A FAT directory has as a logical size of:
EnCase can build a hash set of a selected group of files.
4 bits allows what number of possibilities?
A standard Windows 98 boot disk is acceptable for booting a suspect drive.
Pressing the power button on a computer that is running could have which of the following results?
When undeleting a file in the FAT file system, EnCase will check the _____________ to see if it has already been overwritten.
The case file should be archived with the evidence files at the termination of a case.
The EnCase evidence file is best described as:
The Unicode system can address ____ characters?
How does EnCase verify that the case information (Case Number, Evidence Number, Investigator Name, etc) in an evidence file has not been damaged or changed, after the evidence file has been written?
