ENCE Study Guide 2026
Everything you need to pass the ENCE exam in one place: the exam format, every topic to study, real practice questions with explanations, flashcards, and full-length practice tests. Free, no sign-up needed.
📋 ENCE Exam Format at a Glance
📚 ENCE Topics to Study (71)
✍️ Sample ENCE Questions & Answers
1. What is the role of the 'Evidence Processor' hash library in EnCase, and how does it affect investigation workflow?
Hash libraries in EnCase's Evidence Processor let examiners apply known-good sets (like NSRL) to exclude irrelevant files and known-bad sets (like CAID) to automatically flag contraband, dramatically focusing the investigation.
2. What is the EnScript feature used for?
EnScript is a powerful scripting language integrated within EnCase software. Its primary use is to automate complex or repetitive forensic processes, such as searching for specific file types, carving data, or generating custom reports. By leveraging EnScript, forensic examiners can significantly enhance efficiency, consistency, and thoroughness in their investigations.
3. Which authentication factor is classified as "something you are"?
Biometric data such as fingerprints, facial recognition, or retinal scans represents the "something you are" authentication factor.
4. Which registry hive stores local user account information and password hashes on a Windows system?
The SAM (Security Account Manager) hive stores local user account credentials, group memberships, and hashed passwords.
5. Which EnCase feature is used to parse and display the internal structure of a PST or OST file for email review?
EnCase's Email Examiner (or Email Parser module) can parse PST/OST files and present individual messages, attachments, and folder structures in a readable format.
6. An examiner discovers a 'cache.db' file within an iOS app's Library/Caches directory. What type of forensic data might this contain?
The cache.db file is used by iOS's URL caching system (NSURLCache) and may contain HTTP request/response pairs including URLs, headers, and body content.