EnCE Data Analysis & Reporting 3 — Questions and Answers
Question 1: In an EnCase investigation, an examiner needs to identify all URLs visited in Google Chrome. Which SQLite database file should be analyzed?
- Cookies
- History (Correct answer)
- Web Data
- Login Data
Correct answer: History
Chrome stores browsing history, including visited URLs and timestamps, in the 'History' SQLite database located in the user's Chrome profile.
Question 2: Which EnCase feature enables an examiner to search for file fragments in unallocated clusters using known file signatures?
- Hash Analysis
- File Carving (Correct answer)
- Keyword Search
- Entropy Analysis
Correct answer: File Carving
File carving in EnCase searches unallocated space for known file header and footer signatures to recover deleted or fragmented files.
Question 3: During data analysis, an examiner notes that a file's 'Created' timestamp is later than its 'Modified' timestamp. What is the most likely explanation?
- The file system is corrupt
- The file was copied to this location after it was last modified (Correct answer)
- The file was opened in a hex editor
- EnCase has a timestamp parsing error
Correct answer: The file was copied to this location after it was last modified
When a file is copied, the 'Created' timestamp reflects the copy time while 'Modified' retains the original modification time, resulting in Created being newer.
Question 4: What EnCase condition would an examiner use to filter results to only show files larger than 1 GB with a .vmdk extension?
- A hash set filter
- A compound condition using file size AND file extension criteria (Correct answer)
- An entropy filter set above 7.9
- A category filter for disk images
Correct answer: A compound condition using file size AND file extension criteria
EnCase's Condition Manager supports compound conditions combining multiple criteria such as file size and extension to narrow search results precisely.
Question 5: In EnCase, which Windows artifact stores evidence of program execution including run count and last execution time on Windows 10?
- AppCompatCache (ShimCache)
- Prefetch files
- AmCache.hve (Correct answer)
- UserAssist registry keys
Correct answer: AmCache.hve
AmCache.hve on Windows 10 records program execution evidence including SHA1 hashes, first run time, and file metadata for executed applications.
Question 6: An EnCase report must include chain-of-custody documentation. Which section should detail the examiner's credentials and methodology?
- Evidence Summary
- Examiner Qualifications and Methodology (Correct answer)
- Findings and Analysis
- Glossary of Terms
Correct answer: Examiner Qualifications and Methodology
The Examiner Qualifications and Methodology section establishes the examiner's expertise and describes the forensic process used, supporting admissibility.
Question 7: When using EnCase to analyze a FAT32 volume, which structure would the examiner examine to find file entries for deleted files?
- Master File Table (MFT)
- Directory entries with 0xE5 as the first byte (Correct answer)
- Volume Boot Record
- Partition Table
Correct answer: Directory entries with 0xE5 as the first byte
In FAT32, deleted file directory entries have their first byte set to 0xE5, preserving the remaining filename and cluster chain information for potential recovery.
EnCE Data Analysis & Reporting 3
In an EnCase investigation, an examiner needs to identify all URLs visited in Google Chrome.
Which SQLite database file should be analyzed?