ENCASE ASSESSMENT TEST QUESTIONS &
ANSWERS
On what part of the computer system will you find data of evidentiary value? - Answer -
Hard drive
The evidence is a log file and was recovered as an artifact of user activity on the
__________, which was stored on the _______, contained within a __________ on the
media. - Answer -operating system
file system
partition
What information about the document file can be found in FAT on the media? - Answer
-starting cluster of the file
fragmentation of the file
What information about the document file can be found in NTFS Master File Table on
the media? - Answer -name of the file
date and time stamp
start cluster
fragment cluster
ownership
Serve a search warrant on a business suspected of committing large-scale consumer
fraud. Who would you assign to your team? - Answer -Photographer
search and seizure specialist
recorder
digital evidence search and seizure specialist
Need to determine whether any Microsoft Office documents have been renamed with
image extensions to obscure their presence. what EnCase process would you use to
find such files? - Answer -File signature analysis
You want to reduce the number of files required for examination by identifying and
filtering out known good or system file. What EnCase process would you use to identify
such files? - Answer -File hash analysis
You want to determine whether a user has opened or double-clicked a file. What folder
would you look in for an operating system artifact for this user activity? - Answer -
Recent
You want to determine when a user deleted a file contained in a Windows 7 Recycle
Bin. In what file is the date and time information about the file deletion contained? -
Answer -$IOF5B7C.docx
ANSWERS
On what part of the computer system will you find data of evidentiary value? - Answer -
Hard drive
The evidence is a log file and was recovered as an artifact of user activity on the
__________, which was stored on the _______, contained within a __________ on the
media. - Answer -operating system
file system
partition
What information about the document file can be found in FAT on the media? - Answer
-starting cluster of the file
fragmentation of the file
What information about the document file can be found in NTFS Master File Table on
the media? - Answer -name of the file
date and time stamp
start cluster
fragment cluster
ownership
Serve a search warrant on a business suspected of committing large-scale consumer
fraud. Who would you assign to your team? - Answer -Photographer
search and seizure specialist
recorder
digital evidence search and seizure specialist
Need to determine whether any Microsoft Office documents have been renamed with
image extensions to obscure their presence. what EnCase process would you use to
find such files? - Answer -File signature analysis
You want to reduce the number of files required for examination by identifying and
filtering out known good or system file. What EnCase process would you use to identify
such files? - Answer -File hash analysis
You want to determine whether a user has opened or double-clicked a file. What folder
would you look in for an operating system artifact for this user activity? - Answer -
Recent
You want to determine when a user deleted a file contained in a Windows 7 Recycle
Bin. In what file is the date and time information about the file deletion contained? -
Answer -$IOF5B7C.docx
