ENCE QUESTIONS AND ANSWERS
How many sector(s) on a hard drive are reserved for the master boot record (MBR)?
A. 1
B. 4
C. 16
D. 62
E. 63
E. 63
How would a user reverse-sort on a column in the Table view?
A. Hold down the Ctrl key, and double-click the selected column header.
B. Right-click the selected column, select Sort, and select either Sort Ascending
or Sort Descending.
C. Both A and B.
C. Both A and B.
When an EnCase user double-clicks on a file within EnCase what determines the action
that will result?
A. The settings in the case file.
B. The settings in the FileTypes.ini file.
C. The setting in the evidence file.
B. The settings in the FileTypes.ini file.
, Search results are found in which of the following files?
Select all that apply.
A. The evidence file
B. The configuration Searches.ini file
C. The case file
C. The case file
If cluster #3552 entry in the FAT table contains a value of ?? this would mean:
A. The cluster is unallocated
B. The cluster is the end of a file
C. The cluster is allocated
D. The cluster is marked bad
C. The cluster is allocated
The extension is in the File Signature table, but the header is incorrect and the header
is not in the File Signatures table. What is this?
A. Alias
B. Unknown
C. Match
D. Bad Signature
D. Bad Signature
What happens when EnCase attempts to reopen a case once the evidence file has
been moved?
How many sector(s) on a hard drive are reserved for the master boot record (MBR)?
A. 1
B. 4
C. 16
D. 62
E. 63
E. 63
How would a user reverse-sort on a column in the Table view?
A. Hold down the Ctrl key, and double-click the selected column header.
B. Right-click the selected column, select Sort, and select either Sort Ascending
or Sort Descending.
C. Both A and B.
C. Both A and B.
When an EnCase user double-clicks on a file within EnCase what determines the action
that will result?
A. The settings in the case file.
B. The settings in the FileTypes.ini file.
C. The setting in the evidence file.
B. The settings in the FileTypes.ini file.
, Search results are found in which of the following files?
Select all that apply.
A. The evidence file
B. The configuration Searches.ini file
C. The case file
C. The case file
If cluster #3552 entry in the FAT table contains a value of ?? this would mean:
A. The cluster is unallocated
B. The cluster is the end of a file
C. The cluster is allocated
D. The cluster is marked bad
C. The cluster is allocated
The extension is in the File Signature table, but the header is incorrect and the header
is not in the File Signatures table. What is this?
A. Alias
B. Unknown
C. Match
D. Bad Signature
D. Bad Signature
What happens when EnCase attempts to reopen a case once the evidence file has
been moved?
