EnCE Data Analysis & Reporting 5

Question 1

Which EnCase feature allows an examiner to compare two evidence images to identify files that exist in one but not the other?

Accepted Answer

Hash Analysis with set comparison

Answer

Hash Analysis in EnCase can compare hash sets from two evidence sources, identifying files unique to each image through set difference operations.

Question 2

During analysis of a Windows 10 system, an examiner wants to determine network-connected application data usage. Which database provides this information?

Accepted Answer

SRUM (System Resource Usage Monitor) database

Answer

The SRUM database (srudb.dat) records per-application network data usage, CPU time, and energy consumption with timestamps, providing rich behavioral evidence.

Question 3

In EnCase, what does the 'Selected' checkbox state on a file entry control?

Accepted Answer

Whether the file is included in search operations and exports

Answer

The Selected checkbox in EnCase determines which items are included in subsequent search, export, and processing operations performed by the examiner.

Question 4

An EnCase examiner is preparing testimony and must explain how a specific file was recovered from unallocated space. Which concept is most important to convey?

Accepted Answer

The distinction between logical deletion and physical overwriting

Answer

Explaining that deletion removes file system pointers but not data helps the court understand why forensically recoverable files may still exist in unallocated space.

Question 5

When an EnCase report is submitted as evidence, why is it critical to document the exact version of EnCase software used during the investigation?

Accepted Answer

To allow opposing counsel to replicate results and validate reproducibility

Answer

Documenting the EnCase version ensures findings are reproducible and defensible, as opposing experts can use the same version to independently verify the analysis.

(EnCE) EnCase Certified Examiner Practice Test

(EnCE) EnCase Certified Examiner Practice Test

EnCE Data Analysis & Reporting 5