ENCE WITH COMPLETE QUESTIONS WITH DETAILED
VERIFIED ANSWERS//GRADED A+// (100% CORRECT
ANSWERS) /ALREADY GR
Grep pipe: |
The pipe is an OR statement and can be used with the
parentheses, i.e., (com)|(net)|(org) for the end of an
email address.
Grep brackets: [ ]
Characters in brackets match any one character that
appears in the brackets. For example "smit[hy]" would
match "smith" and "smity."
Grep up carrot: [^]
A circumflex at the start of the string in brackets
means NOT. Hence [^hy] matches any characters
except h and y.
Page 1 of 32
,Grep dash: [-]
A dash within the brackets signifies a range of
characters. For example, [a-e] matches any character
from a through e, inclusive.
Grep backslash : [\]
A backslash before a character indicates that the
character is to be treated literally and not as a GREP
character.
Where are file signatures stored in encase
Stored in the EnCase configuration file FileTypes.ini
How many hash libraries can you have in a case?
You can have two Hash Libraries for each case
How is a hash value computed?
The hash value of a file is computed only from the
logical file independent of the file name, time/date
stamps, and the slack space of the physical file
Page 2 of 32
,Nibble
4 bit: binary 0000
Byte
8 Bit: binary 0000 0000
Data in each data block is verified by a CRC when no
compression is used. True or false?
True
A case file can contain any number of hard drives or
removable media. True or False?
True
What does a plus sign after a character do, GREP.
A plus sign after a character matches any number of
occurrences of that character except zero. For example
Page 3 of 32
, "john,+smith" would match "john,smith" or "john,,smith,"
but would NOT match "johnsmith."
What does a # sign after a character do, GREP.
A pound / hash sign matches any numeric character [0-
9]. For example ###-#### matches any phone number
in the form 327-4323.
Grep parentheses: (ab)
The parentheses allow the examiner to group individual
characters together as an AND statement.
Grep curly brackets: {m,n}
The curly braces state number of times to repeat, i.e., m
to n times
Word
16 bits: 0000 0000 0000 0000
What is the ASCII table built on
Page 4 of 32
VERIFIED ANSWERS//GRADED A+// (100% CORRECT
ANSWERS) /ALREADY GR
Grep pipe: |
The pipe is an OR statement and can be used with the
parentheses, i.e., (com)|(net)|(org) for the end of an
email address.
Grep brackets: [ ]
Characters in brackets match any one character that
appears in the brackets. For example "smit[hy]" would
match "smith" and "smity."
Grep up carrot: [^]
A circumflex at the start of the string in brackets
means NOT. Hence [^hy] matches any characters
except h and y.
Page 1 of 32
,Grep dash: [-]
A dash within the brackets signifies a range of
characters. For example, [a-e] matches any character
from a through e, inclusive.
Grep backslash : [\]
A backslash before a character indicates that the
character is to be treated literally and not as a GREP
character.
Where are file signatures stored in encase
Stored in the EnCase configuration file FileTypes.ini
How many hash libraries can you have in a case?
You can have two Hash Libraries for each case
How is a hash value computed?
The hash value of a file is computed only from the
logical file independent of the file name, time/date
stamps, and the slack space of the physical file
Page 2 of 32
,Nibble
4 bit: binary 0000
Byte
8 Bit: binary 0000 0000
Data in each data block is verified by a CRC when no
compression is used. True or false?
True
A case file can contain any number of hard drives or
removable media. True or False?
True
What does a plus sign after a character do, GREP.
A plus sign after a character matches any number of
occurrences of that character except zero. For example
Page 3 of 32
, "john,+smith" would match "john,smith" or "john,,smith,"
but would NOT match "johnsmith."
What does a # sign after a character do, GREP.
A pound / hash sign matches any numeric character [0-
9]. For example ###-#### matches any phone number
in the form 327-4323.
Grep parentheses: (ab)
The parentheses allow the examiner to group individual
characters together as an AND statement.
Grep curly brackets: {m,n}
The curly braces state number of times to repeat, i.e., m
to n times
Word
16 bits: 0000 0000 0000 0000
What is the ASCII table built on
Page 4 of 32
