EnCE File Systems & Artifact Examination

Question 1

What is the role of a file system in digital storage?

Accepted Answer

Manages and organizes files

Answer

Plays music

Answer

Boosts Wi-Fi

Answer

Increases RAM

Question 2

Which file systems are commonly examined in forensic cases?

Accepted Answer

NTFS, FAT32, exFAT

Answer

PNG, JPEG

Answer

HTML, CSS

Answer

AI, PSD

Question 3

What are file system artifacts?

Accepted Answer

Metadata and system records

Answer

Wallpapers

Answer

Music files

Answer

Game folders

Question 4

What does the Master File Table (MFT) store?

Accepted Answer

File metadata in NTFS

Answer

Web history

Answer

Wi-Fi passwords

Answer

Battery logs

Question 5

What is slack space in a file system?

Accepted Answer

Unallocated leftover data

Answer

Password field

Answer

Compressed folder

Answer

Search bar

Question 6

How are deleted files identified in EnCase?

Accepted Answer

Unallocated space analysis

Answer

Color coding

Answer

Search engine

Answer

Audio alert

Question 7

What is a Volume Shadow Copy?

Accepted Answer

System snapshot backup

Answer

Screen brightness setting

Answer

Cloud backup

Answer

Antivirus

Question 8

Which artifact reveals recent USB activity?

Accepted Answer

Registry entries

Answer

Screensavers

Answer

Antivirus logs

Answer

Screenshots

Question 9

How can time stamps be manipulated?

Accepted Answer

Use timestamp editing tools

Answer

Increase brightness

Answer

Log out of accounts

Answer

Delete wallpaper