EnCase Certified Examiner (EnCE) Certification Exam — Questions and Answers

Question 1: Which authentication factor is classified as "something you are"?

Password
Security token
Smart card
Biometric data (Correct answer)

Correct answer: Biometric data

Biometric data such as fingerprints, facial recognition, or retinal scans represents the "something you are" authentication factor.

Question 2: What is the key to effective cross-functional communication in EnCE environments?

Communicating only in writing
Avoiding all technical details
Adapting language and context for different audiences (Correct answer)
Using department-specific jargon

Correct answer: Adapting language and context for different audiences

Adapting language and providing appropriate context for different audiences ensures effective communication across functional boundaries.

Question 3: What is the forensic significance of the 'Bcc:' (Blind Carbon Copy) field?

It is always visible in recovered email headers
BCC prevents the email from being logged by mail servers
BCC fields are encrypted by default in all email protocols
BCC recipients are hidden from other recipients but may appear in the sender's sent copy or server logs (Correct answer)

Correct answer: BCC recipients are hidden from other recipients but may appear in the sender's sent copy or server logs

BCC recipients are stripped from the message headers before delivery, but the sender's sent folder copy and server logs may retain the original BCC list.

Question 4: An EnCase report includes output from the Physical Disk Emulator (PDE). What should the examiner document about this process?

Only that the image was verified before PDE use
PDE use does not need to be documented as it is read-only
That PDE was used to boot the image, the write-block protections in place, and any changes that may have occurred to volatile data (Correct answer)
That the original drive was powered on for examination

Correct answer: That PDE was used to boot the image, the write-block protections in place, and any changes that may have occurred to volatile data

Booting a forensic image via PDE can alter volatile artifacts like event logs or swap files, so the report must document write-block protections used and acknowledge any potential changes introduced.

Question 5: Firefox's 'sessionstore.jsonlz4' file is forensically significant because it contains:

Browser extension configuration and permissions
All stored login credentials for visited sites
The complete download history of the browser
Tabs and windows open during the last browser session, including URLs and scroll positions (Correct answer)

Correct answer: Tabs and windows open during the last browser session, including URLs and scroll positions

sessionstore.jsonlz4 preserves the state of the last browser session including open tabs, URLs, and form data, which may capture activity not yet written to history.

Question 6: What is the MOST important reason for EnCase Certified Examiner professionals to maintain continuing education?

To stay current with evolving standards, practices, and regulations (Correct answer)
To increase billing rates
To accumulate credentials for personal prestige
To satisfy employer preferences

Correct answer: To stay current with evolving standards, practices, and regulations

Continuing education ensures professionals remain current with evolving industry standards, best practices, and regulatory requirements. This directly impacts the quality of service provided and maintains public trust in the profession.

Question 7: Which statement BEST describes the relationship between EnCase Certified Examiner certification requirements and industry evolution?

Requirements become less stringent over time
Certification requirements never change once established
Changes only occur when government mandates new requirements
Requirements evolve periodically to reflect advances in knowledge, technology, and practice standards (Correct answer)

Correct answer: Requirements evolve periodically to reflect advances in knowledge, technology, and practice standards

Certification requirements evolve to keep pace with advances in professional knowledge, technological developments, and changes in practice standards. This ensures that certified professionals remain current and competent in a changing professional landscape.

Question 8: Why is bit-stream imaging used?

Shrink files
Improve graphics
Install patches
Clone exact drive contents (Correct answer)

Correct answer: Clone exact drive contents

Bit-stream imaging, also known as forensic imaging or disk cloning, creates an exact, sector-by-sector copy of an entire storage device, including active files, deleted files, and unallocated space. This comprehensive replication ensures that no potential evidence is missed and preserves the original state of the media for thorough analysis.

Question 9: What is the examiner's obligation when a peer review of the forensic report identifies a factual error before the report is submitted to court?

Proceed with the original report to maintain timeline integrity
Correct the error, document the revision, and submit the corrected report with a revision history (Correct answer)
Submit the original report and disclose the error verbally during testimony
Notify only the retaining attorney and let them decide

Correct answer: Correct the error, document the revision, and submit the corrected report with a revision history

Any identified error must be corrected before submission, and a revision history should document what changed and why to maintain transparency and professional integrity.

Question 10: What is the recommended approach for handling errors in encase software?

Suppress all error messages
Let errors crash the application
Log errors but never handle them
Implement structured error handling with meaningful messages (Correct answer)

Correct answer: Implement structured error handling with meaningful messages

Structured error handling with meaningful messages helps diagnose problems quickly while maintaining application stability and user experience.

Question 11: How can time stamps be manipulated?

Use timestamp editing tools (Correct answer)
Increase brightness
Log out of accounts
Delete wallpaper

Correct answer: Use timestamp editing tools

Timestamps, which record file creation, modification, and access times, are critical metadata in digital forensics. These values can be deliberately altered using specialized timestamp editing tools, potentially to obscure malicious activity or create a misleading timeline. Forensic examiners must be aware of this possibility and employ techniques to detect such manipulation, as it can significantly impact an investigation.

Question 12: Which protocol is used to dynamically assign IP addresses to hosts on a network, and what forensic value do its logs hold?

DNS; they reveal domain resolution history
SNMP; they provide device configuration data
DHCP; they map IP addresses to MAC addresses and hostnames over time (Correct answer)
BGP; they reveal routing table changes

Correct answer: DHCP; they map IP addresses to MAC addresses and hostnames over time

DHCP logs record lease assignments, linking IP addresses to specific MAC addresses and hostnames, which is critical for attributing network activity to a specific device.

Question 13: Which element is essential in a well-written EnCE professional report?

