EnCE Report Writing 2 — Questions and Answers
Question 1: When documenting hash values in a forensic report, which algorithm is currently considered the minimum standard for evidentiary integrity verification?
- MD5 alone is sufficient
- SHA-1 alone is sufficient
- SHA-256 or stronger (Correct answer)
- CRC32 checksum
Correct answer: SHA-256 or stronger
SHA-256 or stronger is the current minimum standard because MD5 and SHA-1 are vulnerable to collision attacks that could undermine evidentiary integrity.
Question 2: In an EnCase forensic report, what is the primary purpose of including a 'Limitations' section?
- To excuse investigator errors
- To document scope restrictions, tool constraints, and conditions that may affect findings (Correct answer)
- To reduce the examiner's legal liability
- To list all software versions used
Correct answer: To document scope restrictions, tool constraints, and conditions that may affect findings
A Limitations section transparently discloses scope restrictions, tool constraints, and environmental conditions that could affect the completeness or interpretation of findings.
Question 3: Which EnCase feature generates an itemized list of all files examined, including deleted files, that should be referenced in the formal report?
- Bookmark report
- File list report (Correct answer)
- Case Analyzer output
- Timeline report
Correct answer: File list report
The File List report in EnCase provides an itemized inventory of all files including deleted and unallocated entries that were part of the examination scope.
Question 4: A forensic report states that a file was 'created' on a specific date. What caveat should accompany this finding?
- NTFS timestamps are always accurate
- Filesystem timestamps can be manipulated and may not reflect true creation time (Correct answer)
- Creation timestamps are the most reliable of all NTFS timestamps
- The date is certified by the EnCase tool automatically
Correct answer: Filesystem timestamps can be manipulated and may not reflect true creation time
Filesystem timestamps can be altered by anti-forensic tools, file copies, or timezone changes, so reports must note they may not reflect the true original creation event.
Question 5: When referencing EnCase bookmarks in a formal report, the examiner should ensure that:
- Bookmarks are deleted after the report is finalized
- Each bookmark reference corresponds to a verifiable location within the acquired evidence file (Correct answer)
- Bookmarks are only used in internal notes, never in court reports
- Bookmark descriptions are written by legal counsel
Correct answer: Each bookmark reference corresponds to a verifiable location within the acquired evidence file
Every bookmark referenced in the report must map to a verifiable, reproducible location within the forensic image so opposing counsel or another examiner can independently verify the finding.
Question 6: What is the correct way to report findings from EnCase's keyword search results in a formal forensic report?
- List only hits that support the prosecution's theory
- Report all keyword hits with context, location, and relevance determination (Correct answer)
- Summarize hits numerically without file locations
- Only include hits verified by a second tool
Correct answer: Report all keyword hits with context, location, and relevance determination
All keyword hits should be reported with their context, file location, and relevance determination to ensure completeness and avoid accusations of cherry-picking evidence.
Question 7: In an EnCE-level forensic report, how should an examiner handle evidence that is exculpatory (favorable to the subject)?
- Include it only if requested by the defense
- Omit it to simplify the report
- Include all exculpatory findings with the same rigor as inculpatory findings (Correct answer)
- Mention it only in a verbal briefing to the attorney
Correct answer: Include all exculpatory findings with the same rigor as inculpatory findings
Professional forensic examiners must report all material findings including exculpatory evidence with equal rigor, as withholding such evidence is unethical and potentially unlawful.
EnCE Report Writing 2
When documenting hash values in a forensic report, which algorithm is currently considered the minimum standard for evidentiary integrity verification?