EnCase Certified Examiner (EnCE) Certification Exam — Questions and Answers

Question 1: An examiner acquires a RAID 5 array by imaging each individual physical disk. What additional step is needed before analysis?

Hash each drive image separately and compare them
Acquire the RAID controller's firmware
Reconstruct the RAID stripe set in EnCase to interpret the logical volume (Correct answer)
Convert all images to RAW format before analysis

Correct answer: Reconstruct the RAID stripe set in EnCase to interpret the logical volume

RAID 5 stripes data across disks; the logical volume must be reconstructed from the individual disk images before meaningful file system analysis can occur.

Question 2: Which artifact would best corroborate a user's access to a specific network share on a Windows system?

Prefetch files
NetBIOS name cache
MUICache entries
LNK files referencing UNC paths (Correct answer)

Correct answer: LNK files referencing UNC paths

LNK shortcut files that reference UNC paths (e.g., \\server\share\file) directly evidence user access to specific network shares.

Question 3: In a network forensic investigation, which DNS record type would an examiner focus on to identify hosts that may be used for C2 via domain fronting?

CNAME records (Correct answer)
PTR records
MX records
SOA records

Correct answer: CNAME records

CNAME records are commonly abused in domain fronting attacks because they allow traffic destined for a benign CDN host to be routed to a malicious backend.

Question 4: What is the primary consideration when implementing changes to network forensics?

Impact assessment and change management (Correct answer)
Speed of implementation
Vendor preference
Personal convenience

Correct answer: Impact assessment and change management

Impact assessment and proper change management ensure that modifications do not introduce unexpected problems or service disruptions.

Question 5: What is the PRIMARY ethical obligation of a certified EnCase Certified Examiner professional regarding confidential information?

Protect it from unauthorized disclosure at all times (Correct answer)
Use it to advance career opportunities
Discuss it informally during professional networking
Share it with colleagues who might benefit

Correct answer: Protect it from unauthorized disclosure at all times

Confidentiality is a fundamental ethical obligation. Certified professionals must protect confidential information from unauthorized disclosure, regardless of circumstances. Breach of confidentiality can result in loss of certification and legal liability.

Question 6: What is the PRIMARY ethical obligation of a certified EnCase Certified Examiner professional regarding confidential information?

Use it to advance career opportunities
Discuss it informally during professional networking
Share it with colleagues who might benefit
Protect it from unauthorized disclosure at all times (Correct answer)

Correct answer: Protect it from unauthorized disclosure at all times

Question 7: When a EnCE professional faces pressure to compromise professional standards, the BEST response is to:

Immediately resign from the position
Ignore the pressure and continue without reporting
Comply to maintain workplace relationships
Document the pressure and uphold professional standards (Correct answer)

Correct answer: Document the pressure and uphold professional standards

Professionals should document any pressure to compromise standards and continue upholding their professional obligations. Documentation creates a record of the situation while maintaining ethical integrity.

Question 8: Which EnCase feature allows examiners to recover files where only the file header (magic bytes) is used for identification, regardless of file extension?

Hash Set Analysis
File Signature Analysis (Correct answer)
Keyword Search
GREP Expression Search

Correct answer: File Signature Analysis

File Signature Analysis in EnCase compares file headers (magic bytes) against a library of known signatures to identify files that may have been deliberately renamed or have incorrect extensions.

Question 9: What distinguishes a EnCase Certified Examiner certified professional from a non-certified practitioner?

Certified professionals always have more years of experience
Certification validates competency through standardized assessment against established benchmarks (Correct answer)
There is no meaningful difference in competency
Certified professionals exclusively work in larger organizations

Correct answer: Certification validates competency through standardized assessment against established benchmarks

Certification provides objective validation of competency through standardized assessment. While non-certified practitioners may be skilled, certification offers verified evidence that a professional meets established benchmarks for knowledge and performance.

Question 10: Which standard governs best practices for digital evidence acquisition and is referenced in many law enforcement forensic procedures?

NIST SP 800-86 (Guide to Integrating Forensic Techniques into Incident Response) (Correct answer)
COBIT 5 for Information Security
PCI DSS v4.0
ISO 27001

Correct answer: NIST SP 800-86 (Guide to Integrating Forensic Techniques into Incident Response)

NIST SP 800-86 provides guidance on integrating forensic techniques into incident response, including evidence acquisition best practices widely used by law enforcement.

Question 11: In EnCase, which Windows artifact stores evidence of program execution including run count and last execution time on Windows 10?

Prefetch files
AppCompatCache (ShimCache)
UserAssist registry keys
AmCache.hve (Correct answer)

Correct answer: AmCache.hve

AmCache.hve on Windows 10 records program execution evidence including SHA1 hashes, first run time, and file metadata for executed applications.

Question 12: Which principle states that users should only have access necessary for their role?

Principle of least privilege (Correct answer)
Defense in depth
Need to share
Separation of duties

Correct answer: Principle of least privilege

The principle of least privilege ensures users only have the minimum access rights needed to perform their job functions, limiting potential damage.

Question 13: What is the significance of MFT entry number 0 in NTFS?

It is reserved and always empty
It represents the root directory
It is the MFT itself ($MFT) (Correct answer)
It holds the volume label

Correct answer: It is the MFT itself ($MFT)

$MFT (entry 0) is the MFT's own metadata record, allowing NTFS to treat the MFT as a regular file for self-description.

Question 14: What is the primary purpose of a SIEM system in network forensic investigations?

To perform deep packet inspection on all traffic in real time
To automatically patch vulnerabilities discovered during investigations
To aggregate and correlate log data from multiple sources for threat detection (Correct answer)
To encrypt all network traffic for secure storage

Correct answer: To aggregate and correlate log data from multiple sources for threat detection

A SIEM (Security Information and Event Management) system collects, aggregates, and correlates logs and events from across an environment to identify security incidents.

