Spring Sale Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: pass65
marks4sure logo
Which of the following would be a true statement about the function of the BIOS?
Assume that MyNote.txt has been deleted. The FAT file system directory entry for that file has been overwritten. The data for MyNote.txt is now:
Using good forensic practices, when seizing a computer at a business running Windows 2000 Server you should:
The spool files that are created during a print job are __________ after the print job is completed.
The EnCase signature analysis is used to perform which of the following actions?
What information should be obtained from the BIOS during computer forensic investigations?
A restored floppy diskette will have the same hash value as the original diskette.
The EnCase methodology dictates that the lab drive for evidence have a __________ prior to making an image.
In Windows 98 and ME, Internet based e-mail, such as Hotmail, will most likely be recovered in the _____________________ folder.
The following keyword was typed in exactly as shown. Choose the answer(s) that would result. All search criteria have default settings. credit card
The case number in an evidence file can be changed without causing the verification feature to report an error, if:
When a non-compressed evidence file is reacquired with compression, the acquisition and verification hash values for the evidence will remain the same for both files.
You are working in a computer forensic lab. A law enforcement investigator brings you a computer and a valid search warrant. You have legal authority to search the computer. The investigator hands you a piece of paper that has three printed checks on it. All three checks have the same check and account number. You image the suspect's computer and open the evidence file with EnCase. You perform a text search for the account number and check number. Nothing returns on the search results. You perform a text search for all other information found on the printed checks and there is still nothing returned in the search results. You run a signature analysis and check the gallery. You cannot locate any graphical copies of the printed checks in the gallery. At this point, is it safe to say that the checks are not located on the suspect computer?
When undeleting a file in the FAT file system, EnCase will check the _____________ to see if it has already been overwritten.
If a hard drive is left in a room while acquiring, and several persons have access to that room, which of the following areas would be of most concern?
Assume that an evidence file is added to a case, the case is saved, and the case is closed. What happens if the evidence file is moved, and the case is then opened?
All investigators using EnCase should run tests on the evidence file acquisition and verification process to:
If cases are worked on a lab drive in a secure room, without any cleaning of the contents of the drive, which of the following areas would be of most concern?
A hard drive has been formatted as NTFS and Windows XP was installed. The user used fdisk to remove all partitions from that drive. Nothing else was done. You have imaged the drive and have opened the evidence file with EnCase. What would be the best way to examine this hard drive?
You are an investigator and have encountered a computer that is running at the home of a suspect. The computer does not appear to be a part of a network. The operating system is Windows XP Home. No programs are visibly running. You should:
Which of the following aspects of the EnCase evidence file can be changed during a reacquire of the evidence file?
The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. 800[) \-]+555-1212
How does EnCase verify that the evidence file contains an exact copy of the suspect hard drive?
An EnCase evidence file of a hard drive ________ be restored to another hard drive of equal or greater size.
You are investigating a case involving fraud. You seized a computer from a suspect who stated that the computer is not used by anyone other than himself. The computer has Windows 98 installed on the hard drive. You find the filename C:\downloads\check01.jpg that EnCase shows as being moved. The starting extent is 0C4057. You find another filename :\downloads\chk1.dll with the starting extent 0C4057, which EnCase also shows as being moved. In the C:\Windows\System folder you find an allocated file named chk1.dll with the starting extent 0C4057. The chk1.dll file is a JPEG image of a counterfeit check. What can be deduced from your findings?
A hard drive has 8 sectors per cluster. File Mystuff.doc has a logical file size of 13,000 bytes. How many clusters will be used by Mystuff.doc?
An evidence file can be moved to another directory without changing the file verification.
TESTED 02 May 2026