Deck 2: Certification for EnCE Outside North America

Question 1

A CPU is:

A) A chip that would be considered the brain of a computer, which is installed on a motherboard.
B) A Central Programming Unit.
C) An entire computer box, not including the monitor and other attached peripheral devices.
D) A motherboard with all required devices connected.

Answer 1

A chip that would be considered the brain of a computer, which is installed on a motherboard.

Question 2

The EnCase default export folder is:

A) A global setting that cannot be changed.
B) A case-specific setting that can be changed.
C) A global setting that can be changed.
D) A case-specific setting that cannot be changed.

Answer 2

A case-specific setting that can be changed.

Question 3

If cases are worked on a lab drive in a secure room, without any cleaning of the contents of the drive, which of the following areas would be of most concern?

A) Storage
B) There is no concern
C) Chain-of-custody
D) Cross-contamination

Answer 3

Cross-contamination

Question 4

EnCase is able to read and examine which of the following file systems?

A) HFS
B) FAT
C) NTFS
D) EXT3
E) None of the above

Question 5

A personal data assistant was placed in a evidence locker until an examiner has time to examine it.  Which of the following areas would require special attention?

A) Chain-of-custody
B) Cross-contamination
C) Storage
D) There is no concern

Question 6

When an EnCase user double-clicks on a valid . jpg file, that file is:

A) Renamed to JPG_0001. jpg and copied to the default export folder.
B) Copied to the default export folder and opened by an associated program.
C) Opened by EnCase.
D) Copied to the EnCase specified temp folder and opened by an associated program.

Question 7

What are the EnCase configuration .ini files used for?

A) Storing information that will be available to EnCase each time it is opened, regardless of the active case(s).
B) Storing the results of a signature analysis.
C) Storing pointers to acquired evidence.
D) Storing information that is specific to a particular case.

Question 8

Which of the following would be a true statement about the function of the BIOS?

A) The BIOS is responsible for checking and configuring the system after the power is turned on.
B) Both a and c
C) The BIOS is responsible for swapping out memory pages when RAM fills up.
D) The BIOS integrates compressed executable files with memory addresses for faster execution.

Question 9

A FAT directory has as a logical size of:

A) One cluster
B) 0 bytes
C) 128 bytes
D) 64 bytes

Question 10

In Windows, the file MyNote.txt is deleted from C Drive and is automatically sent to the Recycle Bin. The long filename was MyNote.txt and the short filename was MYNOTE.TXT. When viewing the Recycle Bin with EnCase, how will the long filename and MyNote.txt and the short filename was MYNOTE.TXT?

A) MyNote.txt, DC0.txt
B) MyNote.del, DC1.del
C) MyNote.txt, CD0.txt
D) MyNote.del, DC0.del

Question 11

Which of the following selections would be used to keep track of a fragmented file in the FAT file system?

A) All of the above
B) The partition table of extents
C) The File Allocation Table
D) The directory entry for the fragmented file

Question 12

A hard drive has been formatted as NTFS and Windows XP was installed.  The user used fdisk to remove all partitions from that drive. Nothing else was done.  You have imaged the drive and have opened the evidence file with EnCase.  What would be the best way to examine this hard drive?

A) EnCase will not see a drive that has been fdisked.
B) Use the recovered Deleted Partitions feature and then examine the system.
C) Conduct a physical search of the hard drive and bookmark any evidence.
D) Use the add Partition feature to rebuild the partition and then examine the system.

Question 13

Within EnCase for Windows, the search process is:

A) a search of the logical files
B) a search of the physical disk in unallocated clusters and other unused disk areas
C) both a and b
D) None of the above

Question 14

Hash libraries are commonly used to:

A) Compare a file header to a file extension.
B) Compare one hash set with another hash set.
C) Identify files that are already known to the user.
D) Verify the evidence file.

Question 15

RAM is an acronym for:

A) Random Addressable Memory
B) Relative Addressable Memory
C) Relative Address Memory
D) Random Access Memory

Question 16

In hexadecimal notation, one byte is represented by _____ character(s).

