EnCE Data Analysis & Reporting 3

Question 1

In an EnCase investigation, an examiner needs to identify all URLs visited in Google Chrome. Which SQLite database file should be analyzed?

Accepted Answer

History

Answer

Chrome stores browsing history, including visited URLs and timestamps, in the 'History' SQLite database located in the user's Chrome profile.

Question 2

Which EnCase feature enables an examiner to search for file fragments in unallocated clusters using known file signatures?

Accepted Answer

File Carving

Answer

File carving in EnCase searches unallocated space for known file header and footer signatures to recover deleted or fragmented files.

Question 3

During data analysis, an examiner notes that a file's 'Created' timestamp is later than its 'Modified' timestamp. What is the most likely explanation?

Accepted Answer

The file was copied to this location after it was last modified

Answer

When a file is copied, the 'Created' timestamp reflects the copy time while 'Modified' retains the original modification time, resulting in Created being newer.

Question 4

What EnCase condition would an examiner use to filter results to only show files larger than 1 GB with a .vmdk extension?

Accepted Answer

A compound condition using file size AND file extension criteria

Answer

EnCase's Condition Manager supports compound conditions combining multiple criteria such as file size and extension to narrow search results precisely.

Question 5

In EnCase, which Windows artifact stores evidence of program execution including run count and last execution time on Windows 10?

Accepted Answer

AmCache.hve

Answer

AmCache.hve on Windows 10 records program execution evidence including SHA1 hashes, first run time, and file metadata for executed applications.

(EnCE) EnCase Certified Examiner Practice Test

(EnCE) EnCase Certified Examiner Practice Test

EnCE Data Analysis & Reporting 3