EnCE Evidence Acquisition & Preservation 2 — Questions and Answers
Question 1: When acquiring evidence from a live system, which volatile data should be collected FIRST according to the order of volatility?
- Swap space contents
- CPU registers and cache (Correct answer)
- Temporary file system data
- Network configuration
Correct answer: CPU registers and cache
CPU registers and cache are the most volatile data and must be collected first as they are lost the moment collection is delayed.
Question 2: What is the primary purpose of a write-blocker during forensic evidence acquisition?
- To speed up the imaging process
- To prevent any data from being written to the source drive (Correct answer)
- To verify hash values after acquisition
- To compress the acquired image file
Correct answer: To prevent any data from being written to the source drive
A write-blocker prevents any write commands from reaching the source drive, ensuring the original evidence remains unaltered.
Question 3: An examiner acquires a forensic image and the MD5 hash of the image does not match the hash taken at acquisition. What does this indicate?
- The acquisition software has a bug
- The image file has been altered or is corrupt (Correct answer)
- MD5 is no longer a valid hashing algorithm
- The source drive has bad sectors
Correct answer: The image file has been altered or is corrupt
A hash mismatch between acquisition and verification indicates the image data has changed, meaning it was altered or became corrupt.
Question 4: Which EnCase acquisition format stores the image in multiple segments with embedded hash verification?
- RAW/DD format
- EnCase Evidence File (E01) (Correct answer)
- AFF format
- ISO format
Correct answer: EnCase Evidence File (E01)
The E01 (Expert Witness Format) stores the forensic image in compressed, segmented files with embedded CRC and MD5 hash values.
Question 5: During a network-based acquisition in EnCase, what protocol is used by the SAFE (Secure Authentication For EnCase) servlet?
- FTP over SSL
- Proprietary encrypted protocol over TCP (Correct answer)
- SMB with Kerberos authentication
- HTTP with digest authentication
Correct answer: Proprietary encrypted protocol over TCP
EnCase's SAFE servlet uses a proprietary encrypted TCP-based protocol to securely communicate between the examiner and the target machine.
Question 6: What is a 'sparse acquisition' in the context of EnCase evidence collection?
- An acquisition that skips encrypted sectors
- An acquisition that only captures allocated files and file system metadata (Correct answer)
- An acquisition made without a write blocker
- An acquisition of only the first and last sectors of a drive
Correct answer: An acquisition that only captures allocated files and file system metadata
A sparse acquisition captures only allocated file system data and metadata rather than imaging the entire drive sector by sector.
Question 7: When documenting chain of custody for digital evidence, which element is NOT typically required?
- Date and time of collection
- Name of person who collected the evidence
- The monetary value of the device (Correct answer)
- Description of the evidence item
Correct answer: The monetary value of the device
Chain of custody documentation tracks who handled evidence and when, but the monetary value of the device is not a required chain of custody element.
EnCE Evidence Acquisition & Preservation 2
When acquiring evidence from a live system, which volatile data should be collected FIRST according to the order of volatility?