A) 8
B) 4
C) 2
D) 1

Question 17

In DOS and Windows, how many bytes are in one FAT directory entry?

A) 16
B) 8
C) 32
D) Variable
E) 64

Question 18

The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. [\x00-\x05]\x00\x00\x00[\x00-\x05]\x00\x00\x00 

A) 00 00 00 01 FF FF BA
B) FF 00 00 00 00 FF BA
C) 04 00 00 00 FF FF BA
D) 04 06 00 00 00 FF FF BA

Question 19

For an EnCase evidence file acquired with a hash value to pass verification, which of the following must be true?

A) Either the CRC or MD5 hash values must verify.
B) The CRC values must verify.
C) The CRC values and the MD5 hash value both must verify.
D) The MD5 hash value must verify.

Question 20

Which of the following would most likely be an add-in card?

A) Anything plugged into socket 7
B) A motherboard
C) A video card that is connected to the motherboard in the AGP slot
D) The board that connects to the power supply

Question 21

A case file can contain ____ hard drive images?

A) 1
B) 5
C) 10
D) any number of

Question 22

Bookmarks are stored in which of the following files?

A) All of the above
B) The case file
C) The evidence file
D) The configuration Bookmarks.ini file

Question 23

Within EnCase, what is purpose of the default export folder?

A) This is the folder used to hold copies of files that are sent to external viewers.
B) This is the folder that will automatically store an evidence file when the acquisition is made in DOS.
C) This is the folder that will be automatically selected when the copy/unerase feature is used.
D) This is the folder that temporarily stores all bookmark and search results.

Question 24

In Unicode, one printed character is composed of ____ bytes of data.

A) 1
B) 8
C) 4
D) 2

Question 25

What information in a FAT file system directory entry refers to the location of a file on the hard drive?

A) The starting cluster
B) The fragmentation settings
C) The file attributes
D) The file size

Question 26

In the EnCase environment, the term external viewers is best described as?

A) Programs that are exported out of an evidence file.
B) Programs that are associated with EnCase to open specific file types.
C) Any program that will work with EnCase.
D) Any program that is loaded on the lab hard drive.

Question 27

What files are reconfigured or deleted by EnCase during the creation of an EnCase boot disk?

A) command.com
B) io.sys
C) autoexec.bat
D) drvspace.bin

Question 28

The boot partition table found at the beginning of a hard drive is located in what sector?

A) Master boot record
B) Volume boot sector
C) Master file table
D) Volume boot record

Question 29

By default, EnCase will display the data from the end of a logical file, to the end of the cluster, in what color:

A) Red
B) Black
C) Red on black
D) Black on red

Question 30

Will EnCase allow a user to write data into an acquired evidence file?

A) No.  Data cannot be added to the evidence file after the acquisition is made.
B) Yes, but only bookmarks.
C) Yes, but only case information.
D) No, unless the user established a writing privilege when the evidence was acquired.
E) Yes, but only to resize the partitions.

Question 31

The signature table data is found in which of the following files?

A) The case file
B) All of the above
C) The configuration FileSignatures.ini file
D) The evidence file

Question 32

In DOS acquisition mode, if a physical drive is detected, but no partition information is displayed, what would be the cause:

A) There are no partitions present.
B) The partition scheme is not recognized by DOS.
C) Both a and b
D) Neither a or b

Question 33

The following keyword was typed in exactly as shown.  Choose the answer(s) that would result.  All search criteria have default settings. credit card

A) Credit Card
B) credit card
C) Card
D) Credit

Question 34

This question addresses the EnCase for Windows search process.  If a target word is within a logical file, and it begins in cluster 10 and ends in cluster 15 (the word is fragmented), the search

A) Will find it because EnCase performs a logical search.
B) Will not find it unless slack is checked on the search dialog box.
C) Will not find it because EnCase performs a physical search only.
D) Will not find it because the letters of the keyword are not contiguous.

