EnCE Report Writing 3 — Questions and Answers
Question 1: When EnCase identifies Internet history artifacts in a forensic investigation, how should the examiner represent browser cache data in the report?
- As proof of deliberate user intent to visit the site
- As artifacts recovered from cache with a note that cache population can be automated (Correct answer)
- As confirmed user visits with timestamps
- As deleted data with no probative value
Correct answer: As artifacts recovered from cache with a note that cache population can be automated
Browser cache can be populated automatically by background processes, email links, or pre-fetching, so the report must distinguish recovered cache artifacts from deliberate user navigation.
Question 2: What does 'chain of custody' documentation in a forensic report establish?
- The suspect's criminal history
- The chronological transfer, possession, and handling of evidence items (Correct answer)
- The list of all investigators on the case
- The tool versions used during examination
Correct answer: The chronological transfer, possession, and handling of evidence items
Chain of custody documents the chronological record of who possessed, transferred, and handled evidence to demonstrate that it was not altered or tampered with.
Question 3: An examiner uses EnCase to recover fragmented files from unallocated space. How should these recovered files be characterized in the report?
- As fully intact files with guaranteed content accuracy
- As potentially incomplete fragments whose content may be partial or mixed with other data (Correct answer)
- As securely deleted files that cannot be used as evidence
- As files with confirmed ownership by the suspect
Correct answer: As potentially incomplete fragments whose content may be partial or mixed with other data
Fragmented files recovered from unallocated space may be incomplete or contain overwritten segments, and the report must accurately convey this uncertainty about their completeness.
Question 4: Which section of a forensic report should contain the examiner's professional qualifications, certifications, and relevant experience?
- Findings section
- Methodology section
- Curriculum vitae or qualifications section (Correct answer)
- Executive summary
Correct answer: Curriculum vitae or qualifications section
The examiner's qualifications, certifications (such as EnCE), and experience are placed in a dedicated CV or qualifications section to establish their competency as an expert witness.
Question 5: When reporting on deleted file recovery using EnCase, the examiner should note that recovery success depends on:
- The suspect's cooperation during investigation
- Whether the clusters previously occupied by the file have been overwritten since deletion (Correct answer)
- The age of the suspect's operating system
- Whether antivirus software was installed
Correct answer: Whether the clusters previously occupied by the file have been overwritten since deletion
Deleted file recovery depends on whether the file's allocated clusters have been reused by new data; if overwritten, the original content is unrecoverable.
Question 6: In an EnCase report, what is the significance of reporting the 'physical offset' of a piece of evidence?
- It indicates the geographic location where the device was seized
- It provides the exact byte location within the forensic image for independent verification (Correct answer)
- It identifies which investigator found the evidence
- It specifies the file system type of the evidence
Correct answer: It provides the exact byte location within the forensic image for independent verification
Reporting the physical offset allows any examiner with access to the forensic image to navigate directly to that byte location and independently verify the finding.
Question 7: A forensic report discusses artifacts found in Windows Registry hives. What should the examiner clarify about Registry timestamps?
- Registry key LastWriteTime is the only reliable timestamp in Windows forensics
- Registry LastWriteTime reflects the last modification to the key but not necessarily to individual values within it (Correct answer)
- Registry timestamps are set by EnCase and are always accurate
- Registry timestamps cannot be used in court
Correct answer: Registry LastWriteTime reflects the last modification to the key but not necessarily to individual values within it
Windows Registry LastWriteTime records when the key itself was last written, but individual value modifications within that key do not update to a separate timestamp.
EnCE Report Writing 3
When EnCase identifies Internet history artifacts in a forensic investigation, how should the examiner represent browser cache data in the report?