Ambiguous conclusions
Objective findings supported by data (Correct answer)
Personal opinions without evidence
Emotional language

Correct answer: Objective findings supported by data

Professional reports require objective findings supported by verifiable data to maintain credibility and support sound decision-making.

Question 14: Which legal concept permits investigators to expand the scope of a digital search when contraband is found incidentally during a lawfully scoped search?

Exigent circumstances
Good faith exception
Plain view doctrine (Correct answer)
Inevitable discovery

Correct answer: Plain view doctrine

The plain view doctrine allows seizure of incidentally discovered evidence when the officer is lawfully present and the incriminating nature is immediately apparent.

Question 15: When using EnCase's remote acquisition feature, what software must be running on the target machine?

EnCase Enterprise Agent (servlet) (Correct answer)
EnCase Examiner Desktop
EnScript Daemon
SAFE Authentication Server

Correct answer: EnCase Enterprise Agent (servlet)

The EnCase Enterprise Agent (servlet) must be deployed and running on the target endpoint to enable remote acquisition and analysis.

Question 16: Which principle requires that digital forensic examiners document their methods so completely that another qualified examiner could reproduce the same results?

Reproducibility (Correct answer)
Peer review
Non-repudiation
Chain of custody

Correct answer: Reproducibility

Reproducibility is a foundational scientific principle requiring that forensic methods be documented well enough for another examiner to obtain the same results independently.

Question 17: An examiner acquires a forensic image and the MD5 hash of the image does not match the hash taken at acquisition. What does this indicate?

The image file has been altered or is corrupt (Correct answer)
MD5 is no longer a valid hashing algorithm
The source drive has bad sectors
The acquisition software has a bug

Correct answer: The image file has been altered or is corrupt

A hash mismatch between acquisition and verification indicates the image data has changed, meaning it was altered or became corrupt.

Question 18: What distinguishes a EnCase Certified Examiner certified professional from a non-certified practitioner?

Certification validates competency through standardized assessment against established benchmarks (Correct answer)
There is no meaningful difference in competency
Certified professionals exclusively work in larger organizations
Certified professionals always have more years of experience

Correct answer: Certification validates competency through standardized assessment against established benchmarks

Certification provides objective validation of competency through standardized assessment. While non-certified practitioners may be skilled, certification offers verified evidence that a professional meets established benchmarks for knowledge and performance.

Question 19: Why is hashing used during evidence collection?

Add encryption
Resize images
Verify data integrity (Correct answer)
Modify timestamps

Correct answer: Verify data integrity

Hashing, specifically using algorithms like MD5 or SHA-1/SHA-256, generates a unique digital fingerprint for a set of data. During evidence collection, a hash of the original media is taken before and after acquisition to mathematically prove that the acquired image is an exact, unaltered copy of the original. This process verifies data integrity and ensures evidence admissibility.

Question 20: How does the EnCE body of knowledge relate to daily professional practice?

It provides the foundational framework that guides decision-making and standard practices (Correct answer)
It only applies during certification exams
It is relevant only for academic research
It is theoretical and has limited practical application

Correct answer: It provides the foundational framework that guides decision-making and standard practices

The body of knowledge provides the foundational framework of principles, standards, and best practices that professionals use to guide their daily decision-making, ensure consistent quality, and maintain alignment with industry standards.

Question 21: What type of investigations is EnCase commonly used in?

Interior design
Event planning
Digital forensic investigations (Correct answer)
Real estate

Correct answer: Digital forensic investigations

EnCase is a specialized software suite designed for digital forensics. It provides comprehensive tools for acquiring, analyzing, and reporting on electronic evidence from various sources. This makes it an indispensable tool for investigations involving cybercrime, corporate espionage, and legal discovery.

Question 22: When EnCase performs an 'Index Search,' what advantage does it provide over a standard keyword search?

Pre-built word indexes allow near-instantaneous searches across large evidence sets without rescanning every byte (Correct answer)
Index searches hash every search result for automated court submission
Index searches automatically translate keywords into 14 languages simultaneously
Index searches bypass write blockers for faster direct sector access

Correct answer: Pre-built word indexes allow near-instantaneous searches across large evidence sets without rescanning every byte

Creating an index during EnCase processing builds a word-level lookup table, allowing subsequent keyword searches to return results almost instantly rather than linearly scanning the entire evidence image.

Question 23: In EnCase, what is the difference between a 'Physical Disk' view and a 'Logical Volume' view when examining evidence?

Physical Disk view shows raw sectors including partition gaps and unpartitioned space; Logical Volume view shows the file system structure within a partition (Correct answer)
Physical Disk view requires write-blocker hardware; Logical Volume view can be accessed without one
Physical Disk view is for HDDs only; Logical Volume view supports SSDs and flash media
Physical Disk view shows only deleted files; Logical Volume view shows only active files

Correct answer: Physical Disk view shows raw sectors including partition gaps and unpartitioned space; Logical Volume view shows the file system structure within a partition

The Physical Disk view in EnCase exposes every sector of the drive including areas outside partitions, while the Logical Volume view presents the interpreted file system structure within a specific partition.

Question 24: What is the legal effect of 'spoliation' of evidence in a civil proceeding?

Exclusion of all other evidence submitted by that party
Automatic dismissal of the case
Criminal charges against the responsible party
An adverse inference instruction or sanctions against the spoliating party (Correct answer)

Correct answer: An adverse inference instruction or sanctions against the spoliating party

Courts typically respond to spoliation with sanctions such as adverse inference jury instructions, monetary penalties, or case dismissal in severe cases.

Question 25: In EnCase, what is stored in the 'case file' (.case extension)?

The raw forensic image data
Metadata about the case including evidence paths, bookmarks, tags, and search results (Correct answer)
The EnScript source code used during examination
Encrypted copies of all examined files

Correct answer: Metadata about the case including evidence paths, bookmarks, tags, and search results

The .case file is a metadata container storing case configuration, evidence references, bookmarks, tags, and analysis results — not the actual evidence data.

