EnCE EnCase Software 4 — Questions and Answers
Question 1: An examiner acquires a drive using EnCase and later finds the verification hash does not match the acquisition hash. The most likely cause is:
- The EnScript engine modified metadata during export
- The evidence data was altered or corrupted after acquisition (Correct answer)
- The SAFE server reindexed the file
- EnCase automatically updated file timestamps
Correct answer: The evidence data was altered or corrupted after acquisition
A hash mismatch between acquisition and verification indicates that the data changed after acquisition, raising serious chain-of-custody concerns.
Question 2: In EnCase, 'unallocated clusters' refer to:
- Clusters marked as bad sectors by the operating system
- Disk space not currently assigned to any active file by the file system (Correct answer)
- Memory pages not mapped to any running process
- Sectors excluded from the forensic image
Correct answer: Disk space not currently assigned to any active file by the file system
Unallocated clusters are areas of a disk that the file system does not currently assign to any live file, but which may contain remnants of previously deleted files.
Question 3: Which EnCase feature specifically helps identify when a file was last accessed, modified, or created using NTFS metadata?
- Evidence Processor hash set comparison
- MACE timestamps displayed in the file's attributes (Correct answer)
- Keyword search across MFT entries
- Snapshot volatile capture
Correct answer: MACE timestamps displayed in the file's attributes
EnCase surfaces MACE timestamps (Modified, Accessed, Created, Entry Modified) from NTFS MFT records, which are critical for timeline analysis.
Question 4: In EnCase, the 'Hash Library' is used to:
- Store encryption keys for E01 files
- Compare file hashes against known-good or known-bad hash sets (e.g., NSRL) (Correct answer)
- Generate SHA-256 hashes of all evidence containers
- Map hash values to physical disk sectors
Correct answer: Compare file hashes against known-good or known-bad hash sets (e.g., NSRL)
The Hash Library allows examiners to import hash sets (like NIST NSRL) and automatically flag or exclude files whose hashes match known categories.
Question 5: When using EnCase's remote acquisition feature, what software must be running on the target machine?
- EnCase Examiner Desktop
- EnCase Enterprise Agent (servlet) (Correct answer)
- SAFE Authentication Server
- EnScript Daemon
Correct answer: EnCase Enterprise Agent (servlet)
The EnCase Enterprise Agent (servlet) must be deployed and running on the target endpoint to enable remote acquisition and analysis.
Question 6: In EnCase, 'file slack' consists of:
- The space between the last byte of file data and the end of its last allocated cluster (Correct answer)
- Unused sectors at the end of a disk partition
- Empty sectors in the evidence file container
- Metadata stored after the MFT entry
Correct answer: The space between the last byte of file data and the end of its last allocated cluster
File slack is the space between the logical end of a file and the physical end of its last allocated cluster, which may contain remnant data from a previously stored file.
Question 7: An EnCase examiner wants to recover deleted files from an NTFS volume. The primary record to examine is:
- The Volume Boot Record (VBR)
- Master File Table (MFT) entries with the 'in-use' flag cleared (Correct answer)
- The $LogFile journal
- The $Bitmap file
Correct answer: Master File Table (MFT) entries with the 'in-use' flag cleared
Deleted NTFS files have their MFT entry flag changed from 'in-use' to 'not in-use'; EnCase can parse these entries to recover file metadata and locate remaining data.
EnCE EnCase Software 4
An examiner acquires a drive using EnCase and later finds the verification hash does not match the acquisition hash.
The most likely cause is: