EnCE Evidence Acquisition & Preservation

Question 1

What is the purpose of write blockers in evidence acquisition?

Accepted Answer

Prevent data alteration

Answer

Speed up copying

Answer

Delete temporary files

Answer

Format the disk

Question 2

Which file format is commonly used for forensic image acquisition?

Accepted Answer

.E01

Answer

.mp4

Answer

.zip

Answer

.exe

Question 3

Why is hashing used during evidence collection?

Accepted Answer

Verify data integrity

Answer

Add encryption

Answer

Resize images

Answer

Modify timestamps

Question 4

What must be documented in a chain of custody form?

Accepted Answer

Evidence transfer history

Answer

Witness names

Answer

Suspect’s hobbies

Answer

File size only

Question 5

Which method is preferred for live system acquisition?

Accepted Answer

Full format

Answer

Memory dump

Answer

Cold reboot

Answer

Logoff

Question 6

What is volatile data?

Accepted Answer

Temporary system data

Answer

Hard drive info

Answer

Archived files

Answer

Stored backup

Question 7

What tool does EnCase use for acquiring images?

Accepted Answer

EnCase Imager

Answer

Paint

Answer

Command Prompt

Answer

Disk Cleaner

Question 8

What is the first step in digital evidence preservation?

Accepted Answer

Isolate and secure device

Answer

Delete logs

Answer

Connect to Wi-Fi

Answer

Encrypt all data

Question 9

Why is bit-stream imaging used?

Accepted Answer

Clone exact drive contents

Answer

Shrink files

Answer

Improve graphics

Answer

Install patches