Question 26: What is volatile data?

Stored backup
Archived files
Temporary system data (Correct answer)
Hard drive info

Correct answer: Temporary system data

Volatile data refers to information that is temporary and exists only while a computer system is running, such as RAM contents, running processes, network connections, and logged-in users. This data is lost when the system is powered off or rebooted, making its immediate acquisition crucial in live forensic investigations.

Question 27: What is the purpose of an 'Appendix' in a comprehensive forensic report?

To list the opposing expert's weaknesses
To repeat the executive summary in technical language
To summarize the report for non-technical readers
To provide supplementary technical data, tool outputs, and detailed tables that support but do not clutter the main narrative (Correct answer)

Correct answer: To provide supplementary technical data, tool outputs, and detailed tables that support but do not clutter the main narrative

Appendices house detailed supporting data such as full file listings, hash logs, and tool output reports that substantiate findings without disrupting the main report's readability.

Question 28: What does the term 'chain of custody' mean in digital forensics, and how does EnCase support it?

The hierarchical folder structure within an EnCase case file
The documented, unbroken record of who handled evidence and when, supported by EnCase's case notes and audit logs (Correct answer)
A method of linking related files across multiple evidence items using hash values
A network chain used to transmit evidence securely between agencies

Correct answer: The documented, unbroken record of who handled evidence and when, supported by EnCase's case notes and audit logs

Chain of custody is the chronological, documented record tracking who accessed or handled evidence; EnCase supports this through case notes, examiner identifiers recorded in evidence files, and detailed audit logs.

Question 29: Which EnCase report format is best suited for sharing findings with non-technical stakeholders who need a readable document?

CSV
HTML (Correct answer)
XML
TSV

Correct answer: HTML

HTML reports in EnCase produce formatted, human-readable documents suitable for non-technical audiences and court presentation.

Question 30: In an EnCE-level forensic report, how should an examiner handle evidence that is exculpatory (favorable to the subject)?

Omit it to simplify the report
Include all exculpatory findings with the same rigor as inculpatory findings (Correct answer)
Include it only if requested by the defense
Mention it only in a verbal briefing to the attorney

Correct answer: Include all exculpatory findings with the same rigor as inculpatory findings

Professional forensic examiners must report all material findings including exculpatory evidence with equal rigor, as withholding such evidence is unethical and potentially unlawful.

Question 31: In NTFS, which data structure stores the location and attributes of every file and folder on the volume?

File Allocation Table
Volume Boot Record
Index Allocation Buffer
Master File Table (Correct answer)

Correct answer: Master File Table

The Master File Table (MFT) is the core NTFS structure containing a record for every file and directory, including their attributes and data run locations.

Question 32: What does the EnCase 'Blue Ribbon' icon on a file indicate?

The file has been selected as part of an active search hit
The file is encrypted and cannot be read
The file has been bookmarked for review (Correct answer)
The file is a system-protected operating file

Correct answer: The file has been bookmarked for review

A blue ribbon (bookmark flag) in EnCase indicates that the examiner has bookmarked that item for later reference or inclusion in a report.

Question 33: An examiner finds a file named 'WebCacheV01.dat' on a Windows 10 system. Which browser's cache data does this file contain?

Mozilla Firefox
Internet Explorer / Edge Legacy (Correct answer)
Opera
Google Chrome

Correct answer: Internet Explorer / Edge Legacy

WebCacheV01.dat is an Extensible Storage Engine (ESE) database used by Internet Explorer and legacy Microsoft Edge to store cached web content and history.

Question 34: A forensic report references an email extracted using EnCase. Which metadata fields are most critical to include for evidentiary completeness?

Only the email body text
The email client version and operating system
Sender, recipient, timestamp, message-ID, and path to the evidence container (Correct answer)
Subject line and attachment names only

Correct answer: Sender, recipient, timestamp, message-ID, and path to the evidence container

Complete email documentation requires sender, recipient, timestamp, message-ID for authenticity, and the precise path within the forensic image where the artifact was located.

Question 35: In an EnCase forensic report, what is the primary purpose of including a 'Limitations' section?

To reduce the examiner's legal liability
To list all software versions used
To document scope restrictions, tool constraints, and conditions that may affect findings (Correct answer)
To excuse investigator errors

Correct answer: To document scope restrictions, tool constraints, and conditions that may affect findings

A Limitations section transparently discloses scope restrictions, tool constraints, and environmental conditions that could affect the completeness or interpretation of findings.

Question 36: Which risk management approach is MOST effective for EnCE professionals when evaluating potential workplace hazards?

Proactive hazard identification and assessment (Correct answer)
Delegating all safety decisions to management
Reactive analysis after incidents occur
Relying solely on historical accident data

Correct answer: Proactive hazard identification and assessment

Proactive hazard identification and assessment allows professionals to identify and mitigate risks before incidents occur, which is far more effective than reactive approaches that only address problems after they happen.

Question 37: When referencing EnCase bookmarks in a formal report, the examiner should ensure that:

Bookmarks are deleted after the report is finalized
Bookmarks are only used in internal notes, never in court reports
Bookmark descriptions are written by legal counsel
Each bookmark reference corresponds to a verifiable location within the acquired evidence file (Correct answer)

Correct answer: Each bookmark reference corresponds to a verifiable location within the acquired evidence file

Every bookmark referenced in the report must map to a verifiable, reproducible location within the forensic image so opposing counsel or another examiner can independently verify the finding.

Question 38: An examiner finds evidence of EnCase's EnScript automation was used to process the evidence. What should the report document about this?