Question 15: A forensic report references an email extracted using EnCase. Which metadata fields are most critical to include for evidentiary completeness?

Only the email body text
The email client version and operating system
Subject line and attachment names only
Sender, recipient, timestamp, message-ID, and path to the evidence container (Correct answer)

Correct answer: Sender, recipient, timestamp, message-ID, and path to the evidence container

Complete email documentation requires sender, recipient, timestamp, message-ID for authenticity, and the precise path within the forensic image where the artifact was located.

Question 16: What must be true for the 'plain view' doctrine to justify a warrantless seizure of digital evidence found during a lawful search?

The evidence must be physically visible without opening any files
The incriminating nature of the evidence must be immediately apparent (Correct answer)
The officer must have a general warrant covering all devices
The suspect must be present at the time of seizure

Correct answer: The incriminating nature of the evidence must be immediately apparent

Under plain view, the incriminating character of the item must be immediately apparent to the officer who lawfully observed it.

Question 17: What is an Alternate Data Stream (ADS) in NTFS, and why is it forensically significant?

A compressed version of a file stored separately
A redundant copy of MFT records for crash recovery
An additional named data stream attached to a file that can hide data invisible to standard directory listings (Correct answer)
A backup of file timestamps before modification

Correct answer: An additional named data stream attached to a file that can hide data invisible to standard directory listings

NTFS ADS allows arbitrary data to be stored in a named stream (e.g., file.exe:hidden.dat) that standard tools and Explorer do not display, making it a common data-hiding technique.

Question 18: A forensic report states that a file was 'created' on a specific date. What caveat should accompany this finding?

NTFS timestamps are always accurate
Filesystem timestamps can be manipulated and may not reflect true creation time (Correct answer)
The date is certified by the EnCase tool automatically
Creation timestamps are the most reliable of all NTFS timestamps

Correct answer: Filesystem timestamps can be manipulated and may not reflect true creation time

Filesystem timestamps can be altered by anti-forensic tools, file copies, or timezone changes, so reports must note they may not reflect the true original creation event.

Question 19: What are file system artifacts?

Wallpapers
Metadata and system records (Correct answer)
Game folders
Music files

Correct answer: Metadata and system records

File system artifacts are remnants or records left behind by operating system activities and user actions on a storage device. These include crucial metadata, such as file creation/modification times, sizes, and permissions, as well as various system records like journal files and registry entries. They are invaluable in forensic investigations, providing contextual information about system usage and user behavior.

Question 20: What is the recommended approach for handling errors in encase software?

Log errors but never handle them
Implement structured error handling with meaningful messages (Correct answer)
Let errors crash the application
Suppress all error messages

Correct answer: Implement structured error handling with meaningful messages

Structured error handling with meaningful messages helps diagnose problems quickly while maintaining application stability and user experience.

Question 21: What is the primary benefit of version control in encase software for EnCE?

It makes files larger
It tracks changes and enables collaboration (Correct answer)
It eliminates the need for documentation
It replaces testing

Correct answer: It tracks changes and enables collaboration

Version control systems track all changes to code and configurations, enabling collaboration, rollback, and audit trails.

Question 22: What is the PRIMARY purpose of obtaining EnCE certification in EnCase Certified Examiner?

To satisfy a personal achievement goal
To bypass educational requirements
To guarantee employment in the field
To demonstrate verified competency and adherence to professional standards (Correct answer)

Correct answer: To demonstrate verified competency and adherence to professional standards

Professional certification demonstrates that an individual has met established competency standards through verified assessment. It provides assurance to employers, clients, and the public that the certified professional possesses the knowledge and skills required for competent practice.

Question 23: What role does collaboration play in registry analysis for EnCE professionals?

It slows down work unnecessarily
It reduces individual accountability
It enhances outcomes through diverse perspectives and shared expertise (Correct answer)
It is only needed in emergencies

Correct answer: It enhances outcomes through diverse perspectives and shared expertise

Collaboration leverages diverse perspectives and combined expertise to achieve better outcomes than any individual could alone.

Question 24: In EnCase, what is the function of the 'Bookmark' feature?

It marks files for deletion from the evidence container
It sets the evidence file's hash verification status
It tags and annotates specific items or data regions for inclusion in reports (Correct answer)
It encrypts selected files within the case

Correct answer: It tags and annotates specific items or data regions for inclusion in reports

Bookmarks allow examiners to flag, annotate, and organize key evidence items so they can be easily referenced and included in final reports.

Question 25: Which of the following volatile data items has the HIGHEST order of volatility and should be collected first?

System time and clock skew
Contents of pagefile.sys
Temporary file system data
CPU registers and cache (Correct answer)

Correct answer: CPU registers and cache

CPU registers and cache have the highest order of volatility per RFC 3227 guidelines and change constantly, requiring collection before any other volatile data.

Question 26: What is the purpose of the 'Cookies' artifact in browser forensics beyond proving a website was visited?

Cookies contain encrypted user passwords for all sites
Cookies store the full HTML content of visited pages
Cookies log all file downloads initiated from a website
Cookies can reveal user account names, session IDs, preferences, and timestamps of interactions with a site (Correct answer)

Correct answer: Cookies can reveal user account names, session IDs, preferences, and timestamps of interactions with a site

Cookies often contain username values, session identifiers, user preferences, and creation/expiry timestamps that provide detailed behavioral evidence beyond a simple site visit.

Question 27: A report must address user attribution—proving a specific person performed actions on a computer. Which types of artifacts from EnCase provide the strongest attribution evidence?

A convergence of user account activity logs, typed URLs, email artifacts, and device-specific configuration files tied to the individual (Correct answer)
The IP address in DHCP logs
The physical location of the device at time of seizure
File creation dates alone

Correct answer: A convergence of user account activity logs, typed URLs, email artifacts, and device-specific configuration files tied to the individual

Strong user attribution requires convergent evidence—multiple artifact types that collectively point to a specific individual's account and behavioral patterns rather than any single data point.

