The first sector on a volume is called the:
ROM is an acronym for:
Select the appropriate name for the highlighted area of the binary numbers.
In hexadecimal notation, one byte is represented by _____ character(s).
The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. Bob@[a-z]+.com
The BIOS chip on an IBM clone computer is most commonly located on:
What information should be obtained from the BIOS during computer forensic investigations?
The EnCase evidence file is best described as:
Select the appropriate name for the highlighted area of the binary numbers.
EnCase uses the _________________ to conduct a signature analysis.
If cluster #3552 entry in the FAT table contains a value of this would mean:
How does EnCase verify that the evidence file contains an exact copy of the suspect hard drive?
When a drive letter is assigned to a logical volume, that information is temporarily written the volume boot record on the hard drive.
The spool files that are created during a print job are __________ after the print job is completed.
The temporary folder of a case cannot be changed once it has been set.
A standard DOS 6.22 boot disk is acceptable for booting a suspect drive.
Which of the following would most likely be an add-in card?
Pressing the power button on a computer that is running could have which of the following results?
When does the POST operation occur?
Which of the following selections is NOT found in the case file?
When an EnCase user double-clicks on a valid .jpg file, that file is:
When Unicode is selected for a search keyword, EnCase:
How are the results of a signature analysis examined?
Which of the following would be a true statement about the function of the BIOS?
Consider the following path in a FAT file system: C:\My Documents\My Pictures\Bikes. Where does the directory bikes receive its name?
The EnCase signature analysis is used to perform which of the following actions?