EnCE Evidence Acquisition & Preservation 4

Question 1

What is a Device Configuration Overlay (DCO) and why is it forensically significant?

Accepted Answer

A hidden drive area set by manufacturer or user that can conceal data

Answer

A DCO is a drive feature that can reduce the reported drive size, hiding sectors that could contain evidence from both the OS and standard acquisition tools.

Question 2

An examiner is acquiring a virtual machine (VM). Which approach best preserves all forensic artifacts?

Accepted Answer

Capture a snapshot, then acquire the VMDK, memory, and snapshot files

Answer

Capturing the VM snapshot along with VMDK and memory files preserves the full system state, including running processes and open network connections.

Question 3

Why is it important to record the system time and actual UTC time before acquiring evidence from a computer?

Accepted Answer

To correct timestamps in log files and determine the system clock offset

Answer

Recording both the system time and UTC time reveals the clock offset, which is critical for accurately interpreting file timestamps and log entries.

Question 4

When using EnCase to acquire evidence over a network from a running system, the EnCase Servlet must be installed on the target. What security concern does this raise?

Accepted Answer

Installing the servlet modifies the target system, which must be documented as part of acquisition

Answer

Installing the servlet on a live system changes the system's state, which must be fully documented so it can be accounted for and explained during legal proceedings.

Question 5

What is the correct action when EnCase reports read errors (bad sectors) during a physical acquisition?

Accepted Answer

Allow EnCase to log the bad sectors and continue; document the errors in the case notes

Answer

EnCase logs bad sectors and pads them with zeros in the image, allowing acquisition to continue; examiners should document these errors without altering the source drive.

(EnCE) EnCase Certified Examiner Practice Test

(EnCE) EnCase Certified Examiner Practice Test

EnCE Evidence Acquisition & Preservation 4