A logical file would be best described as:
Answer : A
When a document is printed using EMF in Windows, what file(s) are generated in the spooling process?
Answer : C
A personal data assistant was placed in a evidence locker until an examiner has time to examine it. Which of the following areas would require special attention?
Answer : B
The end of a logical file to the end of the cluster that the file ends in is called:
Answer : D
You are at an incident scene and determine that a computer contains evidence as described in the search warrant. When you seize the computer, you should:
Answer : A,B,C
In Unicode, one printed character is composed of ____ bytes of data.
Answer : B
This question addresses the EnCase for Windows search process. If a target word is within a logical file, and it begins in cluster 10 and ends in cluster 15 (the word is fragmented), the search:
Answer : C
If a hash analysis is run on a case, EnCase:
Answer : C
EnCase uses the _________________ to conduct a signature analysis.
Answer : A
Assume that MyNote.txt has been deleted. The FAT file system directory entry for that file has been overwritten. The data for MyNote.txt is now:
Answer : C
How many partitions can be found in the boot partition table found at the beginning of the drive?
Answer : B
Using good forensic practices, when seizing a computer at a business running Windows
2000 Server you should:
Answer : A
This question addresses the EnCase for Windows search process. If a target word is located in the unallocated space, and the word is fragmented between clusters 10 and 15, the search:
Answer : A
Assume that an evidence file is added to a case, the case is saved, and the case is closed.
What happens if the evidence file is moved, and the case is then opened?
Answer : C