EnCE EnCase Software 4

Question 1

An examiner acquires a drive using EnCase and later finds the verification hash does not match the acquisition hash. The most likely cause is:

Accepted Answer

The evidence data was altered or corrupted after acquisition

Answer

A hash mismatch between acquisition and verification indicates that the data changed after acquisition, raising serious chain-of-custody concerns.

Question 2

In EnCase, 'unallocated clusters' refer to:

Accepted Answer

Disk space not currently assigned to any active file by the file system

Answer

Unallocated clusters are areas of a disk that the file system does not currently assign to any live file, but which may contain remnants of previously deleted files.

Question 3

Which EnCase feature specifically helps identify when a file was last accessed, modified, or created using NTFS metadata?

Accepted Answer

MACE timestamps displayed in the file's attributes

Answer

EnCase surfaces MACE timestamps (Modified, Accessed, Created, Entry Modified) from NTFS MFT records, which are critical for timeline analysis.

Question 4

In EnCase, the 'Hash Library' is used to:

Accepted Answer

Compare file hashes against known-good or known-bad hash sets (e.g., NSRL)

Answer

The Hash Library allows examiners to import hash sets (like NIST NSRL) and automatically flag or exclude files whose hashes match known categories.

Question 5

When using EnCase's remote acquisition feature, what software must be running on the target machine?

Accepted Answer

EnCase Enterprise Agent (servlet)

Answer

The EnCase Enterprise Agent (servlet) must be deployed and running on the target endpoint to enable remote acquisition and analysis.

(EnCE) EnCase Certified Examiner Practice Test

(EnCE) EnCase Certified Examiner Practice Test

EnCE EnCase Software 4