GoConqr has a new look! Let us know what you think.

Sign up free

Quiz

EnCase

amandarackham 20 questions

Take the quiz

Questions in this quiz (20)

  1. 1You are a computer forensic examiner tasked with determining what evidence is on a seized computer. On what part of the computer system will you find data of evidentiary value?
    1. AMicroprocessor or CPU
    2. BUSB controller
    3. CHard drive
    4. DPCI expansion slots
  2. 2You are a computer forensic examiner explaining how computers store and access the data you recovered during your examination. The evidence is a log file and was recovered as an artifact of user activity on the ___________, which was stored on the ____________, contained within a _____________ on the media.
    1. APartition, operating system, file system.
    2. BOperating system, file system, partition.
    3. CFile system, operating system, hard drive.
    4. DOperating system, partition, file system.
  3. 3You are a computer forensic examiner investigating a seized computer. You recovered a document
    containing potential evidence. EnCase reports the file system on the forensic image of the
    hard drive is FAT (File Allocation Table). What information about the document file can be
    found in the FAT on the media? (Choose all that apply.)
    1. AName of the file
    2. BDate and time stamps of the file
    3. CStarting cluster of the file
    4. DFragmentation of the file
    5. EOwnership of the file
  4. 4You are a computer forensic examiner investigating media on a seized computer. You recovered
    a document containing potential evidence. EnCase reports the file system on the forensic image
    of the hard drive is NTFS (New Technology File System). What information about the document
    file can be found in the NTFS master file table on the media? (Choose all that apply.)
    1. AName of the file
    2. BDate and time stamps of the file
    3. CStarting cluster of the file
    4. DFragmentation of the file
    5. EOwnership of the file
  5. 5You are preparing to lead a team to serve a search warrant on a business suspected of committing
    large-scale consumer fraud. Ideally, you would you assign which tasks to search team members?
    (Choose all that apply.)
    1. APhotographer
    2. BSearch and seizure specialists
    3. CRecorder
    4. DDigital evidence search and seizure specialists
  6. 6You are a computer forensic examiner at a scene and have determined you will seize a Linux
    server, which according to your source of information, contains the database records for the
    company under investigation for fraud. What is the best practice for “taking down” the server
    for collection?
    1. APhotograph the screen and note any running programs or messages, etc., and use the normal
      shutdown procedure.
    2. BPhotograph the screen and note any running programs or messages, etc., and pull the plug
      from the wall.
    3. CPhotograph the screen and note any running programs or messages, etc., and pull the plug
      from the rear of the computer.
    4. DPhotograph the screen and note any running programs or messages, etc., and ask the user at
      the scene to shut down the server.
  7. 7You are a computer forensic examiner at a scene and are authorized to only seize media that can be
    determined to have evidence related to the investigation. What options do you have to determine
    whether evidence is present before seizure and a full forensic examination? (Choose all that apply.)
    1. AUse a DOS boot floppy or CD to boot the machine and browse through the directory for
      evidence.
    2. BUse an EnCase boot floppy or CD to boot the machine into Linux and use LinEn to preview
      the hard drive through a crossover cable with EnCase for Windows
    3. CRemove the subject hard drive from the machine and preview the hard drive in EnCase for
      Windows with a hardware write blocker like FastBloc.
    4. DUse an EnCase boot floppy or CD to boot the machine into DOS and use EnCase for DOS
      to preview the hard drive through a crossover cable with EnCase for Windows.
  8. 8You are a computer forensic examiner at a scene and have determined you will need to image
    a hard drive in a workstation while onsite. What are your options for creating a forensically
    sound image of the hard drive? (Choose all that apply.)
    1. AUse a DOS boot floppy or CD to boot the machine and use EnCase for DOS to image the
      subject hard drive to a second hard drive attached to the machine.
    2. BUse an EnCase boot floppy or CD to boot the machine into DOS and use EnCase for DOS
      to image the subject hard drive to a second hard drive attached to the machine.
    3. CRemove the subject hard drive from the machine and image the hard drive in EnCase for
      Windows with a hardware write blocker like FastBloc.
    4. DUse an EnCase boot floppy or CD to boot the machine into DOS and use EnCase for DOS
      to image the hard drive through a crossover cable with EnCase for Windows.
  9. 9You are a computer forensic examiner and have imaged a hard drive on site. Before you leave
    the scene, you want to ensure the image completely verifies as an exact forensic duplicate of the
    original. To verify the EnCase evidence file containing the image, you should:
    1. AUse a hex editor to compare a sample of sectors in the EnCase evidence file with that of the
      original.
    2. BLoad the EnCase evidence files into EnCase for Windows, and after the verification is more
      than halfway completed, cancel the verification and spot-check the results for errors.
    3. CLoad the EnCase evidence files into EnCase for DOS and verify the hash of those files.
    4. DLoad the EnCase evidence files into EnCase for Windows, allow the verification process to
      finish, and then check the results for complete verification.
  10. 10You are a computer forensic examiner and need to verify the integrity of an EnCase evidence file.
    To completely verify the file’s integrity, which of the following must be true?
    1. AThe MD5 hash value must verify.
    2. BThe CRC values and the MD5 hash value both must verify.
    3. CEither the CRC or MD5 hash values must verify.
    4. DThe CRC values must verify.

Information

Description
EnCase computer security fundimentals quiz
Language
English
Views
816
Rating
No ratings yet
Rate this quiz
Rate this quiz

Feedback

What is it about?

What do you think of the new look?

How do you like it?