ENCE QUESTIONS AND ANSWERS
Upon creating an EnCase case, what is created by EnCase? - Answer -A unique
directory structure for case management and an EnCase Case File
Lab drives receiving forensic images or other case data should have a unique what? -
Answer -Volume lable
Prior to acquiring digital evidence or adding it to a case, all hardware should be what? -
Answer -Tested and verified
Prior to acquiring digital evidence or adding it to a case, all drives to be used for forensic
images should be what? - Answer -Forensically wiped and prepared
What are EnCase Pathways? - Answer -Suggested strategies to assist the examiner by
providing links to suggested steps in the examination process
What happens in the EnCase Base Case Folder? - Answer -Encase creates the case's
unique folder structure and case file and by default writes all associated case data.
The EnCase base case folder default folders include......? - Answer -Export, Temp,
Searches and Tags
When is the EvidenceCache location chosen? - Answer -At the time of case creation
What are the five navigation panes in the EnCase environment? - Answer -Tree pane
(left)
Table pane (right)
View Pane (bottom left)
Filter pane (bottom right)
GPS bar (very bottom left)
What are the components of the GPS bar? - Answer -Path to object
Physical Sector (PS)
Logical Sector (LS)
Cluster (CL)
Sector Offset (SO)
File Offset (FO)
Length of bytes highlighted (LE)
What does the EnCase Evidence Processor do? - Answer -It processes all or selected
evidence in a case with the core analysis tools of EnCase in an automated workflow.
In order to work properly, what must the EnCase Evidence Processor have? - Answer -
Evidence in the case
Evidence should be acquired first
,Consideration of disk space
Determined time zone
What does the EnCase Evidence process let the examiner do? - Answer -Run a single
automated session of potent analytical tools agains case data, allowing you to work on
other aspects of the case whilst data is processing.
Give some example sources of digital media - Answer -Computers
Servers
Removable media
Virtual drives
Cloud services
Digital evidence handling includes what key aspects? - Answer -Identification
Handling
Cautions
Options for collection in powered on or off states
What is Chain of Custody? - Answer -documentation or paper trail showing custody,
control, transfer and analysis of everyone who comes in contact with the evidence
What are the number of characters addressable by ASCII and Unicode? - Answer -
ASCII 256
Unicode 65536
What is Binary? - Answer -Base 2. Binary uses characters (numbers) 0 and 1 only.
What is decimal? - Answer -Base 10. Decimal uses characters 0 through 9.
What is hexadecimal? - Answer -Base 16. Hex uses characters 0 through F.
What does hexadecimal use to represent one byte - Answer -Two characters
What is a single Unicode printed character composed of? - Answer -2 bytes of data
When an EnCase user double-clicks on a file within EnCase what determines the action
that will result? Select all that apply
A. The settings in the case file.
B. The settings in the FileTypes.ini file.
C. The setting in the evidence file. - Answer -B. The settings in the FileTypes.ini file.
Search results are found in which of the following files? Select all that apply.
A. The evidence file
B. The configuration Searches.ini file
, C. The case file - Answer -C. The case file
If cluster #3552 entry in the FAT table contains a value of ?? this would mean:
A. The cluster is unallocated
B. The cluster is the end of a file
C. The cluster is allocated
D. The cluster is marked bad - Answer -A. The cluster is unallocated
The following GREP expression was typed in exactly as shown. Choose the answer(s)
that would result. Bob@ [a-z]+.com
A. Bob@New zealand.com
B.
C.
D. - Answer -C.
What are the examiners key roles at a scene? - Answer -Documentation of scene and
evidence prior to and during collection, and establishing a chain of custody.
What is the BIOS? What information should be obtained from the BIOS? - Answer -
Basic input output system
System Date/Time
System boot order
What is the Boot Sequence? - Answer -Power button
BIOS - this immediately runs POST and then prepares the system for first program to
run
POST - Power on Self Test, checks system board, RAM, keyboard, disks for
presence/reliability
BIOS from add-in cards - such as SCSI cards, detect devices, load info into BIOS area
in RAM
Load RAM with BIOS data - Special RAM BIOS data area 256 bytes contains results of
the system check and identifies location of attached devices.
Boot Sequence?
What does ASCII stand for? - Answer -American Standard Code for Information
Interchange
You are an investigator and have encountered a computer that is running at the home
of a suspect. The computer does not appear to be a part of a network. The operating
system is Windows XP Home. No programs are visibly running. You should:
A. Pull the plug from the back of the computer.
B. Turn it off with the power button.
C. Pull the plug from the wall.
D. Shut it down with the start menu. - Answer -A. Pull the plug from the back of the
computer.