Question 28: Which section of a forensic report should contain the examiner's professional qualifications, certifications, and relevant experience?

Methodology section
Executive summary
Findings section
Curriculum vitae or qualifications section (Correct answer)

Correct answer: Curriculum vitae or qualifications section

The examiner's qualifications, certifications (such as EnCE), and experience are placed in a dedicated CV or qualifications section to establish their competency as an expert witness.

Question 29: What is the purpose of imaging a drive's Host Protected Area (HPA)?

To acquire the drive's firmware partition
To verify the drive's S.M.A.R.T. data
To capture potentially hidden data that the OS cannot normally access (Correct answer)
To recover deleted files from the file system

Correct answer: To capture potentially hidden data that the OS cannot normally access

The HPA is a portion of the drive hidden from the operating system; imaging it can reveal data intentionally concealed by suspects.

Question 30: In an EnCase report, what is the significance of reporting the 'physical offset' of a piece of evidence?

It provides the exact byte location within the forensic image for independent verification (Correct answer)
It indicates the geographic location where the device was seized
It identifies which investigator found the evidence
It specifies the file system type of the evidence

Correct answer: It provides the exact byte location within the forensic image for independent verification

Reporting the physical offset allows any examiner with access to the forensic image to navigate directly to that byte location and independently verify the finding.

Question 31: In an EnCase forensic report prepared for civil litigation, how does the standard of proof affect the way conclusions are written compared to criminal investigations?

Civil reports may use 'more likely than not' framing while criminal reports require higher certainty thresholds in language (Correct answer)
Civil reports require stricter scientific certainty than criminal reports
Criminal reports use qualified language; civil reports use absolute statements
There is no difference; forensic reports are identical regardless of case type

Correct answer: Civil reports may use 'more likely than not' framing while criminal reports require higher certainty thresholds in language

Civil litigation operates on a preponderance of evidence standard, so conclusion language may reflect 'more likely than not,' while criminal matters may require language conveying higher confidence.

Question 32: When performing a logical acquisition of an iOS device using EnCase, which protocol is primarily used to communicate with the device?

ADB (Android Debug Bridge)
AFC (Apple File Conduit) (Correct answer)
PTP (Picture Transfer Protocol)
MTP (Media Transfer Protocol)

Correct answer: AFC (Apple File Conduit)

EnCase communicates with iOS devices using the Apple File Conduit (AFC) protocol over the USB connection.

Question 33: What is a 'sparse acquisition' in the context of EnCase evidence collection?

An acquisition of only the first and last sectors of a drive
An acquisition that only captures allocated files and file system metadata (Correct answer)
An acquisition that skips encrypted sectors
An acquisition made without a write blocker

Correct answer: An acquisition that only captures allocated files and file system metadata

A sparse acquisition captures only allocated file system data and metadata rather than imaging the entire drive sector by sector.

Question 34: When reporting on deleted file recovery using EnCase, the examiner should note that recovery success depends on:

Whether the clusters previously occupied by the file have been overwritten since deletion (Correct answer)
The suspect's cooperation during investigation
Whether antivirus software was installed
The age of the suspect's operating system

Correct answer: Whether the clusters previously occupied by the file have been overwritten since deletion

Deleted file recovery depends on whether the file's allocated clusters have been reused by new data; if overwritten, the original content is unrecoverable.

Question 35: What does the term 'chain of custody' mean in digital forensics, and how does EnCase support it?

The hierarchical folder structure within an EnCase case file
The documented, unbroken record of who handled evidence and when, supported by EnCase's case notes and audit logs (Correct answer)
A method of linking related files across multiple evidence items using hash values
A network chain used to transmit evidence securely between agencies

Correct answer: The documented, unbroken record of who handled evidence and when, supported by EnCase's case notes and audit logs

Chain of custody is the chronological, documented record tracking who accessed or handled evidence; EnCase supports this through case notes, examiner identifiers recorded in evidence files, and detailed audit logs.

Question 36: A company discovers an employee has been stealing trade secrets and contacts law enforcement. Before police arrive, the IT department creates a forensic image of the suspect's workstation. What issue may arise?

Private searches are always inadmissible in criminal proceedings
A private party search does not trigger Fourth Amendment protections, but evidence handling must still preserve integrity (Correct answer)
The image may not be admissible because IT staff lacked a warrant
The company must obtain a court order before any internal forensic activity

Correct answer: A private party search does not trigger Fourth Amendment protections, but evidence handling must still preserve integrity

The Fourth Amendment applies to government actors, so private company searches do not require a warrant, but proper evidence handling is still critical for admissibility.

Question 37: Which doctrine allows evidence obtained in violation of the Fourth Amendment to be excluded from trial?

The inevitable discovery doctrine
The fruit of the poisonous tree doctrine
The exclusionary rule (Correct answer)
The plain view doctrine

Correct answer: The exclusionary rule

The exclusionary rule prohibits the use of illegally obtained evidence in a criminal trial to deter unlawful police conduct.

Question 38: When EnCase identifies a file's hash as matching a 'Notable' hash set, what should the examiner conclude?

The file is potentially significant and warrants immediate attention, as it matches hashes of known contraband or malware (Correct answer)
The file is a known clean operating system file that can be excluded from review
The file's hash could not be computed due to encryption
The file contains embedded metadata indicating it was accessed by a specific user

Correct answer: The file is potentially significant and warrants immediate attention, as it matches hashes of known contraband or malware

A 'Notable' hash set match (such as CAID for CSAM) flags a file as known contraband or malware, requiring the examiner to immediately document the finding and follow established legal protocols.

Question 39: Which legal concept permits investigators to expand the scope of a digital search when contraband is found incidentally during a lawfully scoped search?

