QUESTION NO: 1
In Windows 2000 and XP, which of the following directories contain user personal folders? In Windows 2000 and XP, which of the following directories contain user? personal folders?
In Windows 2000 and XP, which of the following directories contain user personal folders? In Windows 2000 and XP, which of the following directories contain user? personal folders?
Correct Answer: C
Vote an answer
QUESTION NO: 2
All investigators using EnCase should run tests on the evidence file acquisition and verification process to:
All investigators using EnCase should run tests on the evidence file acquisition and verification process to:
Correct Answer: D
Vote an answer
QUESTION NO: 3
You are examining a hard drive that has Windows XP installed as the operating system. You see a file that has a date and time in the eleted?column. Where does that date and time come from? ?eleted?column. Where does that date and time come from?
You are examining a hard drive that has Windows XP installed as the operating system. You see a file that has a date and time in the eleted?column. Where does that date and time come from? ?eleted?column. Where does that date and time come from?
Correct Answer: C
Vote an answer
QUESTION NO: 4
CORRECT TEXT
A sector on a floppy disk is the same size as a sector on a NTFS formatted hard drive.
CORRECT TEXT
A sector on a floppy disk is the same size as a sector on a NTFS formatted hard drive.
Correct Answer: A
Vote an answer
QUESTION NO: 5
To undelete a file in the FAT file system, EnCase computes the number of _______ the file will use based on the file ______.
To undelete a file in the FAT file system, EnCase computes the number of _______ the file will use based on the file ______.
Correct Answer: A
Vote an answer
QUESTION NO: 6
This question addresses the EnCase for Windows search process. If a target word is located in the unallocated space, and the word is fragmented between clusters 10 and 15, the search:
This question addresses the EnCase for Windows search process. If a target word is located in the unallocated space, and the word is fragmented between clusters 10 and 15, the search:
Correct Answer: B
Vote an answer
QUESTION NO: 7
Correct Answer:
You are investigating a case involving fraud. You seized a computer from a suspect who stated that the computer is not used by anyone other than himself. The computer has Windows 98 installed on the hard drive. You find the filename :\downloads\check01.jpg?that EnCase shows as being moved. The starting extent is 0C4057. You find another filename ?:\downloads\check01.jpg?that EnCase shows as being moved. The starting extent is 0C4057. You find another filename :\downloads\chk1.dll?with the starting extent 0C4057, which EnCase also shows as being moved. In the :\windows\System? ? ?GRZQORDGV?FKNGOO"ZLWKWKHVWDUWLQJH[WHQW&
QUESTION NO: 8
A suspect typed a file on his computer and saved it to a floppy diskette. The filename was MyNote.txt. You receive the floppy and the suspect computer. The suspect denies that the floppy disk belongs to him. You search the suspect computer and locate only the suspect? computer. The suspect denies that the floppy disk belongs to him. You search the suspect? computer and locate only the filename within a .LNK file. The .LNK file is located in the folder C:\Windows\Recent. How you would use the .LNK file to establish a connection between the file on the floppy diskette and the suspect computer? connection between the file on the floppy diskette and the suspect? computer?
A suspect typed a file on his computer and saved it to a floppy diskette. The filename was MyNote.txt. You receive the floppy and the suspect computer. The suspect denies that the floppy disk belongs to him. You search the suspect computer and locate only the suspect? computer. The suspect denies that the floppy disk belongs to him. You search the suspect? computer and locate only the filename within a .LNK file. The .LNK file is located in the folder C:\Windows\Recent. How you would use the .LNK file to establish a connection between the file on the floppy diskette and the suspect computer? connection between the file on the floppy diskette and the suspect? computer?
Correct Answer: D
Vote an answer
QUESTION NO: 9
You are investigating a case of child pornography on a hard drive containing Windows XP. In the :\Documents and Settings\Bad You are investigating a case of child pornography on a hard drive containing Windows XP. In the ?:\Documents and Settings\Bad Guy\Local Settings\Temporary Internet Files?folder you find three images of child pornography. You find no other copies of the images on the suspect hard drive, and you find no other copies of the filenames. What can be deduced from your findings? images on the suspect? hard drive, and you find no other copies of the filenames. What can be deduced from your findings?
You are investigating a case of child pornography on a hard drive containing Windows XP. In the :\Documents and Settings\Bad You are investigating a case of child pornography on a hard drive containing Windows XP. In the ?:\Documents and Settings\Bad Guy\Local Settings\Temporary Internet Files?folder you find three images of child pornography. You find no other copies of the images on the suspect hard drive, and you find no other copies of the filenames. What can be deduced from your findings? images on the suspect? hard drive, and you find no other copies of the filenames. What can be deduced from your findings?
Correct Answer: C
Vote an answer
QUESTION NO: 10
A signature analysis has been run on a case. The result ?*JPEG ?in the signature column means:
A signature analysis has been run on a case. The result ?*JPEG ?in the signature column means:
Correct Answer: A
Vote an answer