EnScripts are not admissible as part of forensic methodology
The specific EnScript used, its version, and its purpose in the examination (Correct answer)
Only the final output of the EnScript
EnScript runs are proprietary and need not be disclosed

Correct answer: The specific EnScript used, its version, and its purpose in the examination

Any automated tool or script used in the examination must be documented, including its name, version, and purpose, to allow peer review and challenge of the methodology.

Question 39: In EnCase, what is the primary purpose of the 'Conditions' feature?

To filter and display files matching specific criteria during analysis (Correct answer)
To schedule automated backups of case data
To create encrypted containers for sensitive data
To set password protection on evidence files

Correct answer: To filter and display files matching specific criteria during analysis

EnCase Conditions act as filters that allow examiners to display only files meeting specified criteria, such as file type, date range, or size.

Question 40: Which EnCase feature specifically helps identify when a file was last accessed, modified, or created using NTFS metadata?

MACE timestamps displayed in the file's attributes (Correct answer)
Keyword search across MFT entries
Evidence Processor hash set comparison
Snapshot volatile capture

Correct answer: MACE timestamps displayed in the file's attributes

EnCase surfaces MACE timestamps (Modified, Accessed, Created, Entry Modified) from NTFS MFT records, which are critical for timeline analysis.

Question 41: During EnCase evidence processing, what is the function of 'hash analysis' in relation to the NSRL?

It rebuilds deleted files from unallocated space
It identifies files that are known good or known bad by comparing hashes to the NSRL database (Correct answer)
It verifies the integrity of the EnCase application itself
It encrypts evidence files for secure storage

Correct answer: It identifies files that are known good or known bad by comparing hashes to the NSRL database

Hash analysis compares file hashes against the National Software Reference Library (NSRL) to flag known operating system or application files, allowing examiners to focus on potentially relevant user data.

Question 42: An examiner needs to acquire a drive that is larger than the destination media. What is the best approach?

Use compression in EnCase to reduce the image size
Skip unallocated space to reduce image size
Acquire only the active partitions
Use multiple destination drives with segmented image files (Correct answer)

Correct answer: Use multiple destination drives with segmented image files

EnCase supports spanning a forensic image across multiple destination drives using segmented E01 files when the source exceeds destination capacity.

Question 43: Which of the following volatile data items has the HIGHEST order of volatility and should be collected first?

System time and clock skew
CPU registers and cache (Correct answer)
Contents of pagefile.sys
Temporary file system data

Correct answer: CPU registers and cache

CPU registers and cache have the highest order of volatility per RFC 3227 guidelines and change constantly, requiring collection before any other volatile data.

Question 44: Which authentication factor is classified as "something you are"?

Password
Smart card
Biometric data (Correct answer)
Security token

Correct answer: Biometric data

Biometric data such as fingerprints, facial recognition, or retinal scans represents the "something you are" authentication factor.

Question 45: What is the PRIMARY ethical obligation of a certified EnCase Certified Examiner professional regarding confidential information?

Use it to advance career opportunities
Share it with colleagues who might benefit
Protect it from unauthorized disclosure at all times (Correct answer)
Discuss it informally during professional networking

Correct answer: Protect it from unauthorized disclosure at all times

Confidentiality is a fundamental ethical obligation. Certified professionals must protect confidential information from unauthorized disclosure, regardless of circumstances. Breach of confidentiality can result in loss of certification and legal liability.

Question 46: What tool does EnCase use for acquiring images?

EnCase Imager (Correct answer)
Command Prompt
Disk Cleaner
Paint

Correct answer: EnCase Imager

EnCase Imager is a dedicated, standalone tool provided by Guidance Software (now OpenText) specifically for creating forensic images of digital media. It allows investigators to perform bit-stream acquisitions of hard drives, solid-state drives, and other storage devices. This ensures data integrity through hashing and write-blocking capabilities.

Question 47: What documentation is MOST critical to maintain for safety compliance in the EnCase Certified Examiner field?

Incident reports, training records, and inspection logs (Correct answer)
Employee vacation schedules
Client marketing preferences
Annual revenue reports

Correct answer: Incident reports, training records, and inspection logs

Incident reports, training records, and inspection logs are essential safety documentation. They demonstrate compliance with safety regulations, track training completion, and provide evidence of systematic hazard management.

Question 48: When an EnCase examiner writes conclusions in a forensic report, what standard of language is most appropriate?

Qualified statements reflecting the weight of evidence (e.g., 'consistent with', 'indicates', 'suggests') (Correct answer)
Vague language to avoid being challenged on cross-examination
Absolute certainty statements to project confidence to the jury
Legal conclusions about guilt or innocence

Correct answer: Qualified statements reflecting the weight of evidence (e.g., 'consistent with', 'indicates', 'suggests')

Forensic conclusions should use qualified, evidence-based language that accurately reflects the strength of the findings without overclaiming or misrepresenting certainty.

Question 49: Which EnCase acquisition format stores the image in multiple segments with embedded hash verification?

EnCase Evidence File (E01) (Correct answer)
ISO format
AFF format
RAW/DD format

Correct answer: EnCase Evidence File (E01)

The E01 (Expert Witness Format) stores the forensic image in compressed, segmented files with embedded CRC and MD5 hash values.

Question 50: When examining a deleted email in an EnCase PST analysis, what does 'soft delete' mean?

The email was permanently wiped with DoD standards
The email was archived to a separate PST
The email's header was zeroed out but the body remains
The email is moved to the Deleted Items folder but still recoverable (Correct answer)

Correct answer: The email is moved to the Deleted Items folder but still recoverable

A soft delete in Outlook moves the message to the Deleted Items folder; the data is retained and fully recoverable until the folder is emptied.

Question 51: During an EnCase investigation, you find an OST file. What does this indicate about the user's email setup?