Good faith exception
Inevitable discovery
Plain view doctrine (Correct answer)
Exigent circumstances

Correct answer: Plain view doctrine

The plain view doctrine allows seizure of incidentally discovered evidence when the officer is lawfully present and the incriminating nature is immediately apparent.

Question 40: When should an examiner photograph the forensic workstation before beginning an acquisition?

Never — documentation begins after the image is complete
Only when the drive shows signs of physical damage
Always — to document the hardware configuration used for the acquisition (Correct answer)
Only when imaging a RAID array

Correct answer: Always — to document the hardware configuration used for the acquisition

Photographing the forensic workstation documents the hardware setup and write-blocker configuration, supporting the chain of custody and courtroom testimony.

Question 41: What is the appropriate way to present conflicting artifact findings (e.g., a file present in MFT but absent from directory listing) in a forensic report?

Wait until a second examiner confirms before reporting
Document both findings, explain the discrepancy, and offer technically sound interpretations (Correct answer)
Defer to the most favorable interpretation for the requesting party
Report only the MFT entry and ignore the directory listing discrepancy

Correct answer: Document both findings, explain the discrepancy, and offer technically sound interpretations

Conflicting artifacts should both be documented with a technically sound explanation of why the discrepancy exists, such as anti-forensic activity or filesystem inconsistency.

Question 42: What type of steganography technique could be used to hide data within email attachments?

Modifying the email's Date: header timestamp
Embedding hidden data within image files attached to emails using tools like SilentEye (Correct answer)
Changing the Reply-To address to encode binary data
Altering the SMTP port number used for transmission

Correct answer: Embedding hidden data within image files attached to emails using tools like SilentEye

Image steganography tools can hide data within the pixel values of image files, which can then be sent as email attachments to covertly transmit information.

Question 43: When packaging physical evidence for transport to a lab, which environmental hazard poses the greatest risk to hard drives?

Vibration during transport
Humidity above 50%
Electrostatic discharge (ESD) (Correct answer)
Exposure to cold temperatures below 32°F

Correct answer: Electrostatic discharge (ESD)

Electrostatic discharge can destroy drive electronics; anti-static bags and proper grounding are essential when handling drives.

Question 44: What does 'chain of custody' documentation in a forensic report establish?

The chronological transfer, possession, and handling of evidence items (Correct answer)
The tool versions used during examination
The list of all investigators on the case
The suspect's criminal history

Correct answer: The chronological transfer, possession, and handling of evidence items

Chain of custody documents the chronological record of who possessed, transferred, and handled evidence to demonstrate that it was not altered or tampered with.

Question 45: A suspect's laptop is found running with BitLocker encryption active. What is the BEST first step for evidence acquisition?

Boot from a forensic USB drive to bypass BitLocker
Remove the drive and image it with a write-blocker
Immediately pull the power cord to preserve the encrypted state
Perform a live acquisition while the system is running and decrypted (Correct answer)

Correct answer: Perform a live acquisition while the system is running and decrypted

When BitLocker is active and the system is running in a decrypted state, live acquisition captures data in plaintext before it is re-encrypted.

Question 46: Which element is essential in a well-written EnCE professional report?

Ambiguous conclusions
Objective findings supported by data (Correct answer)
Emotional language
Personal opinions without evidence

Correct answer: Objective findings supported by data

Professional reports require objective findings supported by verifiable data to maintain credibility and support sound decision-making.

Question 47: What file extension does EnCase typically use for a captured physical memory image?

.RAM
.E01 (Correct answer)
.vmem
.mem

Correct answer: .E01

EnCase stores acquired memory images in the Expert Witness Format (.E01), the same container used for disk images.

Question 48: What is the purpose of a 'preservation letter' sent to a third-party service provider during an investigation?

To compel immediate production of records under penalty of contempt
To request voluntary preservation of specified records pending formal legal process (Correct answer)
To notify the provider that a subpoena has been filed with the court
To transfer jurisdiction over the investigation to the provider's home state

Correct answer: To request voluntary preservation of specified records pending formal legal process

A preservation letter requests that a provider voluntarily preserve specified data while formal legal process (subpoena or warrant) is being obtained.

Question 49: What is volatile data?

Stored backup
Archived files
Hard drive info
Temporary system data (Correct answer)

Correct answer: Temporary system data

Volatile data refers to information that is temporary and exists only while a computer system is running, such as RAM contents, running processes, network connections, and logged-in users. This data is lost when the system is powered off or rebooted, making its immediate acquisition crucial in live forensic investigations.

Question 50: What is the MOST important reason for EnCase Certified Examiner professionals to maintain continuing education?

To accumulate credentials for personal prestige
To stay current with evolving standards, practices, and regulations (Correct answer)
To increase billing rates
To satisfy employer preferences

Correct answer: To stay current with evolving standards, practices, and regulations

Continuing education ensures professionals remain current with evolving industry standards, best practices, and regulatory requirements. This directly impacts the quality of service provided and maintains public trust in the profession.

Question 51: In EnCase, what is the purpose of 'Bookmarks' and how are they typically used in a forensic examination?

Bookmarks permanently delete files from the evidence image to save processing time
Bookmarks encrypt selected files with a password for secure handoff to prosecutors
Bookmarks create a write-protected copy of selected files for independent verification
Bookmarks allow examiners to flag and annotate specific items of interest for inclusion in reports and presentations (Correct answer)

Correct answer: Bookmarks allow examiners to flag and annotate specific items of interest for inclusion in reports and presentations

Bookmarks in EnCase let examiners tag items of evidentiary interest with notes or annotations, organizing findings for report generation and courtroom presentation.

Question 52: What is the purpose of analyzing email 'threading' in a forensic investigation?

To extract embedded macros from email bodies
To reconstruct conversation sequences and establish timelines between parties (Correct answer)
To identify the mail server software version
To determine the file size of each email attachment

Correct answer: To reconstruct conversation sequences and establish timelines between parties

Email threading reconstructs chronological conversations by linking messages via In-Reply-To and References headers, helping establish communication timelines.

