ENCE TEST LATEST UPDATED
How many sector(s) on a hard drive are reserved for the master boot record
(MBR)?
A. 1
B. 4
C. 16
D. 62
E. 63
E. 63
The extension is in the File Signature table, but the header is incorrect and the
header is not in the File Signatures table. What is this?
A. Alias
B. Unknown
C. Match
D. Bad Signature
D. Bad Signature
What happens when EnCase attempts to reopen a case once the evidence file
has been moved?
A. EnCase reports that the file's integrity has been compromised and renders the
file useless.
B. EnCase reports a different hash value for the evidence file.
C. EnCase prompts for the location of the evidence file.
D. EnCase opens the case, excluding the moved evidence file.
C. EnCase prompts for the location of the evidence file.
, Windows XP contains two master keys in its registry. They are
KEY_LOCAL_MACHINE and which of the following?
A. HKEY_USERS
B. HKEY_CLASSES_ROOT
C. HKEY_CURRENT_USER
D. HKEY_CURRENT_CONFIG
A. HKEY_USERS
How would a user reverse-sort on a column in the Table view?
A. Hold down the Ctrl key, and double-click the selected column header.
B. Right-click the selected column, select Sort, and select either Sort Ascending
or Sort Descending.
C. Both A and B.
C. Both A and B.
When an EnCase user double-clicks on a file within EnCase what determines
the action that will result?
A. The settings in the case file.
B. The settings in the FileTypes.ini file.
C. The setting in the evidence file.
B. The settings in the FileTypes.ini file.
We have an expert-written solution to this problem!
Search results are found in which of the following files?
Select all that apply.
A. The evidence file
B. The configuration Searches.ini file
How many sector(s) on a hard drive are reserved for the master boot record
(MBR)?
A. 1
B. 4
C. 16
D. 62
E. 63
E. 63
The extension is in the File Signature table, but the header is incorrect and the
header is not in the File Signatures table. What is this?
A. Alias
B. Unknown
C. Match
D. Bad Signature
D. Bad Signature
What happens when EnCase attempts to reopen a case once the evidence file
has been moved?
A. EnCase reports that the file's integrity has been compromised and renders the
file useless.
B. EnCase reports a different hash value for the evidence file.
C. EnCase prompts for the location of the evidence file.
D. EnCase opens the case, excluding the moved evidence file.
C. EnCase prompts for the location of the evidence file.
, Windows XP contains two master keys in its registry. They are
KEY_LOCAL_MACHINE and which of the following?
A. HKEY_USERS
B. HKEY_CLASSES_ROOT
C. HKEY_CURRENT_USER
D. HKEY_CURRENT_CONFIG
A. HKEY_USERS
How would a user reverse-sort on a column in the Table view?
A. Hold down the Ctrl key, and double-click the selected column header.
B. Right-click the selected column, select Sort, and select either Sort Ascending
or Sort Descending.
C. Both A and B.
C. Both A and B.
When an EnCase user double-clicks on a file within EnCase what determines
the action that will result?
A. The settings in the case file.
B. The settings in the FileTypes.ini file.
C. The setting in the evidence file.
B. The settings in the FileTypes.ini file.
We have an expert-written solution to this problem!
Search results are found in which of the following files?
Select all that apply.
A. The evidence file
B. The configuration Searches.ini file
