EnCE Data Analysis & Reporting 4 — Questions and Answers
Question 1: Which EnCase analysis technique calculates the mathematical average pixel color of an image to assist in identifying potential contraband?
- Skin Tone Detection (Correct answer)
- Hash Analysis
- Entropy Analysis
- EXIF Parsing
Correct answer: Skin Tone Detection
Skin tone detection algorithms analyze the color distribution of images to flag those with high proportions of skin-tone pixels for further review.
Question 2: In EnCase, what does a high entropy value (close to 8.0) in a file typically indicate?
- The file is a plain text document
- The file is compressed or encrypted (Correct answer)
- The file has been recently accessed
- The file system has errors
Correct answer: The file is compressed or encrypted
High entropy (near 8.0 bits per byte) indicates the data is highly random, characteristic of encrypted, compressed, or packed files.
Question 3: Which Windows artifact tracks user access to the Control Panel and specific system settings, useful for proving intent?
- Prefetch files
- UserAssist registry keys (Correct answer)
- MUICache
- SRUM database
Correct answer: UserAssist registry keys
UserAssist registry keys record GUI-launched application and Control Panel usage with execution counts and timestamps under HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist.
Question 4: An examiner is analyzing a suspect's USB activity on Windows. Which artifact provides the most reliable evidence of specific USB devices previously connected?
- SYSTEM hive USBSTOR key (Correct answer)
- Prefetch files
- Event Log System.evtx
- LNK files
Correct answer: SYSTEM hive USBSTOR key
The USBSTOR registry key in the SYSTEM hive records the device description, serial number, and connection history for USB storage devices connected to the system.
Question 5: When documenting findings in an EnCase report for litigation, what is the significance of including hash values for each piece of evidence?
- It reduces file size of the report
- It proves the evidence has not been altered since acquisition (Correct answer)
- It speeds up subsequent searches
- It identifies the file type automatically
Correct answer: It proves the evidence has not been altered since acquisition
Hash values serve as a digital fingerprint that demonstrates evidence integrity, proving that data has not been modified since it was originally acquired.
Question 6: In EnCase, which view would best help an examiner identify clusters of related email communications between a specific sender and recipient?
- Timeline View
- Table View sorted by date
- Email Thread View (Correct answer)
- Gallery View
Correct answer: Email Thread View
Email Thread View in EnCase organizes messages by conversation thread, making it easy to trace related communications between specific parties.
Question 7: An examiner discovers a file whose allocated size is significantly larger than its logical size. What does this represent?
- File system corruption
- Slack space containing potentially recoverable data (Correct answer)
- An encrypted file container
- A sparse file with compressed content
Correct answer: Slack space containing potentially recoverable data
The difference between a file's allocated (cluster-rounded) size and its logical size is called file slack, which may contain remnants of previously stored data.
EnCE Data Analysis & Reporting 4
Which EnCase analysis technique calculates the mathematical average pixel color of an image to assist in identifying potential contraband?