Question 35

ROM is an acronym for:

A) Random Open Memory
B) Read Open Memory
C) Relative Open Memory
D) Read Only Memory

Question 36

What does the acronym BIOS stand for?

A) Basic Integrated Operating System
B) Basic Input/Output System
C) Binary Input/Output System
D) Binary Integrated Operating System

Question 37

The temporary folder of a case cannot be changed once it has been set.

Question 38

What information should be obtained from the BIOS during computer forensic investigations?

A) The date and time
B) The video caching information
C) The port assigned to the serial port
D) The boot sequence

Question 39

Consider the following path in a FAT file system: C : \ My Documents\My Pictures\Bikes. Where does the directory Bikes receive its name?

A) From the root directory C : \
B) From itself
C) From the My Pictures directory
D) From the My Documents directory

Question 40

Select the appropriate name for the highlighted area of the binary numbers.

A) Nibble
B) Byte
C) Dword
D) Bit
E) Word

Question 41

The end of a logical file to the end of the cluster that the file ends in is called:

A) Unallocated space
B) Allocated space
C) Slack
D) Available space

Question 42

When undeleting a file in the FAT file system, EnCase will check the _____________ to see if it has already been overwritten.

A) directory entry
B) data on the hard drive
C) deletion table
D) FAT

Question 43

When does the POST operation occur?

A) When the power button to a computer is turned on.
B) When SCSI devices are configured.
C) When Windows starts up.
D) After a computer begins to boot from a device.

Question 44

Which of the following directories contain the information that is found on a Windows 98 Desktop?

A) C : \ Program files\Programs\Desktop
B) C : \ Startup\Desktop\Items
C) C : \ Windows\Desktop
D) C : \ Desktop

Question 45

When an EnCase user double-clicks on a file within EnCase what determines the action that will result?

A) The settings in the case file.
B) The setting in the evidence file.
C) The settings in the FileTypes.ini file.
D) Both a and b.

Question 46

Select the appropriate name for the highlighted area of the binary numbers.

A) Bit
B) Nibble
C) Word
D) Byte
E) Dword

Question 47

During the power-up sequence, which of the following happens first?

A) The BIOS on an add-in card is executed.
B) The boot sector is located on the hard drive.
C) The power On Self-Test.
D) The floppy drive is checked for a diskette.

Question 48

If cluster number 10 in the FAT contains the number 55, this means

A) That the file starts in cluster number 55 and continues to cluster number 10.
B) The cluster number 55 is the end of an allocated file.
C) That there is a cross-linked file.
D) That cluster 10 is used and the file continues in cluster number 55.

Question 49

Which of the following selections is NOT found in the case file?

A) Signature analysis results
B) Search results
C) Pointers to evidence files
D) External viewers

Question 50

You are working in a computer forensic lab. A law enforcement investigator brings you a computer and a valid search warrant. You have legal authority to search the computer. The investigator hands you a piece of paper that has three printed checks on it. All three checks have the same check and account number. You image the suspect's computer and open the evidence file with EnCase. You perform a text search for the account number and check number. Nothing returns on the search results. You perform a text search for all other information found on the printed checks and there is still nothing returned in the search results. You run a signature analysis and check the gallery. You cannot locate any graphical copies of the printed checks in the gallery. At this point, is it safe to say that the checks are not located on the suspect computer? 

A) No.  The images could be located a compressed file.
B) No.  The images could be in unallocated clusters.
C) No.  The images could be embedded in a document.
D) All of the above.
E) No.  The images could be in an image format not viewable inside EnCase.

Question 51

To undelete a file in the FAT file system, EnCase computes the number of _______ the file will use based on the file ______.

A) Clusters; file size
B) Sectors; file size
C) Clusters; starting extent
D) Sectors; starting extent

Question 52

By default, what color does EnCase use for slack?