Question 53: A forensic report discusses artifacts found in Windows Registry hives. What should the examiner clarify about Registry timestamps?

Registry key LastWriteTime is the only reliable timestamp in Windows forensics
Registry LastWriteTime reflects the last modification to the key but not necessarily to individual values within it (Correct answer)
Registry timestamps cannot be used in court
Registry timestamps are set by EnCase and are always accurate

Correct answer: Registry LastWriteTime reflects the last modification to the key but not necessarily to individual values within it

Windows Registry LastWriteTime records when the key itself was last written, but individual value modifications within that key do not update to a separate timestamp.

Question 54: What type of evidence can be recovered from an email server's MTA logs during a forensic investigation?

Attachment file hashes only
Decrypted message content
User account passwords
Message delivery times, sender/recipient addresses, and IP addresses (Correct answer)

Correct answer: Message delivery times, sender/recipient addresses, and IP addresses

Mail Transfer Agent (MTA) logs record metadata such as timestamps, sender and recipient addresses, message IDs, and the IP addresses of connecting clients.

Question 55: In EnCase, what does the 'Sweep Enterprise' feature enable that standard single-machine EnCase does not?

Remote simultaneous forensic collection and triage across multiple networked endpoints (Correct answer)
Automated generation of Daubert-compliant reports
Synchronization of hash libraries across multiple forensic labs
Acquisition of RAM from a live system over a network

Correct answer: Remote simultaneous forensic collection and triage across multiple networked endpoints

EnCase Endpoint Investigator (formerly Sweep Enterprise) enables remote, network-based forensic collection and analysis across many endpoints simultaneously without requiring physical access to each machine.

Question 56: How does the EnCE body of knowledge relate to daily professional practice?

It is relevant only for academic research
It provides the foundational framework that guides decision-making and standard practices (Correct answer)
It is theoretical and has limited practical application
It only applies during certification exams

Correct answer: It provides the foundational framework that guides decision-making and standard practices

The body of knowledge provides the foundational framework of principles, standards, and best practices that professionals use to guide their daily decision-making, ensure consistent quality, and maintain alignment with industry standards.

Question 57: An examiner needs to acquire a drive that is larger than the destination media. What is the best approach?

Use compression in EnCase to reduce the image size
Acquire only the active partitions
Use multiple destination drives with segmented image files (Correct answer)
Skip unallocated space to reduce image size

Correct answer: Use multiple destination drives with segmented image files

EnCase supports spanning a forensic image across multiple destination drives using segmented E01 files when the source exceeds destination capacity.

Question 58: In professional documentation for EnCE, what is the best practice for organizing information?

Logical structure with clear headings and progression (Correct answer)
Alphabetical order always
Random order of ideas
Longest sections first

Correct answer: Logical structure with clear headings and progression

Logical structure with clear headings helps readers find information quickly and follow the progression of ideas effectively.

Question 59: Which EnCase feature is used to parse and display the internal structure of a PST or OST file for email review?

Windows Registry viewer
Email Examiner module / Email Parser (Correct answer)
File Extents viewer
Disk geometry viewer

Correct answer: Email Examiner module / Email Parser

EnCase's Email Examiner (or Email Parser module) can parse PST/OST files and present individual messages, attachments, and folder structures in a readable format.

Question 60: During an EnCase investigation, you find an OST file. What does this indicate about the user's email setup?

The user used Lotus Notes for email
The PST file is corrupted and converted to OST
Outlook was configured in Cached Exchange Mode connected to an Exchange server (Correct answer)
The user only accessed email via webmail

Correct answer: Outlook was configured in Cached Exchange Mode connected to an Exchange server

An OST (Offline Storage Table) file is created when Outlook is configured in Cached Exchange Mode, storing a local synchronized copy of the Exchange mailbox.

Question 61: What is the forensic significance of the Windows Recycle Bin folder ($Recycle.Bin in Vista+) when examined in EnCase?

It is automatically wiped when EnCase processes the evidence image
It holds system restore points that can be parsed to reconstruct prior system states
It stores encrypted copies of all files opened by a user for auditing purposes
It contains deleted files with original path and deletion timestamp metadata stored in $I files, valuable for proving user intent (Correct answer)

Correct answer: It contains deleted files with original path and deletion timestamp metadata stored in $I files, valuable for proving user intent

Each deleted file in the $Recycle.Bin has a corresponding $I metadata file recording the original file path and deletion timestamp, which EnCase can parse to demonstrate user intent and file provenance.

Question 62: During EnCase evidence processing, what is the function of 'hash analysis' in relation to the NSRL?

It encrypts evidence files for secure storage
It verifies the integrity of the EnCase application itself
It identifies files that are known good or known bad by comparing hashes to the NSRL database (Correct answer)
It rebuilds deleted files from unallocated space

Correct answer: It identifies files that are known good or known bad by comparing hashes to the NSRL database

Hash analysis compares file hashes against the National Software Reference Library (NSRL) to flag known operating system or application files, allowing examiners to focus on potentially relevant user data.

Question 63: When documenting a forensic examination of a mobile device image using EnCase, what additional caveat about timestamps must be included compared to desktop forensics?

EnCase automatically corrects mobile timestamps so no caveat is needed
Mobile timestamps are set by the carrier and are legally binding
Mobile device timestamps may reflect multiple timezones, network time syncs, and carrier-adjusted times that complicate interpretation (Correct answer)
Mobile timestamps are always more accurate than desktop timestamps

Correct answer: Mobile device timestamps may reflect multiple timezones, network time syncs, and carrier-adjusted times that complicate interpretation

Mobile device timestamps can be influenced by carrier network time, GPS, multiple timezone settings, and app-level timestamps, requiring explicit caveats about interpretation.

Question 64: An EnCase report includes output from the Physical Disk Emulator (PDE). What should the examiner document about this process?

