EnCE Data Analysis & Reporting 2

Question 1

In EnCase, which feature allows an examiner to create a visual timeline of file system events based on MAC times?

Accepted Answer

Timeline View

Answer

Timeline View in EnCase plots file system events against MAC (Modified, Accessed, Created) timestamps to visualize activity chronology.

Question 2

When analyzing Windows Registry hives in EnCase, which hive contains user-specific MRU (Most Recently Used) file lists?

Accepted Answer

NTUSER.DAT

Answer

NTUSER.DAT is the user-specific registry hive that stores MRU lists, recent documents, and other per-user activity artifacts.

Question 3

Which EnCase report format is best suited for sharing findings with non-technical stakeholders who need a readable document?

Accepted Answer

HTML

Answer

HTML reports in EnCase produce formatted, human-readable documents suitable for non-technical audiences and court presentation.

Question 4

An examiner finds a file with a .jpg extension but the header bytes read '50 4B 03 04'. What does this indicate?

Accepted Answer

The file is a ZIP archive masquerading as a JPEG

Answer

The magic bytes '50 4B 03 04' (PK signature) identify a ZIP-format file; a .jpg extension mismatch indicates deliberate obfuscation or renaming.

Question 5

In EnCase, what is the purpose of the 'Sweep' feature within the EnScript environment?

Accepted Answer

Scans all selected evidence files with a chosen EnScript

Answer

The Sweep feature executes a selected EnScript across multiple evidence items or cases in batch, automating repetitive analysis tasks.

(EnCE) EnCase Certified Examiner Practice Test