Guidance Software Certification Exam for EnCE Outside North America Sample Questions:

1. The first sector on a volume is called the:

A) Volume boot device
B) Master file table
C) Volume boot sector or record
D) Master boot record

2. In the EnCase environment, the term xternal viewers?is best described as: In the EnCase environment, the term ?xternal viewers?is best described as:

A) Any program that is loaded on the lab hard drive.
B) Programs that are exported out of an evidence file.
C) Any program that will work with EnCase.
D) Programsthat are associated with EnCase to open specific file types.

3. You are working in a computer forensic lab. A law enforcement investigator brings you a computer and a valid search warrant. You have legal authority to search the computer. The investigator hands you a piece of paper that has three printed checks on it. All three checks have the same check and account number. You image the suspect computer and open the evidence file with EnCase. You checks have the same check and account number. You image the suspect? computer and open the evidence file with EnCase. You perform a text search for the account number and check number. Nothing returns on the search results. You perform a text search for all other information found on the printed checks and there is still nothing returned in the search results. You run a signature analysis and check the gallery. You cannot locate any graphical copies of the printed checks in the gallery. At this point, is it safe to say that the checks are not located on the suspect computer? checks are not located on the suspect? computer?

A) No. The images could be located a compressed file.
B) No. The images could be in unallocated clusters.
C) No. The images could be embedded in a document.
D) All of the above.
E) No. The images could be in an image format not viewable inside EnCase.

4. Assume that an evidence file is added to a case, the case is saved, and the case is closed. What happens if the evidence file is moved, and the case is then opened?

A) EnCase asks for the location of the evidence file the next time the case is opened.
B) EnCase reports that the file integrity has been compromised and renders the file useless. EnCase reports that the file? integrity has been compromised and renders the file useless.
C) EnCase opens the case, excluding the moved evidence.
D) EnCase reports a different hash value for the evidence file.

5. A FAT directory has as a logical size of:

A) One cluster
B) 128 bytes
C) 64 bytes
D) 0 bytes

Solutions: