Practice Test Geeks(EnCE) EnCase Certified Examiner Practice Test
← All ENCE Flashcard Decks

Memory Forensics & Volatile Data Analysis Flashcards

7 cards from real ENCE practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 Memory Forensics & Volatile Data Analysis flashcards as text

  1. Which type of data is lost when a computer is powered off and is therefore considered volatile?

    Answer: Contents of the RAM

    RAM (Random Access Memory) is volatile storage, meaning its contents are lost when power is removed from the system.

  2. In EnCase, which feature is used to acquire a live memory image from a running Windows system?

    Answer: EnCase Physical Memory Acquisition

    EnCase Physical Memory Acquisition allows examiners to capture a snapshot of RAM from a live running Windows system.

  3. What is the primary reason an examiner should acquire volatile data before shutting down a suspect's computer?

    Answer: To capture running processes, network connections, and encryption keys

    Volatile data such as active processes, open network connections, logged-in users, and encryption keys only exist in RAM and are lost on shutdown.

  4. Which of the following artifacts can typically be found in a memory dump but NOT on the hard drive?

    Answer: Decrypted BitLocker volume keys

    BitLocker encryption keys are held in RAM while the volume is mounted and decrypted, but are never stored on disk in plaintext.

  5. What file extension does EnCase typically use for a captured physical memory image?

    Answer: .E01

    EnCase stores acquired memory images in the Expert Witness Format (.E01), the same container used for disk images.

  6. When analyzing a memory dump, which data structure is most useful for identifying currently running processes?

    Answer: EPROCESS linked list

    The EPROCESS linked list in Windows kernel memory chains all active process control blocks together, making it the primary structure for enumerating running processes.

  7. Which of the following best describes a 'hibernation file' in the context of memory forensics?

    Answer: A compressed snapshot of RAM written to disk when the system hibernates

    The Windows hibernation file (hiberfil.sys) contains a compressed copy of the entire contents of RAM at the time hibernation was initiated, making it valuable for memory analysis.

How this page was made: written with AI tools and published by Nathan Beja, founder of Practice Test Geeks, who is responsible for its content. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

  1. opentext.com — Test delivery, eligibility, fees, exam format, passing score, renewal, retake policy, score release, time limit, score validity · verified Oct 2026