A) Red
B) Black
C) Black on red
D) Red on black

Question 53

You are investigating a case involving fraud. You seized a computer from a suspect who stated that the computer is not used by anyone other than himself. The computer has Windows 98 installed on the hard drive. You find the filename C : \ downloads\check01. jpg that EnCase shows as being moved. The starting extent is 0C4057. You find another filename C : \ downloads\chk1.dll with the starting extent 0C4057, which EnCase also shows as being moved. In the C : \ windows\System folder you find an allocated file named chk1.dll with the starting extent 0C4057. The chk1.dll file is a JPEG image of a counterfeit check. Could this information be used to refute the suspect claim that he never knew it was on the computer?

A) Yes, because the chk1.dll file was moved and renamed.
B) No, because the Windows operating system likely moved and renamed the chk1.dll file during disk maintenance.
C) No, because the chk1.dll file has no evidentiary value.
D) Yes, because the ch1.dll is all the evidence required to prove the case.

Question 54

A SCSI host adapter would most likely perform which of the following tasks?

A) Set up the connection of IDE hard drives.
B) None of the above.
C) Configure the motherboard settings to the BIOS.
D) Make SCSI hard drives and other SCSI devices accessible to the operating system.

Question 55

To later verify the contents of an evidence file?  7RODWHUYHULI\WKHFRQWHQWVRIDQHYLGHQFHILOH

A) EnCase writes a CRC value for every 64 sectors copied.
B) EnCase writes an MD5 hash value for every 32 sectors copied.
C) EnCase writes an MD5 hash value every 64 sectors copied.
D) EnCase writes a CRC value for every 128 sectors copied.

Question 56

Assume that MyNote.txt has been deleted.  The FAT file system directory entry for that file has been overwritten.  The data for MyNote.txt is now:

A) Allocated
B) Cross-linked
C) Unallocated
D) Overwritten

Question 57

When Unicode is selected for a search keyword, EnCase:

A) Will only find the keyword if it is Unicode.
B) None of the above.
C) Unicode is not a search option for EnCase.
D) Will find the keyword if it is either Unicode or ASCII.

Question 58

Select the appropriate name for the highlighted area of the binary numbers.

A) Nibble
B) Dword
C) Word
D) Bit
E) Byte

Question 59

You are investigating a case of child pornography on a hard drive containing Windows XP. In the C : \ Documents and Settings\Bad Guy\Local Settings\Temporary Internet Files folder you find three images of child pornography. You find no other copies of the images on the suspect hard drive, and you find no other copies of the filenames. What can be deduced from your findings?

A) The presence and location of the images is strong evidence of possession.
B) The presence and location of the images is not strong evidence of possession.
C) The presence and location of the images proves the images were intentionally downloaded.
D) Both a and c

Question 60

You are at an incident scene and determine that a computer contains evidence as described in the search warrant.  When you seize the computer, you should:

A) Record the identity of the person(s) involved in the seizure.
B) Record the location that the computer was recovered from.
C) Record nothing to avoid inaccuracies that might jeopardize the use of the evidence.
D) Record the date and time the computer was seized.

Question 61

The case number in an evidence file can be changed without causing the verification feature to report an error, if:

A) The user utilizes a text editor.
B) The user utilizes the case information editor within EnCase.
C) The evidence file is reacquired.
D) The case information cannot be changed in an evidence file, without causing the verification feature to report an error.

Question 62

A physical file size is:

A) The total size of all the clusters used by the file measured in bytes.
B) The total size in bytes of a logical file.
C) The total size of the file including the ram slack in bytes.
D) The total size in sectors of an allocated file.

Question 63

You are conducting an investigation and have encountered a computer that is running in the field.  The operating system is Windows XP.  A software program is currently running and is visible on the screen.  You should:

A) Pull the plug from the wall.
B) Photograph the screen and pull the plug from the back of the computer.
C) Pull the plug from the back of the computer.
D) Navigate through the program and see what the program is all about, then pull the plug.

Question 64

The term signature and reader as they relate to a signature analysis are:

A) Areas compared with each other to verify the correct file type.
B) Synonymous.
C) The signature is the file extension.  The header is a standard pattern normally found at the beginning of a file.
D) None of the above

Question 65

When can an evidence file containing a NTFS partition be logically restored to a FAT 32 partition?

