Chapter 5: EnCase Concepts
1. D. An EnCase evidence file is a bitstream image of a source device such as a hard drive, CD-ROM, or floppy disk written to a file (.Ex01) or several file segments (.Ex02, .Ex03, and so on).
2. D. EnCase writes a CRC value for every 64 sectors copied, by default. If the block size has been increased, the CRC frequency will be adjusted accordingly.
3. D. The smallest file size that an EnCase evidence file can be saved as is 30 MB.
4. D. The largest file size that an EnCase evidence file can be saved as is now 8,589,934,588 GB with EnCase 7. Naturally the file system storing the file must support this file size.
5. A. EnCase compares the MD5 hash value (alternatively SHA-1 or both) of the source device to the MD5 ...
Get EnCE EnCase Computer Forensics: The Official EnCase Certified Examiner Study Guide, 3rd Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
