O'Reilly logo

EnCE EnCase Computer Forensics: The Official EnCase Certified Examiner Study Guide, 3rd Edition by Steve Bunting

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Review Questions

1. The EnCase evidence file is best described as follows:

A. A mirror image of the source device written to a hard drive

B. A sector-by-sector image of the source device written to corresponding sectors of a secondary hard drive

C. A bitstream image of a source device written to the corresponding sectors of a secondary hard drive

D. A bitstream image of a source device written to a file or several file segments

2. How does EnCase verify the contents of an evidence file, using the default settings?

A. EnCase writes an MD5 and/or SHA-1 hash value for every 32 sectors copied.

B. EnCase writes an MD5 and/or SHA-1 value for every 64 sectors copied.

C. EnCase writes a CRC value for every 32 sectors copied.

D. EnCase writes a CRC value ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required