EnCE Data Analysis & Reporting 2 — Questions and Answers
Question 1: In EnCase, which feature allows an examiner to create a visual timeline of file system events based on MAC times?
- Bookmark Manager
- Timeline View (Correct answer)
- Condition Manager
- Case Analyzer
Correct answer: Timeline View
Timeline View in EnCase plots file system events against MAC (Modified, Accessed, Created) timestamps to visualize activity chronology.
Question 2: When analyzing Windows Registry hives in EnCase, which hive contains user-specific MRU (Most Recently Used) file lists?
- SYSTEM
- SAM
- NTUSER.DAT (Correct answer)
- SOFTWARE
Correct answer: NTUSER.DAT
NTUSER.DAT is the user-specific registry hive that stores MRU lists, recent documents, and other per-user activity artifacts.
Question 3: Which EnCase report format is best suited for sharing findings with non-technical stakeholders who need a readable document?
- HTML (Correct answer)
- CSV
- TSV
- XML
Correct answer: HTML
HTML reports in EnCase produce formatted, human-readable documents suitable for non-technical audiences and court presentation.
Question 4: An examiner finds a file with a .jpg extension but the header bytes read '50 4B 03 04'. What does this indicate?
- The file is corrupt
- The file is a ZIP archive masquerading as a JPEG (Correct answer)
- The file uses JPEG 2000 encoding
- The EXIF metadata is missing
Correct answer: The file is a ZIP archive masquerading as a JPEG
The magic bytes '50 4B 03 04' (PK signature) identify a ZIP-format file; a .jpg extension mismatch indicates deliberate obfuscation or renaming.
Question 5: In EnCase, what is the purpose of the 'Sweep' feature within the EnScript environment?
- Deletes temporary analysis files
- Runs an EnScript against all cases simultaneously
- Scans all selected evidence files with a chosen EnScript (Correct answer)
- Compresses evidence containers for archiving
Correct answer: Scans all selected evidence files with a chosen EnScript
The Sweep feature executes a selected EnScript across multiple evidence items or cases in batch, automating repetitive analysis tasks.
Question 6: Which artifact would best corroborate a user's access to a specific network share on a Windows system?
- Prefetch files
- MUICache entries
- NetBIOS name cache
- LNK files referencing UNC paths (Correct answer)
Correct answer: LNK files referencing UNC paths
LNK shortcut files that reference UNC paths (e.g., \\server\share\file) directly evidence user access to specific network shares.
Question 7: When generating an EnCase report, what is the role of the 'Bookmark' in the reporting workflow?
- It marks evidence containers as read-only
- It tags selected data items for inclusion in the final report (Correct answer)
- It creates hash verification checkpoints
- It links external exhibits to the case file
Correct answer: It tags selected data items for inclusion in the final report
Bookmarks in EnCase allow examiners to tag and annotate specific data items, which are then selectively included when generating the final report.
EnCE Data Analysis & Reporting 2
In EnCase, which feature allows an examiner to create a visual timeline of file system events based on MAC times?