EnCE Digital Forensics Fundamentals & EnCase Interface 4 — Questions and Answers
Question 1: Which of the following best describes the concept of 'unallocated space' in a digital forensics investigation?
- Space reserved by the operating system for kernel use only
- Disk space not currently assigned to any active file but potentially containing recoverable deleted file data (Correct answer)
- Space between the MBR and the first partition on a disk
- Encrypted sectors protected by BitLocker that cannot be examined
Correct answer: Disk space not currently assigned to any active file but potentially containing recoverable deleted file data
Unallocated space consists of sectors no longer assigned to active files (often from deleted files), making it a critical area for recovering deleted content in a forensic investigation.
Question 2: In EnCase, what does the 'Sweep Enterprise' feature enable that standard single-machine EnCase does not?
- Acquisition of RAM from a live system over a network
- Remote simultaneous forensic collection and triage across multiple networked endpoints (Correct answer)
- Automated generation of Daubert-compliant reports
- Synchronization of hash libraries across multiple forensic labs
Correct answer: Remote simultaneous forensic collection and triage across multiple networked endpoints
EnCase Endpoint Investigator (formerly Sweep Enterprise) enables remote, network-based forensic collection and analysis across many endpoints simultaneously without requiring physical access to each machine.
Question 3: When EnCase identifies a file's hash as matching a 'Notable' hash set, what should the examiner conclude?
- The file is a known clean operating system file that can be excluded from review
- The file is potentially significant and warrants immediate attention, as it matches hashes of known contraband or malware (Correct answer)
- The file's hash could not be computed due to encryption
- The file contains embedded metadata indicating it was accessed by a specific user
Correct answer: The file is potentially significant and warrants immediate attention, as it matches hashes of known contraband or malware
A 'Notable' hash set match (such as CAID for CSAM) flags a file as known contraband or malware, requiring the examiner to immediately document the finding and follow established legal protocols.
Question 4: What is the MFT (Master File Table) in an NTFS file system, and why is it important in EnCase investigations?
- A compressed index of all installed software, used to verify program authenticity
- The central NTFS database containing metadata records for every file and folder, critical for file recovery and timeline analysis (Correct answer)
- A log of all network connections made by the operating system
- A hash table mapping physical sectors to logical file system addresses
Correct answer: The central NTFS database containing metadata records for every file and folder, critical for file recovery and timeline analysis
The NTFS MFT stores a record for every file and directory including timestamps, file size, and data location; EnCase parses the MFT to display the file system and recover deleted file metadata.
Question 5: In EnCase, what is the purpose of 'Bookmarks' and how are they typically used in a forensic examination?
- Bookmarks encrypt selected files with a password for secure handoff to prosecutors
- Bookmarks allow examiners to flag and annotate specific items of interest for inclusion in reports and presentations (Correct answer)
- Bookmarks permanently delete files from the evidence image to save processing time
- Bookmarks create a write-protected copy of selected files for independent verification
Correct answer: Bookmarks allow examiners to flag and annotate specific items of interest for inclusion in reports and presentations
Bookmarks in EnCase let examiners tag items of evidentiary interest with notes or annotations, organizing findings for report generation and courtroom presentation.
Question 6: Which timestamp does NTFS maintain that records the last time a file's MFT entry itself was modified (distinct from file content changes)?
- Created ($STDINFO)
- Last Accessed ($STDINFO)
- Entry Modified ($STDINFO) (Correct answer)
- Last Written ($STDINFO)
Correct answer: Entry Modified ($STDINFO)
NTFS tracks four timestamps per file: Created, Last Written, Last Accessed, and Entry Modified ($MTIME in $STANDARD_INFORMATION); Entry Modified records when the MFT record itself was last changed, which differs from when the file's content changed.
Question 7: What is 'timestomping' in the context of anti-forensics, and how can EnCase help detect it?
- Overwriting sectors with random data to prevent file recovery, detected by entropy analysis
- Deliberately altering file timestamps to mislead investigators about when files were created or accessed, detectable by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps (Correct answer)
- Embedding malware in timestamp metadata fields of JPG images
- Spoofing the system clock during evidence acquisition to invalidate hash verification
Correct answer: Deliberately altering file timestamps to mislead investigators about when files were created or accessed, detectable by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps
Timestomping uses tools to modify $STANDARD_INFORMATION timestamps, but $FILE_NAME timestamps (updated only by the file system kernel) are harder to alter — discrepancies between the two in EnCase indicate potential manipulation.
EnCE Digital Forensics Fundamentals & EnCase Interface 4
Which of the following best describes the concept of 'unallocated space' in a digital forensics investigation?