A) When the FAT 32 has the same number of sectors / clusters.
B) When the FAT 32 is the same size or bigger.
C) Never
D) Both A and B

Question 66

An Enhanced Metafile would best be described as:

A) A compound e-mail attachment.
B) A graphics file attached to an e-mail message.
C) A file format used in the printing process by Windows.
D) A compressed zip file.

Question 67

Before utilizing an analysis technique on computer evidence, the investigator should:

A) Test the technique on simulated evidence in a controlled environment to confirm that the results are consistent.
B) Be trained in the employment of the technique.
C) Neither a or b.
D) Both a and b.

Question 68

If a floppy diskette is in the a drive, the computer will always boot to that drive before any other device.

Question 69

The following GREP expression was typed in exactly as shown.  Choose the answer(s) that would result. Jan 1 st , 2?0?00

A) Jan 1 st , 1900
B) Jan 1 st , 2001
C) Jan 1 st , 2000
D) Jan 1 st , 2100

Question 70

RAM is used by the computer to:

A) Establish a connection with external devices.
B) Temporarily store electronic data that is being processed.
C) Execute the POST during start-up.
D) Permanently store electronic data.

Question 71

A file extension and signature can be manually added by:

A) Right-clicking on a file and selecting add  
B) Using the new file signature feature under file signatures.
C) Using the new library feature under hash libraries.
D) Using the new set feature under hash sets.

Question 72

Calls to the C : \ volume of the hard drive are not made by DOS when a computer is booted with a standard DOS 6.22 boot disk.

Question 73

Creating an image of a hard drive that was seized as evidence:

A) Should be done by the user, as they are most familiar with the hard drive.
B) May only be done by trained personnel because the process has the potential to alter the original evidence.
C) May be done by anyone because it is a relatively simple procedure.
D) May only be done by computer scientists.

Question 74

In Windows 98 and ME, Internet based e-mail, such as Hotmail, will most likely be recovered in the _____________________ folder.

A) C : \ Windows\Online\Applications\email
B) C : \ Windows\Temp
C) C : \ Windows\Temporary Internet files
D) C : \ Windows\History\Email

Question 75

A hash set would most accurately be described as:

A) A group of hash libraries organized by category.
B) A table of file headers and extensions.
C) A group of hash values that can be added to the hash library.
D) Both a and b.

Question 76

How does EnCase verify that the case information (Case Number, Evidence Number, Investigator Name, etc) in an evidence file has not been damaged or changed, after the evidence file has been written?

A) The .case file writes a CRC value for the case information and verifies it when the case is opened.
B) EnCase does not verify the case information and case information can be changed by the user as it becomes necessary.
C) EnCase writes a CRC value of the case information and verifies the CRC value when the evidence is added to a case.
D) EnCase writes an MD5 hash value for the entire evidence file, which includes the case information, and verifies the MD5 hash when the evidence is added to a case.

Question 77

The following GREP expression was typed in exactly as shown.  Choose the answer(s) that would result. [^a-z]Tom[^a-z]

A) Tom
B) Toms
C) Tomato
D) Stomp

Question 78

The acronym ASCII stands for:

A) American Standard Communication Information Index
B) Accepted Standard Communication Information Index
C) American Standard Code for Information Interchange
D) Accepted Standard Code for Information Interchange

Question 79

How does EnCase verify that the evidence file contains an exact copy of the suspect hard drive?

A) By means of a CRC value of the suspect hard drive compared to a CRC value of the data stored in the evidence file.
B) By means of a CRC value of the evidence file itself.
C) By means of an MD5 hash of the suspect hard drive compared to an MD5 hash of the data stored in the evidence file.
D) By means of an MD5 hash value of the evidence file itself.

Question 80

Which statement would most accurately describe a motherboard?

A) The main circuit board that has slots for the microprocessor, RAM, ROM, and add-in cards.
B) Any circuit board, regardless of its function.
C) An add-in card that controls all hard drive activity.
D) An add-in card that handles all RAM.