EnCE Report Writing 2

Question 1

When documenting hash values in a forensic report, which algorithm is currently considered the minimum standard for evidentiary integrity verification?

Accepted Answer

SHA-256 or stronger

Answer

SHA-256 or stronger is the current minimum standard because MD5 and SHA-1 are vulnerable to collision attacks that could undermine evidentiary integrity.

Question 2

In an EnCase forensic report, what is the primary purpose of including a 'Limitations' section?

Accepted Answer

To document scope restrictions, tool constraints, and conditions that may affect findings

Answer

A Limitations section transparently discloses scope restrictions, tool constraints, and environmental conditions that could affect the completeness or interpretation of findings.

Question 3

Which EnCase feature generates an itemized list of all files examined, including deleted files, that should be referenced in the formal report?

Accepted Answer

File list report

Answer

The File List report in EnCase provides an itemized inventory of all files including deleted and unallocated entries that were part of the examination scope.

Question 4

A forensic report states that a file was 'created' on a specific date. What caveat should accompany this finding?

Accepted Answer

Filesystem timestamps can be manipulated and may not reflect true creation time

Answer

Filesystem timestamps can be altered by anti-forensic tools, file copies, or timezone changes, so reports must note they may not reflect the true original creation event.

Question 5

When referencing EnCase bookmarks in a formal report, the examiner should ensure that:

Accepted Answer

Each bookmark reference corresponds to a verifiable location within the acquired evidence file

Answer

Every bookmark referenced in the report must map to a verifiable, reproducible location within the forensic image so opposing counsel or another examiner can independently verify the finding.

(EnCE) EnCase Certified Examiner Practice Test

(EnCE) EnCase Certified Examiner Practice Test

EnCE Report Writing 2