.
C. Items marked with red flags denote items that are not applicable to the file system
being processed.
D. Items marked with red flags denote items that must be run during the first or initial
run of the EnCase Evidence Processor and can't be run in any subsequent run
thereafter.
E. A raw keyword search can be conducted during processing by the EnCase Evidence
Processor. - Answer -C. A device must be an image or be acquired first by the EnCase
Evidence Processor. Live devices can be subjected to direct processing by the EnCase
Evidence Processor. Red flags denote items that must be run during the first run of the
processor. If you don't run them then, you can't run them later. It's now or never, so to
speak.
When performing a keyword search in Windows, EnCase searches which of the
following?
A. The logical files
B. The physical disk in unallocated clusters and other unused disk areas
C. Both A and B
D. None of the above - Answer -C. EnCase performs a search not only of logical files
but of the entire disk to include unallocated clusters and unused disk areas outside the
logical partition.
By default, search terms are case sensitive.
