ENCASE Part 1 Exam Questions and Answers Graded A+
The Encase evidence file is best described as follows: - Answers a bitstream image of a source
drive written to a file or several file segments
How does EnCase verify the contents of an evidence file? - Answers EnCase writes a CRC value
for every 64 sectors copied
What is the smallest file size that an EnCase evidence file can be saved as? - Answers The
smallest file size that an EnCase evidence file can be save as is 1 MB.
What is the largest file size segment that an EnCase evidence file be saved as? - Answers
8,796,093,018,112 MB
How does EnCase verify that the evidence file contains an exact copy of the source device? -
Answers EnCase compares the MD5 hash value of the source device to the MD5 hash value of
just the data stored in the evidence file.
How does EnCase verify that the case information-such as case number, evidence number,
notes, and so on-in an evidence file has not been damaged or altered after the evidence file has
been written? - Answers EnCase writes a CRC value for the case information, and verifies the
CRC value when the evidence is added to the case.
For an EnCase evidence file to successfully pass the file verification process, which of the
following must be true? - Answers The CRC values and the MD5 has value (alternatively SHA-1
or both) both must verify
The MD5 hash algorithm produces a ___ value. - Answers The MD5 hash algorithm produces a
128-bit value.
Regarding the Encase backup process(Encase 7.04) which are the following are true - Answers
By default, the backup frequency is every 30 minutes after completion of the previous backup.
And The evidnece and the case folder are backed up, except for the Encase evidence files and
the temp and Export folders
If an evidence file has been added to a case and completely verified, what happens if the data
area within the evidence file is later altered? - Answers EnCase will detect the error only if he
evidence is manually reverified
Which of the following aspects of the EnCase evidence file can be changed during a reacquire
of the evidence file? - Answers evidence file size
An evidence file was archived onto five CD-ROMS with the third file segment on disc 3. Can the
contents of the third file segment be verified by itself while still on the CD-ROM? - Answers Yes.
Any evidence file segment can be verified independently by comparing the CRC values
, Will EnCase allow a user to write data into an acquired evidence file? - Answers no, data cannnot
be added to the evidence file after the acquisition is complete.
All investigators using EnCase should run tests on the evidence file acquisition and verification
process to do which of the following? - Answers All of the above As with any forensic tool, the
investigator should test the tools to better understand how the tool performs and to verify that it
is functioning properly.
When a non compressed evidence file is reacquired with compression, the acquisition and
verification hash values for the evidence file will remain the same. - Answers true
Search hit results are bookmarks stored in the evidence file. - Answers false.
The EnCase evidence file's logical file name can be changed without affecting the verification of
the acquired evidence. - Answers true
An evidence file can be moved to another directory without changing the file verification. -
Answers true
What happens when EnCase attempts to reopen a case once the evidence file has been moved?
- Answers EnCase will prompt for the new location of the evidence file.
During reacquisition, you can change which of the following? - Answers All may be changed
during reacquisition with the exception of the investigator's name.
In the EnCase Windows environment, must an examiner first create a new case before adding a
device to examine? - Answers yes
When encase 7 is used to create a new case, which files are cerated automatically in the case
folder under the folder bearing the name of the case? - Answers Email, Export, Tags, and Temp
From the encase 7 home screen, which of the following cannot be carried out? - Answers none
of the above so they all can be carried out
When creating a new case, the Case Options dialog box prompts for which of the following? -
Answers The Case Options dialog box asks for all of the options listed when a new case is
created.
What determines the action that will result when a user double-clicks a file within EnCase? -
Answers The FILESTYPES.INI file stores information on files such as types, extensions, and
viewers used to access.
In the EnCase environment, the term external viewers is best described as which of the
following? - Answers External viewers are programs that are associated with EnCase uses to
open specific file types.
Where is the list of external viewers kept within EnCase? - Answers The VIEWERS.INI file stores
The Encase evidence file is best described as follows: - Answers a bitstream image of a source
drive written to a file or several file segments
How does EnCase verify the contents of an evidence file? - Answers EnCase writes a CRC value
for every 64 sectors copied
What is the smallest file size that an EnCase evidence file can be saved as? - Answers The
smallest file size that an EnCase evidence file can be save as is 1 MB.
What is the largest file size segment that an EnCase evidence file be saved as? - Answers
8,796,093,018,112 MB
How does EnCase verify that the evidence file contains an exact copy of the source device? -
Answers EnCase compares the MD5 hash value of the source device to the MD5 hash value of
just the data stored in the evidence file.
How does EnCase verify that the case information-such as case number, evidence number,
notes, and so on-in an evidence file has not been damaged or altered after the evidence file has
been written? - Answers EnCase writes a CRC value for the case information, and verifies the
CRC value when the evidence is added to the case.
For an EnCase evidence file to successfully pass the file verification process, which of the
following must be true? - Answers The CRC values and the MD5 has value (alternatively SHA-1
or both) both must verify
The MD5 hash algorithm produces a ___ value. - Answers The MD5 hash algorithm produces a
128-bit value.
Regarding the Encase backup process(Encase 7.04) which are the following are true - Answers
By default, the backup frequency is every 30 minutes after completion of the previous backup.
And The evidnece and the case folder are backed up, except for the Encase evidence files and
the temp and Export folders
If an evidence file has been added to a case and completely verified, what happens if the data
area within the evidence file is later altered? - Answers EnCase will detect the error only if he
evidence is manually reverified
Which of the following aspects of the EnCase evidence file can be changed during a reacquire
of the evidence file? - Answers evidence file size
An evidence file was archived onto five CD-ROMS with the third file segment on disc 3. Can the
contents of the third file segment be verified by itself while still on the CD-ROM? - Answers Yes.
Any evidence file segment can be verified independently by comparing the CRC values
, Will EnCase allow a user to write data into an acquired evidence file? - Answers no, data cannnot
be added to the evidence file after the acquisition is complete.
All investigators using EnCase should run tests on the evidence file acquisition and verification
process to do which of the following? - Answers All of the above As with any forensic tool, the
investigator should test the tools to better understand how the tool performs and to verify that it
is functioning properly.
When a non compressed evidence file is reacquired with compression, the acquisition and
verification hash values for the evidence file will remain the same. - Answers true
Search hit results are bookmarks stored in the evidence file. - Answers false.
The EnCase evidence file's logical file name can be changed without affecting the verification of
the acquired evidence. - Answers true
An evidence file can be moved to another directory without changing the file verification. -
Answers true
What happens when EnCase attempts to reopen a case once the evidence file has been moved?
- Answers EnCase will prompt for the new location of the evidence file.
During reacquisition, you can change which of the following? - Answers All may be changed
during reacquisition with the exception of the investigator's name.
In the EnCase Windows environment, must an examiner first create a new case before adding a
device to examine? - Answers yes
When encase 7 is used to create a new case, which files are cerated automatically in the case
folder under the folder bearing the name of the case? - Answers Email, Export, Tags, and Temp
From the encase 7 home screen, which of the following cannot be carried out? - Answers none
of the above so they all can be carried out
When creating a new case, the Case Options dialog box prompts for which of the following? -
Answers The Case Options dialog box asks for all of the options listed when a new case is
created.
What determines the action that will result when a user double-clicks a file within EnCase? -
Answers The FILESTYPES.INI file stores information on files such as types, extensions, and
viewers used to access.
In the EnCase environment, the term external viewers is best described as which of the
following? - Answers External viewers are programs that are associated with EnCase uses to
open specific file types.
Where is the list of external viewers kept within EnCase? - Answers The VIEWERS.INI file stores
