EnCE Digital Forensics Fundamentals & EnCase Interface 2 — Questions and Answers
Question 1: In EnCase, what is the primary purpose of the 'Conditions' feature?
- To set password protection on evidence files
- To filter and display files matching specific criteria during analysis (Correct answer)
- To create encrypted containers for sensitive data
- To schedule automated backups of case data
Correct answer: To filter and display files matching specific criteria during analysis
EnCase Conditions act as filters that allow examiners to display only files meeting specified criteria, such as file type, date range, or size.
Question 2: Which EnCase evidence file format supports logical evidence collection and is commonly used for email archives?
- .E01
- .Ex01
- .L01 (Correct answer)
- .DD
Correct answer: .L01
The .L01 (Logical Evidence File) format is used in EnCase to store logical items such as email archives, specific files, or folders rather than full disk images.
Question 3: What does the EnCase 'Blue Ribbon' icon on a file indicate?
- The file has been bookmarked for review (Correct answer)
- The file is encrypted and cannot be read
- The file has been selected as part of an active search hit
- The file is a system-protected operating file
Correct answer: The file has been bookmarked for review
A blue ribbon (bookmark flag) in EnCase indicates that the examiner has bookmarked that item for later reference or inclusion in a report.
Question 4: During EnCase evidence processing, what is the function of 'hash analysis' in relation to the NSRL?
- It encrypts evidence files for secure storage
- It identifies files that are known good or known bad by comparing hashes to the NSRL database (Correct answer)
- It rebuilds deleted files from unallocated space
- It verifies the integrity of the EnCase application itself
Correct answer: It identifies files that are known good or known bad by comparing hashes to the NSRL database
Hash analysis compares file hashes against the National Software Reference Library (NSRL) to flag known operating system or application files, allowing examiners to focus on potentially relevant user data.
Question 5: Which area of the EnCase interface displays the raw hexadecimal content of a selected file or sector?
- Table pane
- Tree pane
- View pane (Hex tab) (Correct answer)
- Report pane
Correct answer: View pane (Hex tab)
The View pane in EnCase provides multiple tabs including Hex, Text, Doc, and Picture, with the Hex tab displaying raw hexadecimal data for the selected item.
Question 6: What is the significance of a file's 'logical size' versus its 'physical size' in EnCase?
- Logical size is the file's compressed size; physical size is its uncompressed size
- Logical size is the actual data content; physical size includes slack space due to cluster allocation (Correct answer)
- Logical size refers to the number of file system entries; physical size is the on-disk storage
- They are always identical in NTFS file systems
Correct answer: Logical size is the actual data content; physical size includes slack space due to cluster allocation
Logical size is the actual amount of data in a file, while physical size reflects the total clusters allocated including file slack — a forensically significant area that may contain remnant data.
Question 7: In EnCase, what is the 'Case Processor' primarily used for?
- Converting evidence files between E01 and Ex01 formats
- Automating multiple processing tasks such as hash analysis, signature analysis, and indexing simultaneously (Correct answer)
- Generating final court-ready HTML reports
- Synchronizing case data across multiple examiner workstations
Correct answer: Automating multiple processing tasks such as hash analysis, signature analysis, and indexing simultaneously
The EnCase Case Processor automates batch processing tasks including hash analysis, file signature analysis, index creation, and more, saving significant manual effort.
EnCE Digital Forensics Fundamentals & EnCase Interface 2
In EnCase, what is the primary purpose of the 'Conditions' feature?