EnCE Report Writing 3

Question 1

When EnCase identifies Internet history artifacts in a forensic investigation, how should the examiner represent browser cache data in the report?

Accepted Answer

As artifacts recovered from cache with a note that cache population can be automated

Answer

Browser cache can be populated automatically by background processes, email links, or pre-fetching, so the report must distinguish recovered cache artifacts from deliberate user navigation.

Question 2

What does 'chain of custody' documentation in a forensic report establish?

Accepted Answer

The chronological transfer, possession, and handling of evidence items

Answer

Chain of custody documents the chronological record of who possessed, transferred, and handled evidence to demonstrate that it was not altered or tampered with.

Question 3

An examiner uses EnCase to recover fragmented files from unallocated space. How should these recovered files be characterized in the report?

Accepted Answer

As potentially incomplete fragments whose content may be partial or mixed with other data

Answer

Fragmented files recovered from unallocated space may be incomplete or contain overwritten segments, and the report must accurately convey this uncertainty about their completeness.

Question 4

Which section of a forensic report should contain the examiner's professional qualifications, certifications, and relevant experience?

Accepted Answer

Curriculum vitae or qualifications section

Answer

The examiner's qualifications, certifications (such as EnCE), and experience are placed in a dedicated CV or qualifications section to establish their competency as an expert witness.

Question 5

When reporting on deleted file recovery using EnCase, the examiner should note that recovery success depends on:

Accepted Answer

Whether the clusters previously occupied by the file have been overwritten since deletion

Answer

Deleted file recovery depends on whether the file's allocated clusters have been reused by new data; if overwritten, the original content is unrecoverable.

(EnCE) EnCase Certified Examiner Practice Test

(EnCE) EnCase Certified Examiner Practice Test

EnCE Report Writing 3