The user used Lotus Notes for email
The PST file is corrupted and converted to OST
Outlook was configured in Cached Exchange Mode connected to an Exchange server (Correct answer)
The user only accessed email via webmail

Correct answer: Outlook was configured in Cached Exchange Mode connected to an Exchange server

An OST (Offline Storage Table) file is created when Outlook is configured in Cached Exchange Mode, storing a local synchronized copy of the Exchange mailbox.

Question 52: Which statement BEST describes the relationship between EnCase Certified Examiner certification requirements and industry evolution?

Requirements evolve periodically to reflect advances in knowledge, technology, and practice standards (Correct answer)
Certification requirements never change once established
Changes only occur when government mandates new requirements
Requirements become less stringent over time

Correct answer: Requirements evolve periodically to reflect advances in knowledge, technology, and practice standards

Question 53: When reporting on deleted file recovery using EnCase, the examiner should note that recovery success depends on:

Whether antivirus software was installed
The age of the suspect's operating system
The suspect's cooperation during investigation
Whether the clusters previously occupied by the file have been overwritten since deletion (Correct answer)

Correct answer: Whether the clusters previously occupied by the file have been overwritten since deletion

Deleted file recovery depends on whether the file's allocated clusters have been reused by new data; if overwritten, the original content is unrecoverable.

Question 54: In EnCase, what does examining the 'Volume Shadow Copies' (VSS) on a Windows image potentially reveal to a forensic examiner?

Metadata about all USB devices ever connected to the system
A log of all user login attempts including failed passwords
The system's BitLocker recovery keys stored in plaintext
Previous versions of files and system states from before deletion or modification events (Correct answer)

Correct answer: Previous versions of files and system states from before deletion or modification events

Volume Shadow Copies (VSS) are point-in-time snapshots of the file system created by Windows; EnCase can mount and examine these to find earlier versions of files that were subsequently deleted or modified by a subject.

Question 55: What is the significance of a 'Daubert' hearing in the context of digital forensic testimony?

It establishes the chain of custody for digital evidence
It is a hearing to suppress unlawfully obtained evidence
It determines whether a witness can plead the Fifth Amendment
It is a pre-trial hearing where a judge evaluates whether expert testimony meets scientific reliability standards (Correct answer)

Correct answer: It is a pre-trial hearing where a judge evaluates whether expert testimony meets scientific reliability standards

Under Daubert v. Merrell Dow Pharmaceuticals, federal judges act as gatekeepers to assess whether expert testimony is based on sufficient facts and reliable methodology.

Question 56: In EnCase, what is the purpose of 'Bookmarks' and how are they typically used in a forensic examination?

Bookmarks allow examiners to flag and annotate specific items of interest for inclusion in reports and presentations (Correct answer)
Bookmarks permanently delete files from the evidence image to save processing time
Bookmarks create a write-protected copy of selected files for independent verification
Bookmarks encrypt selected files with a password for secure handoff to prosecutors

Correct answer: Bookmarks allow examiners to flag and annotate specific items of interest for inclusion in reports and presentations

Bookmarks in EnCase let examiners tag items of evidentiary interest with notes or annotations, organizing findings for report generation and courtroom presentation.

Question 57: An examiner uses EnCase to examine a Windows system and needs to find evidence of email accessed via a web-based client. Which artifact location is MOST relevant?

Microsoft Outlook PST files
Exchange Server transaction logs
Browser cache and cookies directories for the webmail domain (Correct answer)
Windows Mail application data folder

Correct answer: Browser cache and cookies directories for the webmail domain

Webmail is accessed through the browser, so evidence resides in browser cache, cookies, and history files associated with the webmail provider's domain.

Question 58: When using EnCase to analyze a FAT32 volume, which structure would the examiner examine to find file entries for deleted files?

Volume Boot Record
Partition Table
Master File Table (MFT)
Directory entries with 0xE5 as the first byte (Correct answer)

Correct answer: Directory entries with 0xE5 as the first byte

In FAT32, deleted file directory entries have their first byte set to 0xE5, preserving the remaining filename and cluster chain information for potential recovery.

Question 59: Which scenario represents a violation of the EnCase Certified Examiner code of professional conduct?

Seeking continuing education beyond minimum requirements
Misrepresenting qualifications or certification status (Correct answer)
Declining work outside one's area of competence
Reporting safety concerns to regulatory authorities

Correct answer: Misrepresenting qualifications or certification status

Misrepresenting qualifications or certification status is a serious violation of professional conduct. It undermines public trust and can lead to harm when unqualified individuals perform specialized work.

Question 60: What is the primary consideration when implementing changes to network forensics?

Personal convenience
Speed of implementation
Vendor preference
Impact assessment and change management (Correct answer)

Correct answer: Impact assessment and change management

Impact assessment and proper change management ensure that modifications do not introduce unexpected problems or service disruptions.

Question 61: What is the most important professional competency for EnCE certification in registry analysis?

Speed of task completion
Deep knowledge combined with practical application skills (Correct answer)
Memorization of all reference materials
Ability to work alone exclusively

Correct answer: Deep knowledge combined with practical application skills

Professional competency requires both deep knowledge of the subject matter and the ability to apply that knowledge in practical situations.

Question 62: Which registry key path contains the Windows installation date stored as a Unix epoch timestamp?

HKCU\Software\Microsoft\Windows NT\CurrentVersion
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion (Correct answer)

Correct answer: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion contains InstallDate (Unix timestamp), RegisteredOwner, ProductName, and build information.

Question 63: When EnCase identifies Internet history artifacts in a forensic investigation, how should the examiner represent browser cache data in the report?

As confirmed user visits with timestamps
As proof of deliberate user intent to visit the site
As deleted data with no probative value
As artifacts recovered from cache with a note that cache population can be automated (Correct answer)

Correct answer: As artifacts recovered from cache with a note that cache population can be automated

Browser cache can be populated automatically by background processes, email links, or pre-fetching, so the report must distinguish recovered cache artifacts from deliberate user navigation.

