Encase Study Guide chapter 5-10 UPDATED
ACTUAL Exam Questions and CORRECT
Answers
The Encase evidence file is best described as follows: - CORRECT ANSWER An EnCase
evidence file is a bitstream image of a source drive such as a hard drive, CD-ROM, or floppy
disk written to a file (.E01) or several file segments (.E02, E03, and so on).
How does EnCase verify the contents of an evidence file? - CORRECT ANSWER EnCase
writes a CRC value for every 64 sectors copied, by default. If the block size has been increased,
the CRC frequency will be adjusted accordingly.
What is the smallest file size that an EnCase evidence file can be saved as? - CORRECT
ANSWER The smallest file size that an EnCase evidence file can be save as is 30 MB.
What is the largest file size segment that an EnCase evidence file be saved as? - CORRECT
ANSWER 8,796,093,018,112 MB
How does EnCase verify that the evidence file contains an exact copy of the source device? -
CORRECT ANSWER EnCase compares the MD5 hash value of the source device to the
MD5 hash value of just the data stored in the evidence file.
How does EnCase verify that the case information-such as case number, evidence number, notes,
and so on-in an evidence file has not been damaged or altered after the evidence file has been
written? - CORRECT ANSWER EnCase writes a CRC value for the case information, and
verifies the CRC value when the evidence is added to the case.
For an EnCase evidence file to successfully pass the file verification process, which of the
following must be true? - CORRECT ANSWER The CRC values and the MD5 has value
(alternatively SHA-1 or both) both must verify
, The MD5 hash algorithm produces a ___ value. - CORRECT ANSWER The MD5 hash
algorithm produces a 128-bit value.
Regarding the Encase backup process(Encase 7.04) which are the following are true -
CORRECT ANSWER By default, the backup frequency is every 30 minutes after
completion of the previous backup. And The evidnece and the case folder are backed up, except
for the Encase evidence files and the temp and Export folders
If an evidence file has been added to a case and completely verified, what happens if the data
area within the evidence file is later altered? - CORRECT ANSWER EnCase will detect
the error only if he evidence is manually reverified
Which of the following aspects of the EnCase evidence file can be changed during a reacquire of
the evidence file? - CORRECT ANSWER evidence file size
An evidence file was archived onto five CD-ROMS with the third file segment on disc 3. Can the
contents of the third file segment be verified by itself while still on the CD-ROM? - CORRECT
ANSWER Yes. Any evidence file segment can be verified independently by comparing
the CRC values
Will EnCase allow a user to write data into an acquired evidence file? - CORRECT
ANSWER no, data cannnot be added to the evidence file after the acquisition is complete.
All investigators using EnCase should run tests on the evidence file acquisition and verification
process to do which of the following? - CORRECT ANSWER All of the above As with
any forensic tool, the investigator should test the tools to better understand how the tool performs
and to verify that it is functioning properly.
When a non compressed evidence file is reacquired with compression, the acquisition and
verification hash values for the evidence file will remain the same. - CORRECT
ANSWER true
Search hit results are bookmarks stored in the evidence file. - CORRECT ANSWER false.
ACTUAL Exam Questions and CORRECT
Answers
The Encase evidence file is best described as follows: - CORRECT ANSWER An EnCase
evidence file is a bitstream image of a source drive such as a hard drive, CD-ROM, or floppy
disk written to a file (.E01) or several file segments (.E02, E03, and so on).
How does EnCase verify the contents of an evidence file? - CORRECT ANSWER EnCase
writes a CRC value for every 64 sectors copied, by default. If the block size has been increased,
the CRC frequency will be adjusted accordingly.
What is the smallest file size that an EnCase evidence file can be saved as? - CORRECT
ANSWER The smallest file size that an EnCase evidence file can be save as is 30 MB.
What is the largest file size segment that an EnCase evidence file be saved as? - CORRECT
ANSWER 8,796,093,018,112 MB
How does EnCase verify that the evidence file contains an exact copy of the source device? -
CORRECT ANSWER EnCase compares the MD5 hash value of the source device to the
MD5 hash value of just the data stored in the evidence file.
How does EnCase verify that the case information-such as case number, evidence number, notes,
and so on-in an evidence file has not been damaged or altered after the evidence file has been
written? - CORRECT ANSWER EnCase writes a CRC value for the case information, and
verifies the CRC value when the evidence is added to the case.
For an EnCase evidence file to successfully pass the file verification process, which of the
following must be true? - CORRECT ANSWER The CRC values and the MD5 has value
(alternatively SHA-1 or both) both must verify
, The MD5 hash algorithm produces a ___ value. - CORRECT ANSWER The MD5 hash
algorithm produces a 128-bit value.
Regarding the Encase backup process(Encase 7.04) which are the following are true -
CORRECT ANSWER By default, the backup frequency is every 30 minutes after
completion of the previous backup. And The evidnece and the case folder are backed up, except
for the Encase evidence files and the temp and Export folders
If an evidence file has been added to a case and completely verified, what happens if the data
area within the evidence file is later altered? - CORRECT ANSWER EnCase will detect
the error only if he evidence is manually reverified
Which of the following aspects of the EnCase evidence file can be changed during a reacquire of
the evidence file? - CORRECT ANSWER evidence file size
An evidence file was archived onto five CD-ROMS with the third file segment on disc 3. Can the
contents of the third file segment be verified by itself while still on the CD-ROM? - CORRECT
ANSWER Yes. Any evidence file segment can be verified independently by comparing
the CRC values
Will EnCase allow a user to write data into an acquired evidence file? - CORRECT
ANSWER no, data cannnot be added to the evidence file after the acquisition is complete.
All investigators using EnCase should run tests on the evidence file acquisition and verification
process to do which of the following? - CORRECT ANSWER All of the above As with
any forensic tool, the investigator should test the tools to better understand how the tool performs
and to verify that it is functioning properly.
When a non compressed evidence file is reacquired with compression, the acquisition and
verification hash values for the evidence file will remain the same. - CORRECT
ANSWER true
Search hit results are bookmarks stored in the evidence file. - CORRECT ANSWER false.
