ENCE Study Guide Questions with Complete Solution Graded A+

ENCE Study Guide Questions with Complete Solution Graded A+ Encase Evidence File bit stream image of evidence written to a file Encase Evidence File contains case data that cannot be changed after evidence file is created, contains case number, examiner name, evidence number, unique descriptions, date/time of computer system clock, acquisition notes, serial number of physical hard drive Cyclical Redundancy Check 32 bit CRC for 64 sectors of data only if no compression is used CRC calculated when evidence file is added to a case and rechecked every time the data block is accessed Verification Hash digital signature of all data in evidence file MD5 128-bit/32 characters hash SHA1 160-bit hash Standard Error Granularity size of data blocks when a read error on the media occurs Exhaustive Error Granularity sector by sector when a read error on the media occurs compression algorithm when compression is used, this is used to verify data blocks MD5,SHA1,CRC These three must match for the evidence file to be verified