O'Reilly logo

EnCE EnCase Computer Forensics: The Official EnCase Certified Examiner Study Guide, 3rd Edition by Steve Bunting

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Review Questions

1. When acquiring a hard drive using a Linux boot disk with LinEn, what would be the cause of EnCase (LinEn) not detecting partition information?

A. The drive has been FDisked and the partition(s) removed.

B. The partition(s) are not recognized by Linux.

C. Both A and B.

D. None of the above.

2. LinEn contains a write blocker that protects the target media from being altered.

A. True

B. False

3. As a good forensic practice, why would it be a good idea to wipe a forensic drive before reusing it?

A. Chain-of-custody

B. Cross-contamination

C. Different file and operating systems

D. Chain of evidence

E. No need to wipe

4. If the number of sectors reported by EnCase does not match the number reported by the manufacturer for the drive, ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required