EnCE Evidence Acquisition & Preservation 5 — Questions and Answers
Question 1: What is the significance of the 'Cyclical Redundancy Check' (CRC) embedded in E01 file segments?
- It compresses the data within each segment
- It detects errors within individual segments without requiring full image re-hashing (Correct answer)
- It encrypts each segment for secure storage
- It records the acquisition date and time in each segment
Correct answer: It detects errors within individual segments without requiring full image re-hashing
CRC values are embedded in each E01 segment to detect data corruption within that specific segment, enabling targeted integrity verification.
Question 2: When packaging physical evidence for transport to a lab, which environmental hazard poses the greatest risk to hard drives?
- Exposure to cold temperatures below 32°F
- Electrostatic discharge (ESD) (Correct answer)
- Humidity above 50%
- Vibration during transport
Correct answer: Electrostatic discharge (ESD)
Electrostatic discharge can destroy drive electronics; anti-static bags and proper grounding are essential when handling drives.
Question 3: An examiner acquires a RAID 5 array by imaging each individual physical disk. What additional step is needed before analysis?
- Hash each drive image separately and compare them
- Reconstruct the RAID stripe set in EnCase to interpret the logical volume (Correct answer)
- Acquire the RAID controller's firmware
- Convert all images to RAW format before analysis
Correct answer: Reconstruct the RAID stripe set in EnCase to interpret the logical volume
RAID 5 stripes data across disks; the logical volume must be reconstructed from the individual disk images before meaningful file system analysis can occur.
Question 4: Which of the following is a valid reason to perform a 'logical' acquisition instead of a physical acquisition?
- The examiner wants to capture deleted file remnants
- The target is a cloud storage account where physical media is inaccessible (Correct answer)
- The examiner needs to verify the drive's partition table
- The target drive has a Host Protected Area
Correct answer: The target is a cloud storage account where physical media is inaccessible
Cloud storage accounts have no physical media to image, making logical acquisition of account data (via APIs or consent-based access) the only viable option.
Question 5: During acquisition, EnCase displays 'Acquisition Verified' after computing the hash. What does this confirm?
- The source drive has no bad sectors
- The hash of the acquired image matches the hash computed from the source during acquisition (Correct answer)
- The image file is stored in an authenticated E01 container
- The write-blocker functioned correctly throughout the process
Correct answer: The hash of the acquired image matches the hash computed from the source during acquisition
Acquisition Verified confirms that the MD5/SHA-1 hash of the image file matches the hash computed from the source drive, proving the image is a faithful copy.
Question 6: What is the recommended procedure when an examiner discovers a running computer with an encrypted volume that is currently mounted?
- Immediately hibernate the system to save the encryption keys in the hiberfil.sys
- Perform live memory acquisition first to capture encryption keys, then image the drive (Correct answer)
- Pull the power to preserve the encrypted state for later analysis
- Reboot into a forensic boot environment before imaging
Correct answer: Perform live memory acquisition first to capture encryption keys, then image the drive
Live memory acquisition can capture encryption keys stored in RAM, enabling later decryption of the volume — pulling power would lose this critical evidence.
Question 7: Which standard governs best practices for digital evidence acquisition and is referenced in many law enforcement forensic procedures?
- ISO 27001
- NIST SP 800-86 (Guide to Integrating Forensic Techniques into Incident Response) (Correct answer)
- PCI DSS v4.0
- COBIT 5 for Information Security
Correct answer: NIST SP 800-86 (Guide to Integrating Forensic Techniques into Incident Response)
NIST SP 800-86 provides guidance on integrating forensic techniques into incident response, including evidence acquisition best practices widely used by law enforcement.
EnCE Evidence Acquisition & Preservation 5
What is the significance of the 'Cyclical Redundancy Check' (CRC) embedded in E01 file segments?