DIGITAL FORENSICS ENCASE 8 FINAL EXAM QUESTIONS ANSWERED CORRECTLY LATEST
2025
What is the definition of POST? - Answers A diagnostic test of the computer's hardware for
presence and operability during the boot sequence prior to running the operating system
What is BIOS? - Answers BIOS stands for Basic Input Output System and is a combination of
low-level software and drivers that function as the interface, intermediary, or layer between a
computer's hardware and its operating system.
What is the definition of a CPU? - Answers A part of the computer whose function is to perform
data processing
What is the purpose or function of a computer's ROM chip? - Answers Long-term or permanent
storage of information and instructions
Symmetric (Network) - Answers A network in which all devices can send and receive data at the
same rates. Symmetric networks support more bandwidth in one direction as compared to the
other, and symmetric DSL offers clients the same bandwidth for both downloads and uploads.
Asymmetric - Answers refers to any system in which the data speed or quantity differs in one
direction as compared with the other direction, averaged over time
sector and cluster - Answers The smallest area on a drive that data can be written to is a _______,
while the smallest area on a drive that a file can be written to is a ________.
Bus - Answers The paths, or lines, on the motherboard on which data, instructions, and electrical
power move from component to component.
The digital forensic staffing consists of ______________ - Answers Forensic Investigator, IT
Professionals and Incident Handlers
master, slave, and Cable Select refer to - Answers Jumper settings for internal hardware such
as IDE hard drives and CD drives
Network devices include....? - Answers Router, Switch, Firewall
Login Records or Network Traffic Records - Answers Network device may maintain ______ or
________ that are most valuable resources for the cybercrime investigation.
Privacy Protection Act - Answers The purpose of _____ is to protect unpublished materials - such
as books and magazines - from having their material released by law enforcement officers prior
to making them available to the public....
Computer programs that record peoples password when they log into a computer can be an
instrumentality and computer program that crack passwords often play a significant role in a
crime.
, true or false - Answers true
Digital evidence includes any and all digital data that can establish that a crime has been
committed or can provide a link between a crime and its victim or a crime and its perpetrator.
true or false - Answers true
A personal computer with MS Windows is a non-programmable device.
true or false - Answers false
FAT is defined as? - Answers The FAT (file allocation table) is created by the file system during
format and contains pointers to clusters located on a drive
partition table - Answers A partition table is located in the master boot record and is always
located in the very first sector of a physical drive. The partition table keeps track of the
partitions located on the physical drive.
Which selection keeps track of a fragmented file in a FAT file system? - Answers File allocation
table
A file's logical size is displayed as? - Answers The number of bytes that the logical file contains
What is the area between the end of a file's logical size and the file's physical size called? -
Answers Slack space
Which selection displays the incorrect method for shutting down a computer? - Answers Linux:
Pull the plug
What is the best method to shut down a notebook computer? - Answers Unplug from the back
of the computer and Remove the battery
Which of the following is not acceptable for "bagging" a computer workstation? - Answers
Plastic garbage bag
In the EnCase Windows environment, must an examiner first create a new case before adding a
device to examine?
yes or no - Answers yes
Proper file management and organization require that which of the following should be created
prior to acquiring evidence? - Answers A. Evidence, Export, Temp, and Index folders
B. Unique naming conventions for folders belonging to the same case
C. All subfolders saved under one folder with the same unique
As a good forensic practice, why would it be a good idea to wipe a forensic drive before reusing
2025
What is the definition of POST? - Answers A diagnostic test of the computer's hardware for
presence and operability during the boot sequence prior to running the operating system
What is BIOS? - Answers BIOS stands for Basic Input Output System and is a combination of
low-level software and drivers that function as the interface, intermediary, or layer between a
computer's hardware and its operating system.
What is the definition of a CPU? - Answers A part of the computer whose function is to perform
data processing
What is the purpose or function of a computer's ROM chip? - Answers Long-term or permanent
storage of information and instructions
Symmetric (Network) - Answers A network in which all devices can send and receive data at the
same rates. Symmetric networks support more bandwidth in one direction as compared to the
other, and symmetric DSL offers clients the same bandwidth for both downloads and uploads.
Asymmetric - Answers refers to any system in which the data speed or quantity differs in one
direction as compared with the other direction, averaged over time
sector and cluster - Answers The smallest area on a drive that data can be written to is a _______,
while the smallest area on a drive that a file can be written to is a ________.
Bus - Answers The paths, or lines, on the motherboard on which data, instructions, and electrical
power move from component to component.
The digital forensic staffing consists of ______________ - Answers Forensic Investigator, IT
Professionals and Incident Handlers
master, slave, and Cable Select refer to - Answers Jumper settings for internal hardware such
as IDE hard drives and CD drives
Network devices include....? - Answers Router, Switch, Firewall
Login Records or Network Traffic Records - Answers Network device may maintain ______ or
________ that are most valuable resources for the cybercrime investigation.
Privacy Protection Act - Answers The purpose of _____ is to protect unpublished materials - such
as books and magazines - from having their material released by law enforcement officers prior
to making them available to the public....
Computer programs that record peoples password when they log into a computer can be an
instrumentality and computer program that crack passwords often play a significant role in a
crime.
, true or false - Answers true
Digital evidence includes any and all digital data that can establish that a crime has been
committed or can provide a link between a crime and its victim or a crime and its perpetrator.
true or false - Answers true
A personal computer with MS Windows is a non-programmable device.
true or false - Answers false
FAT is defined as? - Answers The FAT (file allocation table) is created by the file system during
format and contains pointers to clusters located on a drive
partition table - Answers A partition table is located in the master boot record and is always
located in the very first sector of a physical drive. The partition table keeps track of the
partitions located on the physical drive.
Which selection keeps track of a fragmented file in a FAT file system? - Answers File allocation
table
A file's logical size is displayed as? - Answers The number of bytes that the logical file contains
What is the area between the end of a file's logical size and the file's physical size called? -
Answers Slack space
Which selection displays the incorrect method for shutting down a computer? - Answers Linux:
Pull the plug
What is the best method to shut down a notebook computer? - Answers Unplug from the back
of the computer and Remove the battery
Which of the following is not acceptable for "bagging" a computer workstation? - Answers
Plastic garbage bag
In the EnCase Windows environment, must an examiner first create a new case before adding a
device to examine?
yes or no - Answers yes
Proper file management and organization require that which of the following should be created
prior to acquiring evidence? - Answers A. Evidence, Export, Temp, and Index folders
B. Unique naming conventions for folders belonging to the same case
C. All subfolders saved under one folder with the same unique
As a good forensic practice, why would it be a good idea to wipe a forensic drive before reusing
