any part of the file

all of the file

the starting cluster of the file

the directory entry for the file

The .case file writes a CRC value for the case information and verifies it when the case is opened.

EnCase does not verify the case information and case information can be changed by the user as it becomes necessary.

EnCase writes a CRC value of the case information and verifies the CRC value when the evidence is added to a case.

EnCase writes an MD5 hash value for the entire evidence file, which includes the case information, and verifies the MD5 hash when the evidence is added to a case.

1

2

3

4

The data from the beginning of the starting cluster to the length of the file.

The data taken from the starting cluster to the end of the last cluster that is occupied by the file.

A file including any RAM and disk slack.

A file including only RAM slack.

Storing information that is specific to a particular case.

Storing information that will be available to EnCase each time it is opened, regardless of the active case(s).

Storing pointers to acquired evidence.

Storing the results of a signature analysis.

This is the folder that will automatically store an evidence file when the acquisition is made in DOS.

This is the folder that temporarily stores all bookmark and search results.

This is the folder used to hold copies of files that are sent to external viewers.

This is the folder that will be automatically selected when the copy/unerase feature is used.

FAT

File header

Operating system

Directory entry

An MD5 hash

A 32 bit CRC

A running log

Nothing. Restored volumes are not verified.

The case file

The configuration Bookmarks.ini file

The evidence file

All of the above

Pre-POST

During POST

After POST

None of the above.

Tom

Jones

Tom Jones

tom jones

True

False

command.com

io.sys

drvspace.bin

autoexec.bat

A file containing hash values from one or more selected hash sets.

A master table of file headers and extensions.

A list of the all the MD5 hash values used to verify the evidence files.

Both a and b.

Volume boot device

Master boot record

Master file table

Volume boot sector or record

Identify files that are already known to the user.

Compare one hash set with another hash set.

Verify the evidence file.

Compare a file header to a file extension.

Use an EnCase DOS boot disk to conduct a text search for child porn

Use FastBloc or a network/parallel port cable to acquire forensic images of the hard drives, then search the evidence files for the previously identified images.

Use FastBloc or a network/parallel port cable to preview the hard drives. Go to the Gallery view and search for the previously identified images.

Use FastBloc or a network/parallel port cable to preview the hard drives. Conduct a hash analysis of the files on the hard drives, using a hash library containing the hash values of the previously identified images.

By sorting on the signature column in the table view.

By sorting on the hash library column in the table view.

By sorting on the hash sets column in the table view

By sorting on the category column in the table view.

True

False

Inode Table

Info2 file

Directory Entry

Master File Table

MyNote.del, DC0.del

MyNote.txt, CD0.txt

MyNote.txt, DC0.txt

MyNote.del, DC1.del

A clone of the source hard drive.

A sector-by-sector copy of the source hard drive written to the corresponding sectors of the target hard drive.

A bit stream image of the source hard drive written to the corresponding sectors of the target hard drive.

A bit stream image of the source hard drive written to a file, or several file segments.

Will not find it because the letters of the keyword are not contiguous.

Will not find it unless File slack is checked on the search dialog box.

Will find it because EnCase performs a logical search.

Will not find it because EnCase performs a physical search only.