PDE use does not need to be documented as it is read-only
That the original drive was powered on for examination
That PDE was used to boot the image, the write-block protections in place, and any changes that may have occurred to volatile data (Correct answer)
Only that the image was verified before PDE use

Correct answer: That PDE was used to boot the image, the write-block protections in place, and any changes that may have occurred to volatile data

Booting a forensic image via PDE can alter volatile artifacts like event logs or swap files, so the report must document write-block protections used and acknowledge any potential changes introduced.

Question 65: Which timestamp does NTFS maintain that records the last time a file's MFT entry itself was modified (distinct from file content changes)?

Last Accessed ($STDINFO)
Entry Modified ($STDINFO) (Correct answer)
Created ($STDINFO)
Last Written ($STDINFO)

Correct answer: Entry Modified ($STDINFO)

NTFS tracks four timestamps per file: Created, Last Written, Last Accessed, and Entry Modified ($MTIME in $STANDARD_INFORMATION); Entry Modified records when the MFT record itself was last changed, which differs from when the file's content changed.

Question 66: An examiner discovers a pagefile.sys on a seized hard drive. What forensic value does this file have?

It contains a list of recently installed programs
It logs all user login and logout events
It may contain fragments of data that were previously in RAM (Correct answer)
It stores the system's network configuration

Correct answer: It may contain fragments of data that were previously in RAM

The Windows page file (pagefile.sys) is used as virtual memory and can contain data that was paged out of RAM, including plaintext passwords, file fragments, and process data.

Question 67: When documenting chain of custody for digital evidence, which element is NOT typically required?

The monetary value of the device (Correct answer)
Description of the evidence item
Date and time of collection
Name of person who collected the evidence

Correct answer: The monetary value of the device

Chain of custody documentation tracks who handled evidence and when, but the monetary value of the device is not a required chain of custody element.

Question 68: Which protocol does Thunderbird use by default to store locally downloaded email messages?

PST format
EDB format
NSF format
MBOX format (Correct answer)

Correct answer: MBOX format

Mozilla Thunderbird stores email in MBOX format, which concatenates multiple messages into a single plain-text file.

Question 69: What does the term 'smear' refer to in the context of memory acquisition?

Inconsistencies in a memory image caused by changes in RAM during acquisition (Correct answer)
A type of malware that corrupts memory dumps
Contamination of the hard drive during imaging
A method to overwrite sensitive data before imaging

Correct answer: Inconsistencies in a memory image caused by changes in RAM during acquisition

Memory smear occurs because RAM contents change continuously during acquisition; the resulting image may contain data from different points in time, creating inconsistencies.

Question 70: Which EnCase feature generates an itemized list of all files examined, including deleted files, that should be referenced in the formal report?

Timeline report
Bookmark report
Case Analyzer output
File list report (Correct answer)

Correct answer: File list report

The File List report in EnCase provides an itemized inventory of all files including deleted and unallocated entries that were part of the examination scope.

Question 71: When reconstructing a TCP session from a PCAP, what information is used to reassemble packets in the correct order?

IP identification fields
TCP sequence numbers (Correct answer)
Ethernet frame checksums
IP TTL values

Correct answer: TCP sequence numbers

TCP sequence numbers are used to track the order of bytes in a stream, enabling correct reassembly of out-of-order or fragmented TCP segments.

Question 72: In EnCE practice, what is the best approach to quality improvement in internet artifacts?

Wait for problems to occur before acting
Copy what other organizations do without analysis
Use data-driven methods with measurable outcomes (Correct answer)
Make changes without measuring results

Correct answer: Use data-driven methods with measurable outcomes

Data-driven quality improvement with measurable outcomes ensures that changes actually produce the intended improvements and can be verified.

Question 73: What is the key to effective cross-functional communication in EnCE environments?

Using department-specific jargon
Communicating only in writing
Adapting language and context for different audiences (Correct answer)
Avoiding all technical details

Correct answer: Adapting language and context for different audiences

Adapting language and providing appropriate context for different audiences ensures effective communication across functional boundaries.

Question 74: Which foundational principle is MOST important for success in the EnCase Certified Examiner profession?

Specializing in only one narrow area of practice
Maximizing financial returns on every engagement
Maintaining the minimum requirements for certification
Commitment to continuous learning, ethical practice, and quality outcomes (Correct answer)

Correct answer: Commitment to continuous learning, ethical practice, and quality outcomes

Success in any professional field requires a commitment to continuous learning to stay current, ethical practice to maintain trust and integrity, and a focus on quality outcomes that serve stakeholders and the public interest.

Question 75: Which method is preferred for live system acquisition?

Memory dump
Logoff
Cold reboot
Full format (Correct answer)

Correct answer: Full format

The provided answer, 'Full format,' is incorrect as it is a destructive process that erases data, not an acquisition method for live systems. For live system acquisition, the preferred method is a 'Memory dump' (A), which captures volatile data like RAM contents and running processes before they are lost upon system shutdown. This is crucial for a comprehensive forensic analysis.

Question 76: What is the fundamental principle behind network forensics in the EnCE domain?

Balancing performance, reliability, and efficiency (Correct answer)
Following a single vendor solution
Using the newest technology exclusively
Cost minimization at all costs

Correct answer: Balancing performance, reliability, and efficiency

Effective technical design requires balancing performance requirements with reliability needs and operational efficiency.

Question 77: Which EnCase feature is specifically designed to identify and recover JPEG images from unallocated space based on file headers and footers?

File Carving (via EnCase or GREP-based carver) (Correct answer)
Signature Analysis
Hash Analysis
Link File Parsing

Correct answer: File Carving (via EnCase or GREP-based carver)

File carving searches unallocated space for known file headers (e.g., FFD8FF for JPEG) and footers (FFD9) to reconstruct files even when no file system metadata exists, and EnCase supports this both natively and through EnScripts.

