ENCE 325 EXAM 4 CERTIFICATION
ASSESSMENT 2026 VERIFIED ANSWERS
GRADED A+ENCE 325 EXAM 4 CERTIFICATION
ASSESSMENT 2026 VERIFIED ANSWERS
GRADED A+
◉ You are a computer forensic examiner and need to determine
whether any Microsoft Office documents have been renamed with
image extensions to obscure their presence. What EnCase process
would you use to find such files?
A. File signature analysis
B. Recover Folders feature
C. File content search
D. File hash analysis.
Answer: A. File signature analysis
◉ You are a computer forensic examiner and want to reduce the
number of files required for examination by identifying and filtering
out known good or system files. What EnCase process would you use
to identify such files?
,A. File signature analysis
B. Recover Folders feature
C. File content search
D. File hash analysis.
Answer: D. File hash analysis
◉ You are a computer forensic examiner and want to determine
whether a user has opened or double-clicked a file. What folder
would you look in for an operating system artifact for this user
activity?
A. Temp
B. Windows Registry
C. Cookies
D. Desktop.
Answer: B. Windows Registry
◉ You are a computer forensic examiner and want to determine
when a user deleted a file contained in a Windows 7 Recycle Bin. In
what file is the date and time information about the file deletion
contained?
A. $R0F5B7C.docx
,B. $I0F5B7C.docx
C. INFO2
D. deleted.ini.
Answer: B. $I0F5B7C.docx
◉ You are a computer forensic examiner and want to determine how
many times a program was executed. Where would you find
information?
A. Temp folder
B. Registry
C. Recycle Bin
D. Program files.
Answer: B. Registry
◉ You are a computer forensic examiner and want to examine any
email sent and received by the user of the computer system under
investigation. What email formats are supported by EnCase?
(Choose all that apply.)
A. Outlook PSTs
B. Outlook Express
C. America Online
, D. MBOX
E. Lotus Notes NSF
F. Microsoft Exchange EDB.
Answer: A, B, C, D, E and F
◉ What is the definition of a CPU?
A. The physical computer case that contains all its internal
components
B. The computer's internal hard drive
C. A part of the computer whose function is to perform data
processing
D. A part of the computer that stores and manages memory.
Answer: C. A part of the computer whose function is to perform data
processing
◉ What is the BIOS?
A. BIOS stands for Basic Input Output System and is a combination of
low-level software and drivers that function as the interface,
intermediary, or layer between a computer's hardware and its
operating system.
B. BIOS stands for Bootstrap Initialization Operating System and is a
combination of low-level software and drivers that function as the
ASSESSMENT 2026 VERIFIED ANSWERS
GRADED A+ENCE 325 EXAM 4 CERTIFICATION
ASSESSMENT 2026 VERIFIED ANSWERS
GRADED A+
◉ You are a computer forensic examiner and need to determine
whether any Microsoft Office documents have been renamed with
image extensions to obscure their presence. What EnCase process
would you use to find such files?
A. File signature analysis
B. Recover Folders feature
C. File content search
D. File hash analysis.
Answer: A. File signature analysis
◉ You are a computer forensic examiner and want to reduce the
number of files required for examination by identifying and filtering
out known good or system files. What EnCase process would you use
to identify such files?
,A. File signature analysis
B. Recover Folders feature
C. File content search
D. File hash analysis.
Answer: D. File hash analysis
◉ You are a computer forensic examiner and want to determine
whether a user has opened or double-clicked a file. What folder
would you look in for an operating system artifact for this user
activity?
A. Temp
B. Windows Registry
C. Cookies
D. Desktop.
Answer: B. Windows Registry
◉ You are a computer forensic examiner and want to determine
when a user deleted a file contained in a Windows 7 Recycle Bin. In
what file is the date and time information about the file deletion
contained?
A. $R0F5B7C.docx
,B. $I0F5B7C.docx
C. INFO2
D. deleted.ini.
Answer: B. $I0F5B7C.docx
◉ You are a computer forensic examiner and want to determine how
many times a program was executed. Where would you find
information?
A. Temp folder
B. Registry
C. Recycle Bin
D. Program files.
Answer: B. Registry
◉ You are a computer forensic examiner and want to examine any
email sent and received by the user of the computer system under
investigation. What email formats are supported by EnCase?
(Choose all that apply.)
A. Outlook PSTs
B. Outlook Express
C. America Online
, D. MBOX
E. Lotus Notes NSF
F. Microsoft Exchange EDB.
Answer: A, B, C, D, E and F
◉ What is the definition of a CPU?
A. The physical computer case that contains all its internal
components
B. The computer's internal hard drive
C. A part of the computer whose function is to perform data
processing
D. A part of the computer that stores and manages memory.
Answer: C. A part of the computer whose function is to perform data
processing
◉ What is the BIOS?
A. BIOS stands for Basic Input Output System and is a combination of
low-level software and drivers that function as the interface,
intermediary, or layer between a computer's hardware and its
operating system.
B. BIOS stands for Bootstrap Initialization Operating System and is a
combination of low-level software and drivers that function as the
