QUESTION: 29

This question addresses the EnCase for Windows search process. If a target word is within a logical file, and it begins in cluster 10 and ends in cluster 15 (the word is fragmented), the search:

Will not find it unlessile slack is checked on the search dialog box.
Will find it because EnCase performs a logical search.
Will not find it because EnCase performs a physical search only.
Will not find it because the letters of the keyword are not contiguous.

Answer(s): B

Show Answer Next Question

QUESTION: 30

An evidence file was archived onto five CD-Rom disks with the third file segment on disk number three. Can the contents of the third file segment be verified by itself while still on the CD?

No. Archived files are compressed and cannot be verified until un-archived.
No. All file segments must be put back together.
Yes. Any segment of an evidence file can be verified through re-computing and comparing the CRCs, even if it is on a CD.
No. EnCase cannot verify files on CDs.

Answer(s): C

Show Answer Next Question