問題1
The EnCase methodology dictates that ________ be created prior to acquiring evidence.
The EnCase methodology dictates that ________ be created prior to acquiring evidence.
正確答案: D
問題2
The maximum file segment size for an EnCase evidence file is:
The maximum file segment size for an EnCase evidence file is:
正確答案: A
問題3
A hash set would most accurately be described as:
A hash set would most accurately be described as:
正確答案: A
問題4
When a file is deleted in the FAT or NTFS file systems, what happens to the data on the hard drive?
When a file is deleted in the FAT or NTFS file systems, what happens to the data on the hard drive?
正確答案: A
問題5
Which statement would most accurately describe a motherboard?
Which statement would most accurately describe a motherboard?
正確答案: B
問題6
If a hash analysis is run on a case, EnCase:
If a hash analysis is run on a case, EnCase:
正確答案: D
問題7
A hard drive was imaged using EnCase. The original drive was placed into evidence. The restore feature was used to make a copy of the original hard drive. EnCase verifies the restored copy using:
A hard drive was imaged using EnCase. The original drive was placed into evidence. The restore feature was used to make a copy of the original hard drive. EnCase verifies the restored copy using:
正確答案: B
問題8
When can an evidence file containing a NTFS partition be logically restored to a FAT 32 partition?
When can an evidence file containing a NTFS partition be logically restored to a FAT 32 partition?
正確答案: A
問題9
Before utilizing an analysis technique on computer evidence, the investigator should:
Before utilizing an analysis technique on computer evidence, the investigator should:
正確答案: C
問題10
When undeleting a file in the FAT file system, EnCase will check the _____________ to see if it has already been overwritten.
When undeleting a file in the FAT file system, EnCase will check the _____________ to see if it has already been overwritten.
正確答案: A
問題11
CORRECT TEXT
Changing the filename of a file will change the hash value of the file.
CORRECT TEXT
Changing the filename of a file will change the hash value of the file.
正確答案: B
問題12
Creating an image of a hard drive that was seized as evidence:
Creating an image of a hard drive that was seized as evidence:
正確答案: B
問題13
The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. 800[) \-]+555-1212
The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. 800[) \-]+555-1212
正確答案: C
問題14
By default, EnCase will display the data from the end of a logical file, to the end of the cluster, in what color:
By default, EnCase will display the data from the end of a logical file, to the end of the cluster, in what color:
正確答案: A
問題15
CORRECT TEXT
Calls to the C:\ volume of the hard drive are not made by DOS when a computer is booted with a standard DOS 6.22 boot disk.
CORRECT TEXT
Calls to the C:\ volume of the hard drive are not made by DOS when a computer is booted with a standard DOS 6.22 boot disk.
正確答案: B