EnCE Evidence Acquisition & Preservation 5

Question 1

What is the significance of the 'Cyclical Redundancy Check' (CRC) embedded in E01 file segments?

Accepted Answer

It detects errors within individual segments without requiring full image re-hashing

Answer

CRC values are embedded in each E01 segment to detect data corruption within that specific segment, enabling targeted integrity verification.

Question 2

When packaging physical evidence for transport to a lab, which environmental hazard poses the greatest risk to hard drives?

Accepted Answer

Electrostatic discharge (ESD)

Answer

Electrostatic discharge can destroy drive electronics; anti-static bags and proper grounding are essential when handling drives.

Question 3

An examiner acquires a RAID 5 array by imaging each individual physical disk. What additional step is needed before analysis?

Accepted Answer

Reconstruct the RAID stripe set in EnCase to interpret the logical volume

Answer

RAID 5 stripes data across disks; the logical volume must be reconstructed from the individual disk images before meaningful file system analysis can occur.

Question 4

Which of the following is a valid reason to perform a 'logical' acquisition instead of a physical acquisition?

Accepted Answer

The target is a cloud storage account where physical media is inaccessible

Answer

Cloud storage accounts have no physical media to image, making logical acquisition of account data (via APIs or consent-based access) the only viable option.

Question 5

During acquisition, EnCase displays 'Acquisition Verified' after computing the hash. What does this confirm?

Accepted Answer

The hash of the acquired image matches the hash computed from the source during acquisition

Answer

Acquisition Verified confirms that the MD5/SHA-1 hash of the image file matches the hash computed from the source drive, proving the image is a faithful copy.

(EnCE) EnCase Certified Examiner Practice Test

(EnCE) EnCase Certified Examiner Practice Test

EnCE Evidence Acquisition & Preservation 5