ENCASE EXAM REVIEW QUESTIONS & ANSWERS
The _____ is the folder where the case file is stored - Answer -base case folder
Which of the following are not part of the forensic readiness structure - Answer -
examinations
Clicking the ______ symbol displays all items below that in the Table pane, regardless
of type - Answer -home plate
A physical search will look at data cluster by cluster, and if the file is not stored
contiguously, it may not find the match. - Answer -True
A _____ search will miss a keyword if it is fragmented between noncontiguous clusters -
Answer -physical
Link Files, Recycle Bin Files, MFT Transactions, and ShellBags parsing options are
located under which Module? - Answer -Windows Artifact Parser
When acquiring a smartphone, "Acquire from Device" opens the Import Wizard, which
allows you to import a backup file from a mobile device - Answer -False
Filters can be shared from outside of EnCase? - Answer -True
Which of the following is not included in the case report template - Answer -Reporting
templates you can use as is or modify to suit your needs.
Which of the following is not a method to perform a case save - Answer -using the
keyboard shortcut of CTRL-E
Which of the following is not an EnCase Template - Answer -e-discovery
The "Index Slack and Unallocated" option is found under which processor option -
Answer -index text and metadata
The hash value is commonly represented as _____ written in hexadecimal notation -
Answer -binary data
The ______ will search unallocated space and file slack to see if there are fragments or
entire files that match our specifications to be found on the image - Answer -file carver
This policy determines how an computers on the organization's network are allowed to
be utilized - Answer -AUP
The _____ is the folder where the case file is stored - Answer -base case folder
Which of the following are not part of the forensic readiness structure - Answer -
examinations
Clicking the ______ symbol displays all items below that in the Table pane, regardless
of type - Answer -home plate
A physical search will look at data cluster by cluster, and if the file is not stored
contiguously, it may not find the match. - Answer -True
A _____ search will miss a keyword if it is fragmented between noncontiguous clusters -
Answer -physical
Link Files, Recycle Bin Files, MFT Transactions, and ShellBags parsing options are
located under which Module? - Answer -Windows Artifact Parser
When acquiring a smartphone, "Acquire from Device" opens the Import Wizard, which
allows you to import a backup file from a mobile device - Answer -False
Filters can be shared from outside of EnCase? - Answer -True
Which of the following is not included in the case report template - Answer -Reporting
templates you can use as is or modify to suit your needs.
Which of the following is not a method to perform a case save - Answer -using the
keyboard shortcut of CTRL-E
Which of the following is not an EnCase Template - Answer -e-discovery
The "Index Slack and Unallocated" option is found under which processor option -
Answer -index text and metadata
The hash value is commonly represented as _____ written in hexadecimal notation -
Answer -binary data
The ______ will search unallocated space and file slack to see if there are fragments or
entire files that match our specifications to be found on the image - Answer -file carver
This policy determines how an computers on the organization's network are allowed to
be utilized - Answer -AUP