Upon creating an EnCase case, what is created by EnCase? - Answer -A unique
directory structure for case management and an EnCase Case File
Lab drives receiving forensic images or other case data should have a unique what? -
Answer -Volume lable
Prior to acquiring digital evidence or adding it to a case, all hardware should be what? -
Answer -Tested and verified
Prior to acquiring digital evidence or adding it to a case, all drives to be used for forensic
images should be what? - Answer -Forensically wiped and prepared
What are EnCase Pathways? - Answer -Suggested strategies to assist the examiner by
providing links to suggested steps in the examination process
What happens in the EnCase Base Case Folder? - Answer -Encase creates the case's
unique folder structure and case file and by default writes all associated case data.
The EnCase base case folder default folders include......? - Answer -Export, Temp,
Searches and Tags
When is the EvidenceCache location chosen? - Answer -At the time of case creation
What are the five navigation panes in the EnCase environment? - Answer -Tree pane
(left)
Table pane (right)
View Pane (bottom left)
Filter pane (bottom right)
GPS bar (very bottom left)
What are the components of the GPS bar? - Answer -Path to object
Physical Sector (PS)
Logical Sector (LS)
Cluster (CL)
Sector Offset (SO)
File Offset (FO)
Length of bytes highlighted (LE)
What does the EnCase Evidence Processor do? - Answer -It processes all or selected
evidence in a case with the core analysis tools of EnCase in an automated workflow.
In order to work properly, what must the EnCase Evidence Processor have? - Answer -
Evidence in the case
Evidence should be acquired first
,Consideration of disk space
Determined time zone
What does the EnCase Evidence process let the examiner do? - Answer -Run a single
automated session of potent analytical tools agains case data, allowing you to work on
other aspects of the case whilst data is processing.
Give some example sources of digital media - Answer -Computers
Servers
Removable media
Virtual drives
Cloud services
Digital evidence handling includes what key aspects? - Answer -Identification
Handling
Cautions
Options for collection in powered on or off states
What is Chain of Custody? - Answer -documentation or paper trail showing custody,
control, transfer and analysis of everyone who comes in contact with the evidence
What are the number of characters addressable by ASCII and Unicode? - Answer -
ASCII 256
Unicode 65536
What is Binary? - Answer -Base 2. Binary uses characters (numbers) 0 and 1 only.
What is decimal? - Answer -Base 10. Decimal uses characters 0 through 9.
What is hexadecimal? - Answer -Base 16. Hex uses characters 0 through F.
What does hexadecimal use to represent one byte - Answer -Two characters
What is a single Unicode printed character composed of? - Answer -2 bytes of data
When an EnCase user double-clicks on a file within EnCase what determines the action
that will result? Select all that apply
A. The settings in the case file.
B. The settings in the FileTypes.ini file.
C. The setting in the evidence file. - Answer -B. The settings in the FileTypes.ini file.
Search results are found in which of the following files? Select all that apply.
A. The evidence file
B. The configuration Searches.ini file
, C. The case file - Answer -C. The case file
If cluster #3552 entry in the FAT table contains a value of ?? this would mean:
A. The cluster is unallocated
B. The cluster is the end of a file
C. The cluster is allocated
D. The cluster is marked bad - Answer -A. The cluster is unallocated
The following GREP expression was typed in exactly as shown. Choose the answer(s)
that would result. Bob@ [a-z]+.com
A. Bob@New zealand.com
B.
C.
D. - Answer -C.
What are the examiners key roles at a scene? - Answer -Documentation of scene and
evidence prior to and during collection, and establishing a chain of custody.
What is the BIOS? What information should be obtained from the BIOS? - Answer -
Basic input output system
System Date/Time
System boot order
What is the Boot Sequence? - Answer -Power button
BIOS - this immediately runs POST and then prepares the system for first program to
run
POST - Power on Self Test, checks system board, RAM, keyboard, disks for
presence/reliability
BIOS from add-in cards - such as SCSI cards, detect devices, load info into BIOS area
in RAM
Load RAM with BIOS data - Special RAM BIOS data area 256 bytes contains results of
the system check and identifies location of attached devices.
Boot Sequence?
What does ASCII stand for? - Answer -American Standard Code for Information
Interchange
You are an investigator and have encountered a computer that is running at the home
of a suspect. The computer does not appear to be a part of a network. The operating
system is Windows XP Home. No programs are visibly running. You should:
A. Pull the plug from the back of the computer.
B. Turn it off with the power button.
C. Pull the plug from the wall.
D. Shut it down with the start menu. - Answer -A. Pull the plug from the back of the
computer.
