amandarackham
Quiz by , created more than 1 year ago

EnCase computer security fundimentals quiz

738
0
0
amandarackham
Created by amandarackham over 9 years ago
Close

EnCase

Question 1 of 20

1

You are a computer forensic examiner tasked with determining what evidence is on a seized computer. On what part of the computer system will you find data of evidentiary value?

Select one of the following:

  • Microprocessor or CPU

  • USB controller

  • Hard drive

  • PCI expansion slots

Explanation

Question 2 of 20

1

You are a computer forensic examiner explaining how computers store and access the data you recovered during your examination. The evidence is a log file and was recovered as an artifact of user activity on the ___________, which was stored on the ____________, contained within a _____________ on the media.

Select one of the following:

  • Partition, operating system, file system.

  • Operating system, file system, partition.

  • File system, operating system, hard drive.

  • Operating system, partition, file system.

Explanation

Question 3 of 20

1

You are a computer forensic examiner investigating a seized computer. You recovered a document
containing potential evidence. EnCase reports the file system on the forensic image of the
hard drive is FAT (File Allocation Table). What information about the document file can be
found in the FAT on the media? (Choose all that apply.)

Select one or more of the following:

  • Name of the file

  • Date and time stamps of the file

  • Starting cluster of the file

  • Fragmentation of the file

  • Ownership of the file

Explanation

Question 4 of 20

1

You are a computer forensic examiner investigating media on a seized computer. You recovered
a document containing potential evidence. EnCase reports the file system on the forensic image
of the hard drive is NTFS (New Technology File System). What information about the document
file can be found in the NTFS master file table on the media? (Choose all that apply.)

Select one or more of the following:

  • Name of the file

  • Date and time stamps of the file

  • Starting cluster of the file

  • Fragmentation of the file

  • Ownership of the file

Explanation

Question 5 of 20

1

You are preparing to lead a team to serve a search warrant on a business suspected of committing
large-scale consumer fraud. Ideally, you would you assign which tasks to search team members?
(Choose all that apply.)

Select one or more of the following:

  • Photographer

  • Search and seizure specialists

  • Recorder

  • Digital evidence search and seizure specialists

Explanation

Question 6 of 20

1

You are a computer forensic examiner at a scene and have determined you will seize a Linux
server, which according to your source of information, contains the database records for the
company under investigation for fraud. What is the best practice for “taking down” the server
for collection?

Select one of the following:

  • Photograph the screen and note any running programs or messages, etc., and use the normal
    shutdown procedure.

  • Photograph the screen and note any running programs or messages, etc., and pull the plug
    from the wall.

  • Photograph the screen and note any running programs or messages, etc., and pull the plug
    from the rear of the computer.

  • Photograph the screen and note any running programs or messages, etc., and ask the user at
    the scene to shut down the server.

Explanation

Question 7 of 20

1

You are a computer forensic examiner at a scene and are authorized to only seize media that can be
determined to have evidence related to the investigation. What options do you have to determine
whether evidence is present before seizure and a full forensic examination? (Choose all that apply.)

Select one or more of the following:

  • Use a DOS boot floppy or CD to boot the machine and browse through the directory for
    evidence.

  • Use an EnCase boot floppy or CD to boot the machine into Linux and use LinEn to preview
    the hard drive through a crossover cable with EnCase for Windows

  • Remove the subject hard drive from the machine and preview the hard drive in EnCase for
    Windows with a hardware write blocker like FastBloc.

  • Use an EnCase boot floppy or CD to boot the machine into DOS and use EnCase for DOS
    to preview the hard drive through a crossover cable with EnCase for Windows.

Explanation

Question 8 of 20

1

You are a computer forensic examiner at a scene and have determined you will need to image
a hard drive in a workstation while onsite. What are your options for creating a forensically
sound image of the hard drive? (Choose all that apply.)

Select one or more of the following:

  • Use a DOS boot floppy or CD to boot the machine and use EnCase for DOS to image the
    subject hard drive to a second hard drive attached to the machine.

  • Use an EnCase boot floppy or CD to boot the machine into DOS and use EnCase for DOS
    to image the subject hard drive to a second hard drive attached to the machine.

  • Remove the subject hard drive from the machine and image the hard drive in EnCase for
    Windows with a hardware write blocker like FastBloc.

