EnCE EnCase Software 5

Question 1

In EnCase, which report element can an examiner include to show the exact byte offset of a piece of evidence within the forensic image?

Accepted Answer

Bookmark with sector/offset annotation

Answer

Bookmarks in EnCase can include the precise sector and byte offset of flagged data, providing verifiable evidence location for court documentation.

Question 2

What is the purpose of EnCase's 'Index Search' compared to a raw keyword search?

Accepted Answer

Index Search is faster because it queries a pre-built word index rather than scanning raw data

Answer

Index Search queries the pre-built index created by the Evidence Processor, making it significantly faster than scanning raw bytes — though it only finds indexed terms.

Question 3

An examiner using EnCase notices a file's logical size is 1 KB but its physical size shows 4 KB. This difference represents:

Accepted Answer

File slack — the unused space at the end of the last allocated cluster

Answer

The gap between logical size (actual file content) and physical size (allocated cluster space) is file slack, which can contain residual data from prior files.

Question 4

In EnCase, NTFS Alternate Data Streams (ADS) are significant in forensics because they:

Accepted Answer

Can hide data attached to a file without being visible through normal OS tools

Answer

ADS allows additional data streams to be attached to NTFS files; they are invisible in standard directory listings, making them a common data-hiding technique.

Question 5

When EnCase displays a 'Protected' status for a file during evidence processing, it typically indicates:

Accepted Answer

The file is encrypted or password-protected and could not be fully parsed

Answer

A 'Protected' file status in EnCase indicates the file is encrypted, password-protected, or otherwise inaccessible to normal parsing by the processor.

(EnCE) EnCase Certified Examiner Practice Test

(EnCE) EnCase Certified Examiner Practice Test

EnCE EnCase Software 5