EnCE Digital Forensics Fundamentals & EnCase Interface 5 — Questions and Answers
Question 1: In EnCase, what is the difference between a 'Physical Disk' view and a 'Logical Volume' view when examining evidence?
- Physical Disk view shows only deleted files; Logical Volume view shows only active files
- Physical Disk view shows raw sectors including partition gaps and unpartitioned space; Logical Volume view shows the file system structure within a partition (Correct answer)
- Physical Disk view requires write-blocker hardware; Logical Volume view can be accessed without one
- Physical Disk view is for HDDs only; Logical Volume view supports SSDs and flash media
Correct answer: Physical Disk view shows raw sectors including partition gaps and unpartitioned space; Logical Volume view shows the file system structure within a partition
The Physical Disk view in EnCase exposes every sector of the drive including areas outside partitions, while the Logical Volume view presents the interpreted file system structure within a specific partition.
Question 2: What is the forensic significance of the Windows Recycle Bin folder ($Recycle.Bin in Vista+) when examined in EnCase?
- It stores encrypted copies of all files opened by a user for auditing purposes
- It contains deleted files with original path and deletion timestamp metadata stored in $I files, valuable for proving user intent (Correct answer)
- It holds system restore points that can be parsed to reconstruct prior system states
- It is automatically wiped when EnCase processes the evidence image
Correct answer: It contains deleted files with original path and deletion timestamp metadata stored in $I files, valuable for proving user intent
Each deleted file in the $Recycle.Bin has a corresponding $I metadata file recording the original file path and deletion timestamp, which EnCase can parse to demonstrate user intent and file provenance.
Question 3: When EnCase performs an 'Index Search,' what advantage does it provide over a standard keyword search?
- Index searches bypass write blockers for faster direct sector access
- Pre-built word indexes allow near-instantaneous searches across large evidence sets without rescanning every byte (Correct answer)
- Index searches automatically translate keywords into 14 languages simultaneously
- Index searches hash every search result for automated court submission
Correct answer: Pre-built word indexes allow near-instantaneous searches across large evidence sets without rescanning every byte
Creating an index during EnCase processing builds a word-level lookup table, allowing subsequent keyword searches to return results almost instantly rather than linearly scanning the entire evidence image.
Question 4: Which EnCase feature is specifically designed to identify and recover JPEG images from unallocated space based on file headers and footers?
- Hash Analysis
- File Carving (via EnCase or GREP-based carver) (Correct answer)
- Signature Analysis
- Link File Parsing
Correct answer: File Carving (via EnCase or GREP-based carver)
File carving searches unallocated space for known file headers (e.g., FFD8FF for JPEG) and footers (FFD9) to reconstruct files even when no file system metadata exists, and EnCase supports this both natively and through EnScripts.
Question 5: What is the role of the 'Evidence Processor' hash library in EnCase, and how does it affect investigation workflow?
- It stores encrypted copies of acquired evidence for backup purposes
- It allows examiners to import known-good and known-bad hash sets to automatically flag or exclude files during processing (Correct answer)
- It generates unique case hashes that serve as the official case identifier in court
- It computes rolling hashes of live network traffic for intrusion detection
Correct answer: It allows examiners to import known-good and known-bad hash sets to automatically flag or exclude files during processing
Hash libraries in EnCase's Evidence Processor let examiners apply known-good sets (like NSRL) to exclude irrelevant files and known-bad sets (like CAID) to automatically flag contraband, dramatically focusing the investigation.
Question 6: In EnCase, what does examining the 'Volume Shadow Copies' (VSS) on a Windows image potentially reveal to a forensic examiner?
- The system's BitLocker recovery keys stored in plaintext
- Previous versions of files and system states from before deletion or modification events (Correct answer)
- A log of all user login attempts including failed passwords
- Metadata about all USB devices ever connected to the system
Correct answer: Previous versions of files and system states from before deletion or modification events
Volume Shadow Copies (VSS) are point-in-time snapshots of the file system created by Windows; EnCase can mount and examine these to find earlier versions of files that were subsequently deleted or modified by a subject.
Question 7: What is the proper procedure in EnCase when an examiner needs to add notes or tag evidence items without altering the original evidence file?
- Open the evidence file in write mode and embed annotations directly into the E01 container
- Use EnCase's case database (.case file) and bookmarks, which store all annotations separately from the read-only evidence file (Correct answer)
- Export the evidence to a new E01 and annotate the copy, discarding the original
- Use EnScript to inject comments into the file's MFT entry
Correct answer: Use EnCase's case database (.case file) and bookmarks, which store all annotations separately from the read-only evidence file
EnCase stores all examiner notes, bookmarks, and tags in the case file (.case), completely separate from the read-only evidence files (.E01), ensuring the original evidence remains forensically unaltered.
EnCE Digital Forensics Fundamentals & EnCase Interface 5
In EnCase, what is the difference between a 'Physical Disk' view and a 'Logical Volume' view when examining evidence?