EnCE File Systems & Artifact Examination 4

Question 1

When examining an Ext4 Linux file system, which structure is analogous to the NTFS MFT record and stores file metadata?

Accepted Answer

Inode

Answer

Inodes in Ext4 store file metadata (permissions, timestamps, owner, data block pointers) but do not store the filename, which is kept in directory entries.

Question 2

In a FAT file system, what happens to a directory entry when a file is deleted?

Accepted Answer

The first byte of the filename is replaced with 0xE5

Answer

FAT marks a directory entry as deleted by writing 0xE5 (sigma character) into the first byte of the file name field, leaving the rest of the entry — including cluster chain start — intact.

Question 3

What is 'slack space' in file system forensics?

Accepted Answer

The unused space between the end of file data and the end of the last allocated cluster

Answer

File slack comprises RAM slack (padded with zeros or RAM contents to sector boundary) and drive slack (remaining sectors in the last cluster), which may contain remnant data from previously stored files.

Question 4

Which EnCase artifact analysis capability specifically helps identify web browsing history from Internet Explorer and Edge (EdgeHTML)?

Accepted Answer

IE/Edge Artifact parser under Artifacts > Internet Explorer

Answer

EnCase includes a dedicated Internet Explorer/Edge artifact parser that reads the ESE database (WebCacheV01.dat) to extract URLs, visit counts, and timestamps.

Question 5

What is the purpose of the Volume Shadow Copy Service (VSS) from a forensic standpoint?

Accepted Answer

It creates point-in-time snapshots that may preserve deleted files and earlier file versions

Answer

VSS shadow copies can contain versions of files and directories from earlier points in time, allowing examiners to recover deleted content or view a system's state before evidence was destroyed.

(EnCE) EnCase Certified Examiner Practice Test

(EnCE) EnCase Certified Examiner Practice Test

EnCE File Systems & Artifact Examination 4