EnCE Digital Forensics Fundamentals & EnCase Interface 5

Question 1

In EnCase, what is the difference between a 'Physical Disk' view and a 'Logical Volume' view when examining evidence?

Accepted Answer

Physical Disk view shows raw sectors including partition gaps and unpartitioned space; Logical Volume view shows the file system structure within a partition

Answer

The Physical Disk view in EnCase exposes every sector of the drive including areas outside partitions, while the Logical Volume view presents the interpreted file system structure within a specific partition.

Question 2

What is the forensic significance of the Windows Recycle Bin folder ($Recycle.Bin in Vista+) when examined in EnCase?

Accepted Answer

It contains deleted files with original path and deletion timestamp metadata stored in $I files, valuable for proving user intent

Answer

Each deleted file in the $Recycle.Bin has a corresponding $I metadata file recording the original file path and deletion timestamp, which EnCase can parse to demonstrate user intent and file provenance.

Question 3

When EnCase performs an 'Index Search,' what advantage does it provide over a standard keyword search?

Accepted Answer

Pre-built word indexes allow near-instantaneous searches across large evidence sets without rescanning every byte

Answer

Creating an index during EnCase processing builds a word-level lookup table, allowing subsequent keyword searches to return results almost instantly rather than linearly scanning the entire evidence image.

Question 4

Which EnCase feature is specifically designed to identify and recover JPEG images from unallocated space based on file headers and footers?

Accepted Answer

File Carving (via EnCase or GREP-based carver)

Answer

File carving searches unallocated space for known file headers (e.g., FFD8FF for JPEG) and footers (FFD9) to reconstruct files even when no file system metadata exists, and EnCase supports this both natively and through EnScripts.

Question 5

What is the role of the 'Evidence Processor' hash library in EnCase, and how does it affect investigation workflow?

Accepted Answer

It allows examiners to import known-good and known-bad hash sets to automatically flag or exclude files during processing

Answer

Hash libraries in EnCase's Evidence Processor let examiners apply known-good sets (like NSRL) to exclude irrelevant files and known-bad sets (like CAID) to automatically flag contraband, dramatically focusing the investigation.

(EnCE) EnCase Certified Examiner Practice Test

(EnCE) EnCase Certified Examiner Practice Test

EnCE Digital Forensics Fundamentals & EnCase Interface 5