Exam Essentials
Know and understand the file signature process. Understand and explain what a file header is. Be able to explain what a file extension is and how it is used in a Windows environment. Understand how a file type and category are determined before and after the file signature analysis process. Understand how EnCase views files and the importance of the file signature analysis to the proper viewing of file types.
Understand the purpose and function of the File Types view. Know where the file types database is stored (FileTypes.ini). Explain how a file signature is created, modified, or deleted. Be able to explain what information is stored in a file signature record.
Understand and interpret the results of the file signature analysis. ...
Get EnCE EnCase Computer Forensics: The Official EnCase Certified Examiner Study Guide, 3rd Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
