Spring Sale Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: pass65
marks4sure logo
You are an investigator and have encountered a computer that is running at the home of a suspect. The computer does not appear to be a part of a network. The operating system is Windows XP Home. No programs are visibly running. You should:
Which is the proper formula for determining the size in bytes of a hard drive that uses cylinders (C), heads (H), and sectors (S) geometry?
This question addresses the EnCase for Windows search process. If a target word is located in the unallocated space, and the word is fragmented between clusters 10 and 15, the search:
Assume that an evidence file is added to a case, the case is saved, and the case is closed. What happens if the evidence file is moved, and the case is then opened?
The results of a hash analysis on an evidence file that has been added to a case will be stored in which of the following files?
In Windows 2000 and XP, which of the following directories contain user personal folders?
The spool files that are created during a print job are __________ after the print job is completed.
An evidence file was archived onto five CD-Rom disks with the third file segment on disk number three. Can the contents of the third file segment be verified by itself while still on the CD?
You are examining a hard drive that has Windows XP installed as the operating system. You see a file that has a date and time in the deleted column. Where does that date and time come from?
The Windows 98 Start Menu has a selection called documents which displays a list of recently used files. Which of the following The Windows 98 Start Menu has a selection called documents which displays a list of recently used files. Which of the following folders contain those files?
Pressing the power button on a computer that is running could have which of the following results?
Which of the following aspects of the EnCase evidence file can be changed during a reacquire of the evidence file?
When can an evidence file containing a NTFS partition be logically restored to a FAT 32 partition?
By default, EnCase will display the data from the end of a logical file, to the end of the cluster, in what color:
The following keyword was typed in exactly as shown. Choose the answer(s) that would result. All search criteria have default settings. Tom Jones
For an EnCase evidence file acquired with a hash value to pass verification, which of the following must be true?
The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result.[\x00-\x05]\x00\x00? & gt;[?[@?[?[?[
Before utilizing an analysis technique on computer evidence, the investigator should:
When a document is printed using EMF in Windows, what file(s) are generated in the spooling process?
The EnCase signature analysis is used to perform which of the following actions?
When a file is deleted in the FAT or NTFS file systems, what happens to the data on the hard drive?
How many copies of the FAT are located on a FAT 32, Windows 98-formatted partition?
You are at an incident scene and determine that a computer contains evidence as described in the search warrant. When you seize the computer, you should:
If cluster #3552 entry in the FAT table contains a value of ?? this would mean:
The EnCase evidence file logical filename can be changed without affecting the verification of the acquired evidence.
The EnCase methodology dictates that ________ be created prior to acquiring evidence.
TESTED 02 May 2026