EnCE Data Analysis & Reporting 5 — Questions and Answers
Question 1: Which EnCase feature allows an examiner to compare two evidence images to identify files that exist in one but not the other?
- Keyword Search
- Hash Analysis with set comparison (Correct answer)
- File Carving
- Condition Filters
Correct answer: Hash Analysis with set comparison
Hash Analysis in EnCase can compare hash sets from two evidence sources, identifying files unique to each image through set difference operations.
Question 2: During analysis of a Windows 10 system, an examiner wants to determine network-connected application data usage. Which database provides this information?
- Prefetch database
- SRUM (System Resource Usage Monitor) database (Correct answer)
- WMI repository
- Event log Security.evtx
Correct answer: SRUM (System Resource Usage Monitor) database
The SRUM database (srudb.dat) records per-application network data usage, CPU time, and energy consumption with timestamps, providing rich behavioral evidence.
Question 3: In EnCase, what does the 'Selected' checkbox state on a file entry control?
- Whether the file is included in hash calculations
- Whether the file is included in search operations and exports (Correct answer)
- Whether the file is flagged as evidence
- Whether the file's timestamps are locked
Correct answer: Whether the file is included in search operations and exports
The Selected checkbox in EnCase determines which items are included in subsequent search, export, and processing operations performed by the examiner.
Question 4: An EnCase examiner is preparing testimony and must explain how a specific file was recovered from unallocated space. Which concept is most important to convey?
- The file's entropy value
- The distinction between logical deletion and physical overwriting (Correct answer)
- The file's MIME type classification
- The hash set category the file belongs to
Correct answer: The distinction between logical deletion and physical overwriting
Explaining that deletion removes file system pointers but not data helps the court understand why forensically recoverable files may still exist in unallocated space.
Question 5: When an EnCase report is submitted as evidence, why is it critical to document the exact version of EnCase software used during the investigation?
- To satisfy software licensing requirements
- To allow opposing counsel to replicate results and validate reproducibility (Correct answer)
- To determine billing for the investigation
- To enable automatic report updates
Correct answer: To allow opposing counsel to replicate results and validate reproducibility
Documenting the EnCase version ensures findings are reproducible and defensible, as opposing experts can use the same version to independently verify the analysis.
Question 6: Which Windows artifact would help an examiner establish that a user opened a specific document stored on an external drive, even after the drive has been removed?
- Thumbcache database
- Recent Items LNK files with volume serial number (Correct answer)
- AppCompatCache
- Amcache.hve
Correct answer: Recent Items LNK files with volume serial number
LNK files in the Recent Items folder contain the volume serial number and drive letter of the source device, linking a user to a specific external drive even after removal.
Question 7: In EnCase, when exporting data for use by other forensic tools, which format preserves the most metadata and is most widely accepted across platforms?
- Plain text (.txt)
- E01 (Expert Witness Format) (Correct answer)
- DOCX
Correct answer: E01 (Expert Witness Format)
E01 format preserves complete disk image data with embedded metadata, hash values, and case information, making it the most interoperable format for forensic tool exchange.
EnCE Data Analysis & Reporting 5
Which EnCase feature allows an examiner to compare two evidence images to identify files that exist in one but not the other?