Question 78: When reviewing HKLM\SYSTEM\CurrentControlSet\Services, what forensically significant evidence can an examiner identify?

Malicious services or drivers configured to load at startup with their executable image paths (Correct answer)
Installed software license keys and activation records
A chronological history of all commands run via the command prompt
The complete list of scheduled tasks configured on the system

Correct answer: Malicious services or drivers configured to load at startup with their executable image paths

The Services key registers all Windows services and kernel drivers including malicious ones, exposing their binary image path, start type, and description.

Question 79: What is 'timestomping' in the context of anti-forensics, and how can EnCase help detect it?

Overwriting sectors with random data to prevent file recovery, detected by entropy analysis
Deliberately altering file timestamps to mislead investigators about when files were created or accessed, detectable by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps (Correct answer)
Spoofing the system clock during evidence acquisition to invalidate hash verification
Embedding malware in timestamp metadata fields of JPG images

Correct answer: Deliberately altering file timestamps to mislead investigators about when files were created or accessed, detectable by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps

Timestomping uses tools to modify $STANDARD_INFORMATION timestamps, but $FILE_NAME timestamps (updated only by the file system kernel) are harder to alter — discrepancies between the two in EnCase indicate potential manipulation.

Question 80: An examiner is investigating a data breach and finds encrypted traffic to a cloud storage provider. The TLS handshake is intact but payload is encrypted. What is the BEST next forensic step?

Examine endpoint artifacts such as browser history, cloud sync logs, and application logs to determine what files were uploaded (Correct answer)
Discard the traffic as unexaminable
Attempt to crack the TLS encryption using brute force
Report the cloud provider's IP as malicious without further investigation

Correct answer: Examine endpoint artifacts such as browser history, cloud sync logs, and application logs to determine what files were uploaded

When network payload is encrypted, pivoting to endpoint artifacts — browser history, cloud application logs, file system activity — can reveal what data was transferred even without decrypting the traffic.

Question 81: What tool does EnCase use for acquiring images?

Disk Cleaner
Paint
Command Prompt
EnCase Imager (Correct answer)

Correct answer: EnCase Imager

EnCase Imager is a dedicated, standalone tool provided by Guidance Software (now OpenText) specifically for creating forensic images of digital media. It allows investigators to perform bit-stream acquisitions of hard drives, solid-state drives, and other storage devices. This ensures data integrity through hashing and write-blocking capabilities.

Question 82: Which of the following best describes the concept of 'unallocated space' in a digital forensics investigation?

Space reserved by the operating system for kernel use only
Disk space not currently assigned to any active file but potentially containing recoverable deleted file data (Correct answer)
Encrypted sectors protected by BitLocker that cannot be examined
Space between the MBR and the first partition on a disk

Correct answer: Disk space not currently assigned to any active file but potentially containing recoverable deleted file data

Unallocated space consists of sectors no longer assigned to active files (often from deleted files), making it a critical area for recovering deleted content in a forensic investigation.

Question 83: How does EnCase organize data for review?

Audio alerts
Color coding
Graph generation
Bookmarks (Correct answer)

Correct answer: Bookmarks

EnCase utilizes bookmarks as a primary method for organizing and flagging important evidence during an investigation. Investigators can create bookmarks for specific files, folders, or data fragments, adding notes and categorizing them. This streamlines review, analysis, and report generation by providing quick access to critical findings.

Question 84: An examiner must report on LNK (Windows shortcut) files found during an EnCase examination. What critical forensic value do LNK file timestamps provide?

They prove a suspect opened a specific file at a specific time with absolute certainty
They can indicate when a linked file was last accessed on the system, providing usage timeline evidence (Correct answer)
They only reflect when the shortcut itself was created, not when it was used
They are unreliable and should never be included in forensic reports

Correct answer: They can indicate when a linked file was last accessed on the system, providing usage timeline evidence

LNK files contain MAC timestamps that can indicate when the linked target file was accessed, making them valuable for establishing a timeline of file usage activity.

Question 85: How does the EnCE body of knowledge relate to daily professional practice?

It provides the foundational framework that guides decision-making and standard practices (Correct answer)
It is relevant only for academic research
It is theoretical and has limited practical application
It only applies during certification exams

Correct answer: It provides the foundational framework that guides decision-making and standard practices

Question 86: In the United States, the 'good faith exception' to the exclusionary rule allows evidence to be admitted when:

Officers believed the suspect was guilty based on prior criminal history
The evidence was discovered by a civilian informant
Officers conducted a search within 48 hours of obtaining probable cause
Officers acted in reasonable reliance on a warrant later found to be defective (Correct answer)

Correct answer: Officers acted in reasonable reliance on a warrant later found to be defective

The good faith exception established in United States v. Leon allows evidence obtained by officers who reasonably relied on a facially valid but ultimately defective warrant.

Question 87: In EnCase, when exporting data for use by other forensic tools, which format preserves the most metadata and is most widely accepted across platforms?

E01 (Expert Witness Format) (Correct answer)
PDF
DOCX
Plain text (.txt)

Correct answer: E01 (Expert Witness Format)

E01 format preserves complete disk image data with embedded metadata, hash values, and case information, making it the most interoperable format for forensic tool exchange.

Question 88: Which EnCase feature allows an examiner to search for email-related keywords across unallocated space?

Registry viewer
Keyword search with GREP expressions (Correct answer)
Hash library matching
File signature analysis

Correct answer: Keyword search with GREP expressions

EnCase's keyword search with GREP expressions can scan unallocated clusters and slack space for email fragments including addresses and message content.

Question 89: In EnCase, what is the difference between a 'Physical Disk' view and a 'Logical Volume' view when examining evidence?

