EnCE Evidence Acquisition & Preservation 4 — Questions and Answers
Question 1: What is a Device Configuration Overlay (DCO) and why is it forensically significant?
- A BIOS setting that controls boot order
- A hidden drive area set by manufacturer or user that can conceal data (Correct answer)
- A partition type used by Linux systems
- A write-protection mechanism built into modern drives
Correct answer: A hidden drive area set by manufacturer or user that can conceal data
A DCO is a drive feature that can reduce the reported drive size, hiding sectors that could contain evidence from both the OS and standard acquisition tools.
Question 2: An examiner is acquiring a virtual machine (VM). Which approach best preserves all forensic artifacts?
- Power off the VM and image only the VMDK file
- Capture a snapshot, then acquire the VMDK, memory, and snapshot files (Correct answer)
- Log into the VM and use network acquisition tools
- Acquire only the VM configuration file
Correct answer: Capture a snapshot, then acquire the VMDK, memory, and snapshot files
Capturing the VM snapshot along with VMDK and memory files preserves the full system state, including running processes and open network connections.
Question 3: Why is it important to record the system time and actual UTC time before acquiring evidence from a computer?
- To calculate the drive's RPM speed
- To correct timestamps in log files and determine the system clock offset (Correct answer)
- To synchronize the write-blocker with the evidence drive
- To measure acquisition speed in sectors per second
Correct answer: To correct timestamps in log files and determine the system clock offset
Recording both the system time and UTC time reveals the clock offset, which is critical for accurately interpreting file timestamps and log entries.
Question 4: When using EnCase to acquire evidence over a network from a running system, the EnCase Servlet must be installed on the target. What security concern does this raise?
- The servlet permanently alters the target system's registry
- Installing the servlet modifies the target system, which must be documented as part of acquisition (Correct answer)
- The servlet disables antivirus software on the target
- The servlet creates hidden administrator accounts
Correct answer: Installing the servlet modifies the target system, which must be documented as part of acquisition
Installing the servlet on a live system changes the system's state, which must be fully documented so it can be accounted for and explained during legal proceedings.
Question 5: What is the correct action when EnCase reports read errors (bad sectors) during a physical acquisition?
- Stop the acquisition immediately and contact law enforcement
- Allow EnCase to log the bad sectors and continue; document the errors in the case notes (Correct answer)
- Re-image the drive using a different acquisition tool
- Use disk repair utilities to fix the bad sectors before continuing
Correct answer: Allow EnCase to log the bad sectors and continue; document the errors in the case notes
EnCase logs bad sectors and pads them with zeros in the image, allowing acquisition to continue; examiners should document these errors without altering the source drive.
Question 6: Which of the following best describes the 'chain of custody' requirement for digital evidence?
- A log showing only who collected the original evidence
- A continuous, documented record of who had possession of evidence and when (Correct answer)
- A technical report of the acquisition hash values
- A list of all tools used during forensic examination
Correct answer: A continuous, documented record of who had possession of evidence and when
Chain of custody is an unbroken, documented record of every person who possessed the evidence from collection through presentation in court.
Question 7: An examiner is instructed to acquire a server that cannot be taken offline. Which EnCase feature supports this scenario?
- EnCase Physical Disk Emulator
- EnCase Enterprise with network-based live acquisition (Correct answer)
- EnCase Portable with offline imaging
- EnCase Forensic with direct SATA attachment
Correct answer: EnCase Enterprise with network-based live acquisition
EnCase Enterprise supports live, network-based acquisition of running systems without requiring the target system to be powered down.
EnCE Evidence Acquisition & Preservation 4
What is a Device Configuration Overlay (DCO) and why is it forensically significant?