Summer Special Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: exc65

examout.co

Within EnCase for Windows, the search process is:

A.

a search of the logical files

B.

a search of the physical disk in unallocated clusters and other unused disk areas

C.

both a and b

D.

None of the above

A sector on a floppy disk is the same size as a sector on a NTFS formatted hard drive.

A.

True

B.

False

When a document is printed using EMF in Windows, what file(s) are generated in the spooling process?

A.

The .SPL file

B.

The .SHD file

C.

Both a and b

D.

Neither a or b

Assume that MyNote.txt has been deleted. The FAT file system directory entry for that file has been overwritten. The data for MyNote.txt is now:

A.

Allocated

B.

Overwritten

C.

Unallocated

D.

Cross-linked

How many copies of the FAT are located on a FAT 32, Windows 98-formatted partition?

A.

1

B.

2

C.

3

D.

4

When undeleting a file in the FAT file system, EnCase will check the _____________ to see if it has already been overwritten.

A.

directory entry

B.

FAT

C.

data on the hard drive

D.

deletion table

A sector on a hard drive contains how many bytes?

A.

512

B.

1024

C.

2048

D.

4096

Which statement would most accurately describe a motherboard?

A.

An add-in card that controls all hard drive activity.

B.

An add-in card that handles all RAM.

C.

The main circuit board that has slots for the microprocessor, RAM, ROM, and add-in cards.

D.

Any circuit board, regardless of its function.

EnCase marks a file as overwritten when _____________ has been allocated to another file.

A.

any part of the file

B.

all of the file

C.

the starting cluster of the file

D.

the directory entry for the file

When a file is deleted in the FAT file system, what happens to the filename?

A.

The first character of the directory entry is marked with a hex E5.

B.

It is wiped from the directory.

C.

It is zeroed out.

D.

The first character of the directory entry is marked with a hex 00.