EnCE EnCase Software 2

Question 1

In EnCase, what is the purpose of the 'Evidence Processor' module?

Accepted Answer

To automate tasks like file recovery, hashing, and indexing on acquired evidence

Answer

The Evidence Processor automates forensic processing tasks such as hashing, file signature analysis, deleted file recovery, and index creation.

Question 2

Which EnCase view displays all files in a case in a flat, unstructured list regardless of their folder location?

Accepted Answer

Table pane in 'Home' view

Answer

The Table pane in the Home view shows all case entries in a flat list, allowing examiners to sort and filter across all folders at once.

Question 3

What does the EnCase 'Snapshot' feature capture when run on a live system?

Accepted Answer

Volatile system data including running processes, open ports, and logged-on users

Answer

Snapshot collects volatile data from a live endpoint such as running processes, network connections, open ports, and logged-on user sessions.

Question 4

In EnCase, a 'Logical Evidence File' (L01) differs from an E01 in that it:

Accepted Answer

Contains only selected files and folders rather than a full physical image

Answer

An L01 is a logical container holding selected files/folders, while an E01 captures the full physical image including unallocated space and slack.

Question 5

Which EnCase feature allows an examiner to write a custom script to automate evidence analysis tasks?

Accepted Answer

EnScript

Answer

EnScript is EnCase's built-in programming language (C++-like) that lets examiners write custom automation scripts for evidence analysis.

(EnCE) EnCase Certified Examiner Practice Test