EnCase

You are a computer forensic examiner investigating a seized computer. You recovered a document
containing potential evidence. EnCase reports the file system on the forensic image of the
hard drive is FAT (File Allocation Table). What information about the document file can be
found in the FAT on the media? (Choose all that apply.)

You are a computer forensic examiner investigating media on a seized computer. You recovered
a document containing potential evidence. EnCase reports the file system on the forensic image
of the hard drive is NTFS (New Technology File System). What information about the document
file can be found in the NTFS master file table on the media? (Choose all that apply.)

You are preparing to lead a team to serve a search warrant on a business suspected of committing
large-scale consumer fraud. Ideally, you would you assign which tasks to search team members?
(Choose all that apply.)

You are a computer forensic examiner at a scene and are authorized to only seize media that can be
determined to have evidence related to the investigation. What options do you have to determine
whether evidence is present before seizure and a full forensic examination? (Choose all that apply.)

You are a computer forensic examiner at a scene and have determined you will need to image
a hard drive in a workstation while onsite. What are your options for creating a forensically
sound image of the hard drive? (Choose all that apply.)

You are a computer forensic examiner and have imaged a hard drive on site. Before you leave
the scene, you want to ensure the image completely verifies as an exact forensic duplicate of the
original. To verify the EnCase evidence file containing the image, you should:

You are a computer forensic examiner and need to verify the integrity of an EnCase evidence file.
To completely verify the file’s integrity, which of the following must be true?

You are a computer forensic examiner and need to determine what files are contained within a
folder called Business documents. What EnCase pane will you use to view the names of the files
in the folder?

You are a computer forensic examiner and need to view the contents of a file contained within a
folder called Business documents. What EnCase pane will you use to view the contents of the file?

You are a computer forensic examiner and are viewing a file in an EnCase evidence file. With
your cursor, you have selected one character in the file. What binary term is used for the amount
of data that represents a single character?

You are a computer forensic examiner and need to search for the name of a suspect in an EnCase evidence
file. You enter the name of the suspect into the EnCase keyword interface as John Doe. What
search hits will be found with this search term with the default settings? (Choose all that apply.)

You are a computer forensic examiner and need to determine if any Microsoft Office documents
have been renamed with image extensions to obscure their presence. What EnCase process
would you use to find such files?

You are a computer forensic examiner and want to reduce the number of files required for examination
by identifying and filtering out known good or system files. What EnCase process would
you use to identify such files?

You are a computer forensic examiner and want to determine if a user has opened or doubleclicked
a file. What folder would you look in for an operating system artifact for this user activity?

You are a computer forensic examiner and want to determine when a user deleted a file contained
in the Recycle Bin. In what file is the date and time information about the file deletion
contained?

You are a computer forensic examiner and want to determine how many times a program was
executed. Where would you find information?

You are a computer forensic examiner and want to examine any e-mail sent and received by the
user of the computer system under investigation. What e-mail formats are supported by EnCase?
(Choose all that apply.)