EnCE File Systems & Artifact Examination 4 — Questions and Answers
Question 1: When examining an Ext4 Linux file system, which structure is analogous to the NTFS MFT record and stores file metadata?
- Superblock
- Inode (Correct answer)
- Block Group Descriptor
- Journal block
Correct answer: Inode
Inodes in Ext4 store file metadata (permissions, timestamps, owner, data block pointers) but do not store the filename, which is kept in directory entries.
Question 2: In a FAT file system, what happens to a directory entry when a file is deleted?
- The entry is zeroed out completely
- The first byte of the filename is replaced with 0xE5 (Correct answer)
- The cluster chain is immediately overwritten
- The entry is moved to a hidden deleted log
Correct answer: The first byte of the filename is replaced with 0xE5
FAT marks a directory entry as deleted by writing 0xE5 (sigma character) into the first byte of the file name field, leaving the rest of the entry — including cluster chain start — intact.
Question 3: What is 'slack space' in file system forensics?
- Unpartitioned space at the end of a disk
- The unused space between the end of file data and the end of the last allocated cluster (Correct answer)
- Free space between MFT records
- The gap between partitions in the partition table
Correct answer: The unused space between the end of file data and the end of the last allocated cluster
File slack comprises RAM slack (padded with zeros or RAM contents to sector boundary) and drive slack (remaining sectors in the last cluster), which may contain remnant data from previously stored files.
Question 4: Which EnCase artifact analysis capability specifically helps identify web browsing history from Internet Explorer and Edge (EdgeHTML)?
- SQLite viewer for WebCacheV01.dat
- IE/Edge Artifact parser under Artifacts > Internet Explorer (Correct answer)
- Registry Viewer pointed at SOFTWARE hive
- Prefetch analysis
Correct answer: IE/Edge Artifact parser under Artifacts > Internet Explorer
EnCase includes a dedicated Internet Explorer/Edge artifact parser that reads the ESE database (WebCacheV01.dat) to extract URLs, visit counts, and timestamps.
Question 5: What is the purpose of the Volume Shadow Copy Service (VSS) from a forensic standpoint?
- It encrypts volumes at rest
- It creates point-in-time snapshots that may preserve deleted files and earlier file versions (Correct answer)
- It records file hashes for integrity verification
- It manages disk quotas for user accounts
Correct answer: It creates point-in-time snapshots that may preserve deleted files and earlier file versions
VSS shadow copies can contain versions of files and directories from earlier points in time, allowing examiners to recover deleted content or view a system's state before evidence was destroyed.
Question 6: Which metadata timestamp in NTFS is updated when a file's data content is modified but NOT when only its attributes change?
- $STANDARD_INFORMATION Created ($SI_C)
- $STANDARD_INFORMATION Modified ($SI_M) (Correct answer)
- $STANDARD_INFORMATION MFT Modified ($SI_MFT)
- $FILE_NAME Created ($FN_C)
Correct answer: $STANDARD_INFORMATION Modified ($SI_M)
$SI_M (last modified) reflects the last time the file's data was written; $SI_MFT changes when any MFT metadata attribute changes, making them useful to distinguish content edits from metadata-only changes.
Question 7: In EnCase, what does 'hashing' an evidence file accomplish during the acquisition phase?
- Encrypts the image for secure storage
- Generates an MD5/SHA-1 digest to verify bit-for-bit integrity of the acquired image (Correct answer)
- Compresses the image to save storage space
- Indexes the file for keyword search
Correct answer: Generates an MD5/SHA-1 digest to verify bit-for-bit integrity of the acquired image
Hashing produces a cryptographic digest of the acquired image that can be recomputed later to prove the evidence has not been altered since acquisition.
EnCE File Systems & Artifact Examination 4
When examining an Ext4 Linux file system, which structure is analogous to the NTFS MFT record and stores file metadata?