RAM is tested during which phase of the power-up sequence?
The Windows 98 Start Menu has a selection called documents which displays a list of recently used files. Which of the following The Windows 98 Start Menu has a selection called documents which displays a list of recently used files. Which of the following folders contain those files?
In Unicode, one printed character is composed of ____ bytes of data.
Search results are found in which of the following files? Select all that apply.
How does EnCase verify that the case information (Case Number, Evidence Number, Investigator Name, etc) in an evidence file has not been damaged or changed, after the evidence file has been written?
RAM is an acronym for:
A hash set would most accurately be described as:
Assume that MyNote.txt was allocated to clusters 5, 9, and 11. Cluster 6, 7, and 8 belong to MyResume.doc. Both files have been deleted and the directory entry in the FAT file system for MyResume.doc has been overwritten. What clusters would EnCase use to undelete MyNote.txt?
What files are reconfigured or deleted by EnCase during the creation of an EnCase boot disk?
By default, what color does EnCase use for the contents of a logical file
When an EnCase user double-clicks on a valid .jpg file, that file is:
A standard Windows 98 boot disk is acceptable for booting a suspect drive.
By default, what color does EnCase use for slack?
A hash library would most accurately be described as:
Within EnCase, clicking on Save on the toolbar affects what file(s)?
To later verify the contents of an evidence file 7RODWHUYHULI\WKHFRQWHQWVRIDQHYLGHQFHILOH
Within EnCase, you highlight a range of data within a file. The length indicator displays the value 30. How many bytes have you actually selected?
How many clusters can a FAT 16 system address?
In DOS and Windows, how many bytes are in one FAT directory entry?
Assume that MyNote.txt has been deleted. The FAT file system directory entry for that file has been overwritten.
The data for MyNote.txt is now:
When an EnCase user double-clicks on a file within EnCase what determines the action that will result? Select all that apply
4 bits allows what number of possibilities?
Temp files created by EnCase are deleted when EnCase is properly closed.
How are the results of a signature analysis examined?
The case file should be archived with the evidence files at the termination of a case.
What are the EnCase configuration .ini files used for?