EnCE Data Analysis & Reporting 4

Question 1

Which EnCase analysis technique calculates the mathematical average pixel color of an image to assist in identifying potential contraband?

Accepted Answer

Skin Tone Detection

Answer

Skin tone detection algorithms analyze the color distribution of images to flag those with high proportions of skin-tone pixels for further review.

Question 2

In EnCase, what does a high entropy value (close to 8.0) in a file typically indicate?

Accepted Answer

The file is compressed or encrypted

Answer

High entropy (near 8.0 bits per byte) indicates the data is highly random, characteristic of encrypted, compressed, or packed files.

Question 3

Which Windows artifact tracks user access to the Control Panel and specific system settings, useful for proving intent?

Accepted Answer

UserAssist registry keys

Answer

UserAssist registry keys record GUI-launched application and Control Panel usage with execution counts and timestamps under HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist.

Question 4

An examiner is analyzing a suspect's USB activity on Windows. Which artifact provides the most reliable evidence of specific USB devices previously connected?

Accepted Answer

SYSTEM hive USBSTOR key

Answer

The USBSTOR registry key in the SYSTEM hive records the device description, serial number, and connection history for USB storage devices connected to the system.

Question 5

When documenting findings in an EnCase report for litigation, what is the significance of including hash values for each piece of evidence?

Accepted Answer

It proves the evidence has not been altered since acquisition

Answer

Hash values serve as a digital fingerprint that demonstrates evidence integrity, proving that data has not been modified since it was originally acquired.

(EnCE) EnCase Certified Examiner Practice Test

(EnCE) EnCase Certified Examiner Practice Test

EnCE Data Analysis & Reporting 4