Question 64: Which protocol operates at the transport layer and provides connectionless, unreliable datagram delivery often used in DNS and streaming media?

ARP
ICMP
UDP (Correct answer)
TCP

Correct answer: UDP

UDP (User Datagram Protocol) is connectionless and does not guarantee delivery, making it suitable for DNS queries and real-time media streaming.

Question 65: What does 'chain of custody' documentation in a forensic report establish?

The suspect's criminal history
The chronological transfer, possession, and handling of evidence items (Correct answer)
The list of all investigators on the case
The tool versions used during examination

Correct answer: The chronological transfer, possession, and handling of evidence items

Chain of custody documents the chronological record of who possessed, transferred, and handled evidence to demonstrate that it was not altered or tampered with.

Question 66: During mobile forensics, what does the term 'JTAG acquisition' refer to?

A cloud-based extraction of device backups from a vendor server
A chip-off method requiring physical removal of the NAND chip
A logical pull of app data via the device's USB debugging mode
A hardware-level technique using test access ports to read raw flash memory (Correct answer)

Correct answer: A hardware-level technique using test access ports to read raw flash memory

JTAG acquisition uses the device's Joint Test Action Group (JTAG) test access ports to read raw memory contents without chip removal.

Question 67: An examiner is acquiring a virtual machine (VM). Which approach best preserves all forensic artifacts?

Acquire only the VM configuration file
Log into the VM and use network acquisition tools
Power off the VM and image only the VMDK file
Capture a snapshot, then acquire the VMDK, memory, and snapshot files (Correct answer)

Correct answer: Capture a snapshot, then acquire the VMDK, memory, and snapshot files

Capturing the VM snapshot along with VMDK and memory files preserves the full system state, including running processes and open network connections.

Question 68: What is the EnScript feature used for?

Gaming controls
Drawing tools
Generating graphics
Automating forensic processes (Correct answer)

Correct answer: Automating forensic processes

EnScript is a powerful scripting language integrated within EnCase software. Its primary use is to automate complex or repetitive forensic processes, such as searching for specific file types, carving data, or generating custom reports. By leveraging EnScript, forensic examiners can significantly enhance efficiency, consistency, and thoroughness in their investigations.

Question 69: Which EnCase feature is specifically designed to identify and recover JPEG images from unallocated space based on file headers and footers?

File Carving (via EnCase or GREP-based carver) (Correct answer)
Hash Analysis
Signature Analysis
Link File Parsing

Correct answer: File Carving (via EnCase or GREP-based carver)

File carving searches unallocated space for known file headers (e.g., FFD8FF for JPEG) and footers (FFD9) to reconstruct files even when no file system metadata exists, and EnCase supports this both natively and through EnScripts.

Question 70: In network forensics, what does the term 'packet carving' refer to?

Reconstructing files or data streams from raw packet captures (Correct answer)
Encrypting captured packets for secure storage
Deleting irrelevant packets from a PCAP file
Physically extracting network cables from a crime scene

Correct answer: Reconstructing files or data streams from raw packet captures

Packet carving is the process of reconstructing files, sessions, or data streams from raw packet capture (PCAP) data.

Question 71: Which EnCase feature allows an examiner to parse SQLite databases found on an Android device without exporting them?

Physical Disk Emulator
EnScript with SQLite library (Correct answer)
Logical Evidence File viewer
Evidence Processor

Correct answer: EnScript with SQLite library

EnScript provides a built-in SQLite library that can parse SQLite database files directly from within the case.

Question 72: On an exFAT volume, which structure replaces the traditional FAT directory entry to store file metadata?

MFT Record
Volume Descriptor
Inode table
Directory Entry Set with File and Stream Extension entries (Correct answer)

Correct answer: Directory Entry Set with File and Stream Extension entries

exFAT uses a Directory Entry Set consisting of a File entry, Stream Extension entry, and File Name entry to store metadata that would occupy a single FAT32 directory entry.

Question 73: What does hashing help verify in EnCase?

Data integrity (Correct answer)
Battery life
Color scheme
Compression ratio

Correct answer: Data integrity

Hashing is a critical process in digital forensics, and in EnCase, it helps verify data integrity. A hash function generates a unique fixed-size string of characters (a hash value) for a given set of data. If even a single bit of the data changes, the hash value will be completely different, thus proving whether the evidence has been altered or remains in its original state since acquisition.

Question 74: Which timestamp does NTFS maintain that records the last time a file's MFT entry itself was modified (distinct from file content changes)?

Last Accessed ($STDINFO)
Created ($STDINFO)
Entry Modified ($STDINFO) (Correct answer)
Last Written ($STDINFO)

Correct answer: Entry Modified ($STDINFO)

NTFS tracks four timestamps per file: Created, Last Written, Last Accessed, and Entry Modified ($MTIME in $STANDARD_INFORMATION); Entry Modified records when the MFT record itself was last changed, which differs from when the file's content changed.

Question 75: An examiner uses EnCase to recover fragmented files from unallocated space. How should these recovered files be characterized in the report?

As files with confirmed ownership by the suspect
As potentially incomplete fragments whose content may be partial or mixed with other data (Correct answer)
As securely deleted files that cannot be used as evidence
As fully intact files with guaranteed content accuracy

Correct answer: As potentially incomplete fragments whose content may be partial or mixed with other data

Fragmented files recovered from unallocated space may be incomplete or contain overwritten segments, and the report must accurately convey this uncertainty about their completeness.

Question 76: What encoding method obfuscates the program paths and GUIDs stored in the UserAssist registry key?

