Which of the following items could contain digital evidence?
What information should be obtained from the BIOS during computer forensic investigations?
Calls to the C:\ volume of the hard drive are not made by DOS when a computer is booted with a standard DOS 6.22 boot disk.
What information in a FAT file system directory entry refers to the location of a file on the hard drive?
The case number in an evidence file can be changed without causing the verification feature to report an error, if:
EnCase can build a hash set of a selected group of files.
The results of a hash analysis on an evidence file that has been added to a case will be stored in which of the following files?
By default, EnCase will display the data from the end of a logical file, to the end of the cluster, in what color:
The maximum file segment size for an EnCase evidence file is:
A restored floppy diskette will have the same hash value as the original diskette.
