clapgeek logo
You are working in a computer forensic lab. A law enforcement investigator brings you a computer and a valid search warrant. You have legal authority to search the computer. The investigator hands you a piece of paper that has three printed checks on it. All three checks have the same check and account number. You image the suspect's computer and open the evidence file with EnCase. You perform a text search for the account number and check number. Nothing returns on the search results. You perform a text search for all other information found on the printed checks and there is still nothing returned in the search results. You run a signature analysis and check the gallery. You cannot locate any graphical copies of the printed checks in the gallery. At this point, is it safe to say that the checks are not located on the suspect computer?
When an EnCase user double-clicks on a file within EnCase what determines the action that will result?
In Windows 98 and ME, Internet based e-mail, such as Hotmail, will most likely be recovered in the _____________________ folder.
The following keyword was typed in exactly as shown. Choose the answer(s) that would result. All search criteria have default settings. Tom Jones
In Windows 2000 and XP, which of the following directories contain user personal folders?
You are conducting an investigation and have encountered a computer that is running in the field. The operating system is Windows XP. A software program is currently running and is visible on the screen. You should:
Within EnCase, you highlight a range of data within a file. The length indicator displays the value 30. How many bytes have you actually selected?
You are assigned to assist with the search and seizure of several computers. The magistrate ordered that the computers cannot be seized unless they are found to contain any one of ten previously identified images. You currently have the ten images in JPG format. Using the EnCase methodology, how would you best handle this situation?
You are at an incident scene and determine that a computer contains evidence as described in the search warrant. When you seize the computer, you should:
By default, EnCase will display the data from the end of a logical file, to the end of the cluster, in what color:
EnCase marks a file as overwritten when _____________ has been allocated to another file.
Calls to the C:\ volume of the hard drive are not made by DOS when a computer is booted with a standard DOS 6.22 boot disk.
The EnCase evidence file logical filename can be changed without affecting the verification of the acquired evidence.
TESTED 06 May 2024