  • Use an EnCase boot floppy or CD to boot the machine into DOS and use EnCase for DOS
    to image the hard drive through a crossover cable with EnCase for Windows.

Explanation

Question 9 of 20

1

You are a computer forensic examiner and have imaged a hard drive on site. Before you leave
the scene, you want to ensure the image completely verifies as an exact forensic duplicate of the
original. To verify the EnCase evidence file containing the image, you should:

Select one or more of the following:

  • Use a hex editor to compare a sample of sectors in the EnCase evidence file with that of the
    original.

  • Load the EnCase evidence files into EnCase for Windows, and after the verification is more
    than halfway completed, cancel the verification and spot-check the results for errors.

  • Load the EnCase evidence files into EnCase for DOS and verify the hash of those files.

  • Load the EnCase evidence files into EnCase for Windows, allow the verification process to
    finish, and then check the results for complete verification.

Explanation

Question 10 of 20

1

You are a computer forensic examiner and need to verify the integrity of an EnCase evidence file.
To completely verify the file’s integrity, which of the following must be true?

Select one or more of the following:

  • The MD5 hash value must verify.

  • The CRC values and the MD5 hash value both must verify.

  • Either the CRC or MD5 hash values must verify.

  • The CRC values must verify.

Explanation

Question 11 of 20

1

You are a computer forensic examiner and need to determine what files are contained within a
folder called Business documents. What EnCase pane will you use to view the names of the files
in the folder?

Select one or more of the following:

  • Tree pane

  • Table pane

  • View pane

  • Filter pane

Explanation

Question 12 of 20

1

You are a computer forensic examiner and need to view the contents of a file contained within a
folder called Business documents. What EnCase pane will you use to view the contents of the file?

Select one or more of the following:

  • Tree pane

  • Table pane

  • View pane

  • Filter pane

Explanation

Question 13 of 20

1

You are a computer forensic examiner and are viewing a file in an EnCase evidence file. With
your cursor, you have selected one character in the file. What binary term is used for the amount
of data that represents a single character?

Select one or more of the following:

  • A bit

  • A nibble

  • A byte

  • A word

Explanation

Question 14 of 20

1

You are a computer forensic examiner and need to search for the name of a suspect in an EnCase evidence
file. You enter the name of the suspect into the EnCase keyword interface as John Doe. What
search hits will be found with this search term with the default settings? (Choose all that apply.)

Select one or more of the following:

  • John Doe

  • John D.

  • john doe

  • John.Doe

Explanation

Question 15 of 20

1

You are a computer forensic examiner and need to determine if any Microsoft Office documents
have been renamed with image extensions to obscure their presence. What EnCase process
would you use to find such files?

Select one or more of the following:

  • File signature analysis

  • Recover Folders feature

  • File content search

  • File hash analysis

Explanation

Question 16 of 20

1

You are a computer forensic examiner and want to reduce the number of files required for examination
by identifying and filtering out known good or system files. What EnCase process would
you use to identify such files?

Select one or more of the following:

  • File signature analysis

  • Recover Folders feature

  • File content search

  • File hash analysis

Explanation

Question 17 of 20

1

You are a computer forensic examiner and want to determine if a user has opened or doubleclicked
a file. What folder would you look in for an operating system artifact for this user activity?

Select one or more of the following:

  • Temp

  • Recent

  • Cookies

  • Desktop

Explanation

Question 18 of 20

1

You are a computer forensic examiner and want to determine when a user deleted a file contained
in the Recycle Bin. In what file is the date and time information about the file deletion
contained?

Select one or more of the following:

  • Index.dat

  • Link file

  • INFO2

  • Deleted.ini

Explanation

Question 19 of 20

1

You are a computer forensic examiner and want to determine how many times a program was
executed. Where would you find information?

Select one or more of the following:

  • Temp folder

  • Registry

  • Recycle Bin

  • Program Files

Explanation

Question 20 of 20

1

You are a computer forensic examiner and want to examine any e-mail sent and received by the
user of the computer system under investigation. What e-mail formats are supported by EnCase?
(Choose all that apply.)

Select one or more of the following:

  • Outlook

  • Outlook Express

  • America Online

  • Hotmail

  • Yahoo!

  • Mozilla Thunderbird

Explanation

Previous
Next