Physical Disk view requires write-blocker hardware; Logical Volume view can be accessed without one
Physical Disk view shows only deleted files; Logical Volume view shows only active files
Physical Disk view is for HDDs only; Logical Volume view supports SSDs and flash media
Physical Disk view shows raw sectors including partition gaps and unpartitioned space; Logical Volume view shows the file system structure within a partition (Correct answer)

Correct answer: Physical Disk view shows raw sectors including partition gaps and unpartitioned space; Logical Volume view shows the file system structure within a partition

The Physical Disk view in EnCase exposes every sector of the drive including areas outside partitions, while the Logical Volume view presents the interpreted file system structure within a specific partition.

Question 90: What is the purpose of an 'Appendix' in a comprehensive forensic report?

To summarize the report for non-technical readers
To provide supplementary technical data, tool outputs, and detailed tables that support but do not clutter the main narrative (Correct answer)
To repeat the executive summary in technical language
To list the opposing expert's weaknesses

Correct answer: To provide supplementary technical data, tool outputs, and detailed tables that support but do not clutter the main narrative

Appendices house detailed supporting data such as full file listings, hash logs, and tool output reports that substantiate findings without disrupting the main report's readability.

Question 91: In the context of Android forensics with EnCase, what is the significance of the 'accounts.db' or 'accounts_ce.db' file?

It holds the device's built-in calculator history
It contains synced Google and third-party account credentials and tokens (Correct answer)
It logs all failed unlock attempts with timestamps
It stores financial transaction records from banking apps

Correct answer: It contains synced Google and third-party account credentials and tokens

The accounts_ce.db file stores registered accounts (Google, social media, etc.) and associated authentication tokens on the device.

Question 92: When using EnCase's remote acquisition feature, what software must be running on the target machine?

SAFE Authentication Server
EnScript Daemon
EnCase Enterprise Agent (servlet) (Correct answer)
EnCase Examiner Desktop

Correct answer: EnCase Enterprise Agent (servlet)

The EnCase Enterprise Agent (servlet) must be deployed and running on the target endpoint to enable remote acquisition and analysis.

Question 93: When EnCase identifies Internet history artifacts in a forensic investigation, how should the examiner represent browser cache data in the report?

As confirmed user visits with timestamps
As artifacts recovered from cache with a note that cache population can be automated (Correct answer)
As proof of deliberate user intent to visit the site
As deleted data with no probative value

Correct answer: As artifacts recovered from cache with a note that cache population can be automated

Browser cache can be populated automatically by background processes, email links, or pre-fetching, so the report must distinguish recovered cache artifacts from deliberate user navigation.

Question 94: When a EnCE professional faces pressure to compromise professional standards, the BEST response is to:

Comply to maintain workplace relationships
Immediately resign from the position
Ignore the pressure and continue without reporting
Document the pressure and uphold professional standards (Correct answer)

Correct answer: Document the pressure and uphold professional standards

Question 95: An EnCase examiner wants to recover deleted files from an NTFS volume. The primary record to examine is:

The $Bitmap file
Master File Table (MFT) entries with the 'in-use' flag cleared (Correct answer)
The Volume Boot Record (VBR)
The $LogFile journal

Correct answer: Master File Table (MFT) entries with the 'in-use' flag cleared

Deleted NTFS files have their MFT entry flag changed from 'in-use' to 'not in-use'; EnCase can parse these entries to recover file metadata and locate remaining data.

Question 96: What is defense in depth in the context of EnCE security?

Focusing only on perimeter security
Implementing multiple layers of security controls (Correct answer)
Using one strong security control
Relying solely on encryption

Correct answer: Implementing multiple layers of security controls

Defense in depth uses multiple layers of security controls so that if one layer fails, additional layers continue to provide protection.

Question 97: When examining a deleted email in an EnCase PST analysis, what does 'soft delete' mean?

The email was archived to a separate PST
The email was permanently wiped with DoD standards
The email's header was zeroed out but the body remains
The email is moved to the Deleted Items folder but still recoverable (Correct answer)

Correct answer: The email is moved to the Deleted Items folder but still recoverable

A soft delete in Outlook moves the message to the Deleted Items folder; the data is retained and fully recoverable until the folder is emptied.

Question 98: An examiner finds evidence of EnCase's EnScript automation was used to process the evidence. What should the report document about this?

The specific EnScript used, its version, and its purpose in the examination (Correct answer)
Only the final output of the EnScript
EnScript runs are proprietary and need not be disclosed
EnScripts are not admissible as part of forensic methodology

Correct answer: The specific EnScript used, its version, and its purpose in the examination

Any automated tool or script used in the examination must be documented, including its name, version, and purpose, to allow peer review and challenge of the methodology.

Question 99: When an EnCase examiner writes conclusions in a forensic report, what standard of language is most appropriate?

Absolute certainty statements to project confidence to the jury
Legal conclusions about guilt or innocence
Vague language to avoid being challenged on cross-examination
Qualified statements reflecting the weight of evidence (e.g., 'consistent with', 'indicates', 'suggests') (Correct answer)

Correct answer: Qualified statements reflecting the weight of evidence (e.g., 'consistent with', 'indicates', 'suggests')

Forensic conclusions should use qualified, evidence-based language that accurately reflects the strength of the findings without overclaiming or misrepresenting certainty.

Question 100: Why is hashing used during evidence collection?

Verify data integrity (Correct answer)
Add encryption
Resize images
Modify timestamps

Correct answer: Verify data integrity

Hashing, specifically using algorithms like MD5 or SHA-1/SHA-256, generates a unique digital fingerprint for a set of data. During evidence collection, a hash of the original media is taken before and after acquisition to mathematically prove that the acquired image is an exact, unaltered copy of the original. This process verifies data integrity and ensures evidence admissibility.

EnCase Certified Examiner (EnCE) Certification Exam

The EnCE certification validates a candidate's proficiency in using EnCase software for digital forensics investigations, including evidence acquisition, analysis, and reporting.

100

Questions

120 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

opentext.com — Test delivery, eligibility, fees, exam format, passing score, renewal, retake policy, score release, time limit, score validity · verified Oct 2026