EnCE Evidence Acquisition & Preservation 2

Question 1

When acquiring evidence from a live system, which volatile data should be collected FIRST according to the order of volatility?

Accepted Answer

CPU registers and cache

Answer

CPU registers and cache are the most volatile data and must be collected first as they are lost the moment collection is delayed.

Question 2

What is the primary purpose of a write-blocker during forensic evidence acquisition?

Accepted Answer

To prevent any data from being written to the source drive

Answer

A write-blocker prevents any write commands from reaching the source drive, ensuring the original evidence remains unaltered.

Question 3

An examiner acquires a forensic image and the MD5 hash of the image does not match the hash taken at acquisition. What does this indicate?

Accepted Answer

The image file has been altered or is corrupt

Answer

A hash mismatch between acquisition and verification indicates the image data has changed, meaning it was altered or became corrupt.

Question 4

Which EnCase acquisition format stores the image in multiple segments with embedded hash verification?

Accepted Answer

EnCase Evidence File (E01)

Answer

The E01 (Expert Witness Format) stores the forensic image in compressed, segmented files with embedded CRC and MD5 hash values.

Question 5

During a network-based acquisition in EnCase, what protocol is used by the SAFE (Secure Authentication For EnCase) servlet?

Accepted Answer

Proprietary encrypted protocol over TCP

Answer

EnCase's SAFE servlet uses a proprietary encrypted TCP-based protocol to securely communicate between the examiner and the target machine.

(EnCE) EnCase Certified Examiner Practice Test