Practice Test Geeks(EnCE) EnCase Certified Examiner Practice Test
← All ENCE Flashcard Decks

Evidence Acquisition & Preservation Flashcards

7 cards from real ENCE practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 Evidence Acquisition & Preservation flashcards as text

  1. When acquiring evidence from a live system, which volatile data should be collected FIRST according to the order of volatility?

    Answer: CPU registers and cache

    CPU registers and cache are the most volatile data and must be collected first as they are lost the moment collection is delayed.

  2. What is the primary purpose of a write-blocker during forensic evidence acquisition?

    Answer: To prevent any data from being written to the source drive

    A write-blocker prevents any write commands from reaching the source drive, ensuring the original evidence remains unaltered.

  3. An examiner acquires a forensic image and the MD5 hash of the image does not match the hash taken at acquisition. What does this indicate?

    Answer: The image file has been altered or is corrupt

    A hash mismatch between acquisition and verification indicates the image data has changed, meaning it was altered or became corrupt.

  4. Which EnCase acquisition format stores the image in multiple segments with embedded hash verification?

    Answer: EnCase Evidence File (E01)

    The E01 (Expert Witness Format) stores the forensic image in compressed, segmented files with embedded CRC and MD5 hash values.

  5. During a network-based acquisition in EnCase, what protocol is used by the SAFE (Secure Authentication For EnCase) servlet?

    Answer: Proprietary encrypted protocol over TCP

    EnCase's SAFE servlet uses a proprietary encrypted TCP-based protocol to securely communicate between the examiner and the target machine.

  6. What is a 'sparse acquisition' in the context of EnCase evidence collection?

    Answer: An acquisition that only captures allocated files and file system metadata

    A sparse acquisition captures only allocated file system data and metadata rather than imaging the entire drive sector by sector.

  7. When documenting chain of custody for digital evidence, which element is NOT typically required?

    Answer: The monetary value of the device

    Chain of custody documentation tracks who handled evidence and when, but the monetary value of the device is not a required chain of custody element.

How this page was made: written with AI tools and published by Nathan Beja, founder of Practice Test Geeks, who is responsible for its content. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

  1. opentext.com — Test delivery, eligibility, fees, exam format, passing score, renewal, retake policy, score release, time limit, score validity · verified Oct 2026