Certification Exam For ENCE North America v5.0

A signature analysis has been run on a case. The result "Bad Signature " means:

A standard DOS 6.22 boot disk is acceptable for booting a suspect drive.

When can an evidence file containing a NTFS partition be logically restored to a FAT 32 partition?

Which of the following selections would be used to keep track of a fragmented file in the
FAT file system?

What files are reconfigured or deleted by EnCase during the creation of an EnCase boot disk?

A signature analysis has been run on a case. The result ?*JPEG ?in the signature column means:

The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result.[\x00-\x05]\x00\x00?>[?[@?[?[?[

Which of the following items could contain digital evidence?

What information in a FAT file system directory entry refers to the location of a file on the hard drive?

The EnCase methodology dictates that ________ be created prior to acquiring evidence.

Select the appropriate name for the highlighted area of the binary numbers.

Which of the following is commonly used to encode e-mail attachments?

Select the appropriate name for the highlighted area of the binary numbers.

If cases are worked on a lab drive in a secure room, without any cleaning of the contents of the drive, which of the following areas would be of most concern?