XOR with a static key
Base64 encoding
ROT13 cipher (Correct answer)
MD5 hashing

Correct answer: ROT13 cipher

UserAssist program paths are encoded with ROT13, a simple Caesar cipher shifting each letter by 13 positions, which is trivially reversible.

Question 77: What is the 'inode' change time (ctime) in Linux Ext4, and how does it differ from the modification time (mtime)?

ctime is set at creation only; mtime is updated on every access
ctime records when the inode metadata last changed; mtime records when file content was last written (Correct answer)
ctime records when file content was last read; mtime records last write
ctime and mtime are identical in Ext4

Correct answer: ctime records when the inode metadata last changed; mtime records when file content was last written

In Ext4, mtime reflects the last write to file data content, while ctime reflects the last change to inode metadata (permissions, ownership, link count, etc.).

Question 78: An examiner using EnCase notices a file's logical size is 1 KB but its physical size shows 4 KB. This difference represents:

Compression applied by the file system
An error in the EnCase acquisition
File slack — the unused space at the end of the last allocated cluster (Correct answer)
Alternate data stream content

Correct answer: File slack — the unused space at the end of the last allocated cluster

The gap between logical size (actual file content) and physical size (allocated cluster space) is file slack, which can contain residual data from prior files.

Question 79: What is the role of the 'Evidence Processor' hash library in EnCase, and how does it affect investigation workflow?

It computes rolling hashes of live network traffic for intrusion detection
It allows examiners to import known-good and known-bad hash sets to automatically flag or exclude files during processing (Correct answer)
It generates unique case hashes that serve as the official case identifier in court
It stores encrypted copies of acquired evidence for backup purposes

Correct answer: It allows examiners to import known-good and known-bad hash sets to automatically flag or exclude files during processing

Hash libraries in EnCase's Evidence Processor let examiners apply known-good sets (like NSRL) to exclude irrelevant files and known-bad sets (like CAID) to automatically flag contraband, dramatically focusing the investigation.

Question 80: Which of the following best describes the EnCase Home screen?

Case and tool dashboard (Correct answer)
Video streamer
Live chat room
Music player

Correct answer: Case and tool dashboard

The EnCase Home screen serves as a central dashboard, providing investigators with an overview of active cases and quick access to essential tools and features. From here, users can manage cases, start new acquisitions, open existing evidence files, and navigate to various analysis modules efficiently.

Question 81: Which registry key path stores UserAssist entries that track GUI-launched program executions per user?

HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\UserAssist
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist
HKLM\SYSTEM\CurrentControlSet\Control\UserAssist
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist (Correct answer)

Correct answer: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist

UserAssist is stored per-user under HKCU in the Explorer branch, recording run counts and last execution timestamps for each program launched via the shell.

Question 82: Which of the following is a valid reason to perform a 'logical' acquisition instead of a physical acquisition?

The target is a cloud storage account where physical media is inaccessible (Correct answer)
The examiner needs to verify the drive's partition table
The examiner wants to capture deleted file remnants
The target drive has a Host Protected Area

Correct answer: The target is a cloud storage account where physical media is inaccessible

Cloud storage accounts have no physical media to image, making logical acquisition of account data (via APIs or consent-based access) the only viable option.

Question 83: In EnCase, when exporting data for use by other forensic tools, which format preserves the most metadata and is most widely accepted across platforms?

E01 (Expert Witness Format) (Correct answer)
Plain text (.txt)
DOCX
PDF

Correct answer: E01 (Expert Witness Format)

E01 format preserves complete disk image data with embedded metadata, hash values, and case information, making it the most interoperable format for forensic tool exchange.

Question 84: Which file format is commonly used for forensic image acquisition?

.mp4
.zip
.exe
.E01 (Correct answer)

Correct answer: .E01

The .E01 format, also known as EnCase Evidence File, is a widely accepted standard for forensic image acquisition. It creates a bit-for-bit copy of the original storage medium, including unallocated space, and incorporates metadata, hash values, and case information. This ensures the integrity and authenticity of the acquired evidence.

Question 85: In EnCase, what is the 'Case Processor' primarily used for?

Automating multiple processing tasks such as hash analysis, signature analysis, and indexing simultaneously (Correct answer)
Generating final court-ready HTML reports
Synchronizing case data across multiple examiner workstations
Converting evidence files between E01 and Ex01 formats

Correct answer: Automating multiple processing tasks such as hash analysis, signature analysis, and indexing simultaneously

The EnCase Case Processor automates batch processing tasks including hash analysis, file signature analysis, index creation, and more, saving significant manual effort.

Question 86: Which exception to the warrant requirement allows officers to seize and search a computer without a warrant when someone with apparent authority gives consent?

Good faith exception
Third-party consent doctrine (Correct answer)
Emergency aid exception
Exigent circumstances exception

Correct answer: Third-party consent doctrine

The third-party consent doctrine permits a warrantless search when a person with apparent authority over the area or device voluntarily consents.

Question 87: A report must address user attribution—proving a specific person performed actions on a computer. Which types of artifacts from EnCase provide the strongest attribution evidence?

The physical location of the device at time of seizure
A convergence of user account activity logs, typed URLs, email artifacts, and device-specific configuration files tied to the individual (Correct answer)
File creation dates alone
The IP address in DHCP logs

Correct answer: A convergence of user account activity logs, typed URLs, email artifacts, and device-specific configuration files tied to the individual

Strong user attribution requires convergent evidence—multiple artifact types that collectively point to a specific individual's account and behavioral patterns rather than any single data point.

Question 88: When EnCase identifies a file's hash as matching a 'Notable' hash set, what should the examiner conclude?

The file's hash could not be computed due to encryption
The file is a known clean operating system file that can be excluded from review
The file contains embedded metadata indicating it was accessed by a specific user
The file is potentially significant and warrants immediate attention, as it matches hashes of known contraband or malware (Correct answer)

Correct answer: The file is potentially significant and warrants immediate attention, as it matches hashes of known contraband or malware

A 'Notable' hash set match (such as CAID for CSAM) flags a file as known contraband or malware, requiring the examiner to immediately document the finding and follow established legal protocols.

Question 89: In the context of EnCase and the EnScript programming environment, what is an EnScript primarily used for?

Configuring hardware write blockers remotely
Automating repetitive analysis tasks and extending EnCase functionality (Correct answer)
Encrypting evidence containers with AES-256
Writing formal forensic reports in DOC format

Correct answer: Automating repetitive analysis tasks and extending EnCase functionality

EnScript is EnCase's built-in scripting language (similar to C++) that allows examiners to automate tasks, perform custom analysis, and extend the software's capabilities beyond built-in functions.

Question 90: Which EnCase feature generates an itemized list of all files examined, including deleted files, that should be referenced in the formal report?

Case Analyzer output
Timeline report
File list report (Correct answer)
Bookmark report

Correct answer: File list report

The File List report in EnCase provides an itemized inventory of all files including deleted and unallocated entries that were part of the examination scope.

Question 91: What is the primary purpose of EnCase software?

Software development
Gaming optimization
Video editing
Digital forensics and evidence recovery (Correct answer)

Correct answer: Digital forensics and evidence recovery

EnCase is a leading software platform specifically designed for digital forensics investigations. Its primary purpose is to acquire, analyze, and preserve digital evidence from various sources, such as computers, mobile devices, and networks. This capability is crucial for law enforcement, corporate security, and legal professionals to uncover and present electronic evidence in investigations and court proceedings.

Question 92: A EnCE professional discovers a conflict of interest in a current assignment. What is the MOST ethical course of action?

Handle it privately without informing stakeholders
Ignore it if no one else has noticed
Continue the assignment but document the conflict later
Disclose the conflict immediately and recuse if necessary (Correct answer)

Correct answer: Disclose the conflict immediately and recuse if necessary

Ethical standards require immediate disclosure of conflicts of interest. Transparency protects both the professional's integrity and the stakeholders' interests. Recusal may be necessary to maintain objectivity.

Question 93: Which registry key can provide evidence of the last interactive user logon time on a Windows system?

HKLM\SAM\SAM\Domains\Account\Users\[RID] (Correct answer)
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\LastLogin
HKLM\SECURITY\Policy\Accounts\[SID]\LastLogin
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI

Correct answer: HKLM\SAM\SAM\Domains\Account\Users\[RID]

The SAM hive stores per-user binary records that embed the last interactive logon timestamp along with failed logon count and password change history.

Question 94: What are file system artifacts?

Wallpapers
Game folders
Metadata and system records (Correct answer)
Music files

Correct answer: Metadata and system records

File system artifacts are remnants or records left behind by operating system activities and user actions on a storage device. These include crucial metadata, such as file creation/modification times, sizes, and permissions, as well as various system records like journal files and registry entries. They are invaluable in forensic investigations, providing contextual information about system usage and user behavior.

Question 95: A EnCE professional discovers a conflict of interest in a current assignment. What is the MOST ethical course of action?

Handle it privately without informing stakeholders
Ignore it if no one else has noticed
Disclose the conflict immediately and recuse if necessary (Correct answer)
Continue the assignment but document the conflict later

Correct answer: Disclose the conflict immediately and recuse if necessary

Question 96: What is the purpose of active listening in EnCE professional interactions?

To appear polite
To fully understand the speaker's message and respond appropriately (Correct answer)
To wait for your turn to speak
To memorize every word

Correct answer: To fully understand the speaker's message and respond appropriately

Active listening involves fully concentrating on the speaker's message to understand it completely before formulating an appropriate response.

Question 97: Which scenario represents a violation of the EnCase Certified Examiner code of professional conduct?

Misrepresenting qualifications or certification status (Correct answer)
Seeking continuing education beyond minimum requirements
Reporting safety concerns to regulatory authorities
Declining work outside one's area of competence

Correct answer: Misrepresenting qualifications or certification status

Question 98: What is the best practice for maintaining network forensics performance over time?

Implement scheduled preventive maintenance (Correct answer)
Outsource all maintenance
Wait for failures before acting
Upgrade all equipment annually

Correct answer: Implement scheduled preventive maintenance

Scheduled preventive maintenance catches potential issues before they cause failures, maintaining reliability and extending equipment life.

Question 99: A EnCE certified professional is asked to provide services outside their scope of competence. The CORRECT ethical response is to:

Decline and refer to a qualified professional (Correct answer)
Accept but charge a lower rate
Accept and learn as they go
Accept the work to gain new experience

Correct answer: Decline and refer to a qualified professional

Ethical practice requires professionals to work within their scope of competence. Accepting work beyond one's qualifications can lead to substandard results and potential harm. Referring to qualified professionals ensures proper service delivery.

Question 100: In EnCase registry analysis, what do the terms 'allocated' and 'unallocated' cells refer to within a hive file?

Whether the hive is protected by Windows File Protection from modification
Whether the hive file itself resides in allocated or free disk space
Whether the hive has been loaded into memory by the operating system
Whether registry cells (keys/values) are active or marked as deleted within the hive binary structure (Correct answer)

Correct answer: Whether registry cells (keys/values) are active or marked as deleted within the hive binary structure

Registry hive cells are marked allocated (active) or unallocated (deleted) within the hive; deleted cells may be recoverable by carving the hive binary until overwritten.

EnCase Certified Examiner (EnCE) Certification Exam

The EnCE certification validates a candidate's proficiency in using EnCase software for digital forensics investigations, including evidence acquisition, analysis, and reporting.

100

Questions

120 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds