EMT Practice Test

1. Question Content...

---

Question1: If cases are worked on a lab drive in a secure room, without any cleaning of the contents of the drive, which of the following areas would be of most concern?

Question2: Assume that MyNote.txt was allocated to clusters 5, 9, and 11. Cluster 6, 7, and 8 belong to MyResume.doc. Both files have been deleted and the directory entry in the FAT file system for MyResume.doc has been overwritten. What clusters would EnCase use to undelete MyNote.txt?

Question3: What are the EnCase configuration .ini files used for?

Question4: When Unicode is selected for a search keyword, EnCase:

Question5: For an EnCase evidence file acquired with a hash value to pass verification, which of the following must be true?

Question6: If cluster #3552 entry in the FAT table contains a value of ?? this would mean:

Question7: A restored floppy diskette will have the same hash value as the original diskette.

Question8: When a file is deleted in the FAT file system, what happens to the FAT?

Question9: If a hash analysis is run on a case, EnCase:

Question10: By default, what color does EnCase use for the contents of a logical file

Question11: Search results are found in which of the following files? Select all that apply.

Question12: Which statement would most accurately describe a motherboard?

Question13: To undelete a file in the FAT file system, EnCase computes the number of _______ the file will use based on the file ______.

Question14: If an evidence file has been added to a case and completely verified, what happens if the data area within the evidence file is later changed?

Question15: ROM is an acronym for:

Question16: Within EnCase, clicking on Save on the toolbar affects what file(s)?

Question17: A sector on a hard drive contains how many bytes?

Question18: An EnCase evidence file of a hard drive ________ be restored to another hard drive of equal or greater size.

Question19: What does the acronym BIOS stand for?

Question20: The EnCase case file can be best described as:

Question21: Two allocated files can occupy one cluster, as long as they can both fit within the allotted number of bytes.

Question22: Temp files created by EnCase are deleted when EnCase is properly closed.

Question23: This question addresses the EnCase for Windows search process. If a target word is within a logical file, and it begins in cluster 10 and ends in cluster 15 (the word is fragmented), the search:

Question24: When a file is deleted in the FAT or NTFS file systems, what happens to the data on the hard drive?

Question25: The results of a hash analysis on an evidence file that has been added to a case will be stored in which of the following files?

Question26: If a hard drive is left in a room while acquiring, and several persons have access to that room, which of the following areas would be of most concern?

Question27: The following keyword was typed in exactly as shown. Choose the answer(s) that would result. All search criteria have default settings. Tom Jones

Question28: A hard drive has 8 sectors per cluster. File Mystuff.doc has a logical file size of 13,000 bytes. How many clusters will be used by Mystuff.doc?

Question29: The following keyword was typed in exactly as shown. Choose the answer(s) that would result. All search criteria have default settings. Speed and Meth

Question30: The EnCase default export folder is:

Question31: When a non-compressed evidence file is reacquired with compression, the acquisition and verification hash values for the evidence will remain the same for both files.

Question32: To later verify the contents of an evidence file 7RODWHUYHULI
\WKHFRQWHQWVRIDQHYLGHQFHILOH

Question33: Search terms are stored in what .ini configuration file

Question34: How are the results of a signature analysis examined?

Question35: A physical file size is:

Question36: A case file can contain ____ hard drive images?

Question37: The following keyword was typed in exactly as shown. Choose the answer(s) that would result. All search criteria have default settings. credit card

Question38: Which of the following would most likely be an add-in card?

Question39: In DOS and Windows, how many bytes are in one FAT directory entry?

Question40: When an EnCase user double-clicks on a file within EnCase what determines the action that will result?
Select all that apply

Question41: Which of the following items could contain digital evidence?

Question42: Select the appropriate name for the highlighted area of the binary numbers.

Question43: EnCase can make an image of a USB flash drive.

Question44: The end of a logical file to the end of the cluster that the file ends in is called:

Question45: All investigators using EnCase should run tests on the evidence file acquisition and verification process to:

Question46: Within EnCase, you highlight a range of data within a file. The length indicator displays the value 30. How many bytes have you actually selected?

Question47: The BIOS chip on an IBM clone computer is most commonly located on:

Question48: Which is the proper formula for determining the size in bytes of a hard drive that uses cylinders (C), heads (H), and sectors (S) geometry?

Question49: A logical file would be best described as:

Question50: In Unicode, one printed character is composed of ____ bytes of data.

Question51: A signature analysis has been run on a case. The result "Bad Signature " means:

Question52: In DOS acquisition mode, if a physical drive is detected, but no partition information is displayed, what would be the cause:

Question53: The MD5 hash algorithm produces a _____ number.

Question54: In Windows, the file MyNote.txt is deleted from C Drive and is automatically sent to the Recycle Bin. The long filename was MyNote.txt and the short filename was MYNOTE.TXT. When viewing the Recycle Bin with EnCase, how will the long filename and MyNote.txt and the short filename was MYNOTE.TXT?

Question55: A CPU is:

Question56: Will EnCase allow a user to write data into an acquired evidence file

Question57: How many copies of the FAT are located on a FAT 32, Windows 98-formatted partition?

Question58: The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result.
[^a-z] Tom[^a-z]

Question59: What information should be obtained from the BIOS during computer forensic investigations?

Question60: The acronym ASCII stands for:

Question61: Which of the following would be a true statement about the function of the BIOS?

Question62: The Unicode system can address ____ characters?

Question63: EnCase marks a file as overwritten when _____________ has been allocated to another file.

Question64: Which of the following selections would be used to keep track of a fragmented file in the FAT file system?

Question65: When handling computer evidence, an investigator should:

Question66: Consider the following path in a FAT file system:

Question67: In the FAT file system, the size of a deleted file can be found:

Question68: How does EnCase verify that the case information (Case Number, Evidence Number, Investigator Name, etc) in an evidence file has not been damaged or changed, after the evidence file has been written?

Question69: You are at an incident scene and determine that a computer contains evidence as described in the search warrant. When you seize the computer, you should:

Question70: An evidence file was archived onto five CD-Rom disks with the third file segment on disk number three.
Can the contents of the third file segment be verified by itself while still on the CD?

Question71: Which of the following selections is NOT found in the case file

Question72: A standard Windows 98 boot disk is acceptable for booting a suspect drive.

Question73: Before utilizing an analysis technique on computer evidence, the investigator should:

Question74: In Windows 2000 and XP, which of the following directories contain user personal folders?

Question75: A hard drive was imaged using EnCase. The original drive was placed into evidence. The restore feature was used to make a copy of the original hard drive. EnCase verifies the restored copy using:

Question76: What information in a FAT file system directory entry refers to the location of a file on the hard drive?

Question77: The maximum file segment size for an EnCase evidence file is:

Question78: Search terms are case sensitive by default.

Question79: Hash libraries are commonly used to:

Question80: Which of the following statements is more accurate?

Question81: The boot partition table found at the beginning of a hard drive is located in what sector?

Question82: By default, what color does EnCase use for slack?

Question83: The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result.
Jan 1st, 2?0?00

Question84: Within EnCase, what is the purpose of the temp folder?

Question85: RAM is tested during which phase of the power-up sequence?

Question86: Searches and bookmarks are stored in the evidence file.

Question87: A signature analysis has been run on a case. The result "JPEG" in the signature column means:

Question88: The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result.
Bob@ [a-z]+.com

Question89: Bookmarks are stored in which of the following files?

Question90: Pressing the power button on a computer that is running could have which of the following results?

Question91: To generate an MD5 hash value for a file, EnCase:

Question92: The EnCase methodology dictates that ________ be created prior to acquiring evidence.

Question93: The EnCase methodology dictates that the lab drive for evidence have a __________ prior to making an image.

Question94: If a floppy diskette is in the drive, the computer will always boot to that drive before any other device.

Question95: You are assigned to assist with the search and seizure of several computers. The magistrate ordered that the computers cannot be seized unless they are found to contain any one of ten previously identified images. You currently have the ten images in JPG format. Using the EnCase methodology, how would you best handle this situation?

Question96: When a document is printed using EMF in Windows, what file(s) are generated in the spooling process?

Question97: How many copies of the FAT are located on a FAT 32, Windows 98-formatted partition?

Question98: When a file is deleted in the FAT file system, what happens to the filename?

Question99: A suspect typed a file on his computer and saved it to a floppy diskette. The filename was MyNote.txt. You receive the floppy and the suspect computer. The suspect denies that the floppy disk belongs to him. You search the suspect computer an d locate only the filename within a .LNK file. The .LNK file is located in the folder C:\Windows\Recent. How you would use the .LNK file to establish a connection between the file on the floppy diskette and the suspect computer?

Question100: When does the POST operation occur?

Question101: The EnCase evidence file logical filename can be changed without affecting the verification of the acquired evidence.

Question102: The EnCase evidence file is best described as:

Question103: EnCase can build a hash set of a selected group of files.

Question104: 4 bits allows what number of possibilities?

Question105: A file extension and signature can be manually added by:

Question106: The first sector on a volume is called the:

Question107: A hash library would most accurately be described as:

Question108: A SCSI host adapter would most likely perform which of the following tasks?

Question109: RAM is used by the computer to:

Question110: Which of the following aspects of the EnCase evidence file can be changed during a reacquire of the evidence file

Question111: RAM is an acronym for:

Question112: You are investigating a case involving fraud. You seized a computer from a suspect who stated that the computer is not used by anyone other than himself. The computer has Windows 98 installed on the hard drive. You find the filename C:\downloads\check01.jpg that EnCase shows as being moved. The starting extent is 0C4057. You find another filename :\downloads\chk1.dll with the starting extent 0C4057, which EnCase also shows as being moved. In the C:\Windows\System folder you find an allocated file named chk1.dll with the starting extent 0C4057. The chk1.dll file is a JPEG image of a counterfeit check. What can be deduced from your findings?

Question113: Within EnCase for Windows, the search process is:

Question114: Using good forensic practices, when seizing a computer at a business running Windows 2000 Server you should:

Question115: The default export folder remains the same for all cases.

Question116: This question addresses the EnCase for Windows search process. If a target word is located in the unallocated space, and the word is fragmented between clusters 10 and 15, the search:

Question117: To undelete a file in the FAT file system, EnCase obtains the starting extent from the:

Question118: The term signature and header as they relate to a signature analysis are

Question119: How many clusters can a FAT 16 system address?

Question120: A SCSI drive is pinned as a master when it is:

Question121: The case file should be archived with the evidence files at the termination of a case.

Question122: When an EnCase user double-clicks on a valid .jpg file, that file is:

Question123: During the power-up sequence, which of the following happens first?

Question124: GREP terms are automatically recognized as GREP by EnCase.

Question125: The Windows 98 Start Menu has a selection called documents which displays a list of recently used files.
Which of the following The Windows 98 Start Menu has a selection called documents which displays a list of recently used files. Which of the following folders contain those files?

Question126: You are working in a computer forensic lab. A law enforcement investigator brings you a computer and a valid search warrant. You have legal authority to search the computer. The investigator hands you a piece of paper that has three printed checks on it. All three checks have the same check and account number.
You image the suspect computer and open the evidence file with EnCase. You checks have the same check and account number. You image the suspect's computer and open the evidence file with EnCase.
You perform a text search for the account number and check number. Nothing returns on the search results. You perform a text search for all other information found on the printed checks and there is still nothing returned in the search results. You run a signature analysis and check the gallery. You cannot locate any graphical copies of the printed checks in the gallery. At this point, is it safe to say that the checks are not located on the suspect computer?

Question127: Assume that an evidence file is added to a case, the case is saved, and the case is closed. What happens if the evidence file is moved, and the case is then opened?

Question128: The FAT in the File Allocation Table file system keeps track of:

Question129: What files are reconfigured or deleted by EnCase during the creation of an EnCase boot disk?

Question130: EnCase is able to read and examine which of the following file systems?

Question131: The temporary folder of a case cannot be changed once it has been set.

Question132: In the EnCase environment, the term external viewers is best described as:

Question133: When a drive letter is assigned to a logical volume, that information is temporarily written the volume boot record on the hard drive.

Question134: In hexadecimal notation, one byte is represented by _____ character(s).

Question135: The following keyword was typed in exactly as shown. Choose the answer(s) that would be found. All search criteria have default settings. Tom

Question136: The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result.
800[) \-]+555-1212

Question137: A hard drive has been formatted as NTFS and Windows XP was installed. The user used fdisk to remove all partitions from that drive. Nothing else was done. You have imaged the drive and have opened the evidence file with EnCase. What would be the best way to examine this hard drive?

Question138: Which of the following is commonly used to encode e-mail attachments?

Question139: The first sector on a hard drive is called the:

Question140: You are an investigator and have encountered a computer that is running at the home of a suspect. The computer does not appear to be a part of a network. The operating system is Windows XP Home. No programs are visibly running. You should:

Question141: If cluster number 10 in the FAT contains the number 55, this means:

Question142: How many partitions can be found in the boot partition table found at the beginning of the drive?

Question143: An evidence file can be moved to another directory without changing the file verification.

Question144: You are conducting an investigation and have encountered a computer that is running in the field. The operating system is Windows XP. A software program is currently running and is visible on the screen. You should:

Question145: An Enhanced Metafile would best be described as:

Question146: When can an evidence file containing a NTFS partition be logically restored to a FAT 32 partition?

Question147: A FAT directory has as a logical size of:

Question148: A sector on a floppy disk is the same size as a sector on a NTFS formatted hard drive.

Question149: How does EnCase verify that the evidence file contains an exact copy of the suspect hard drive?

Question150: You are examining a hard drive that has Windows XP installed as the operating system. You see a file that has a date and time in the deleted column. Where does that date and time come from?

Question151: Which of the following directories contain the information that is found on a Windows 98 Desktop?

Question152: A hash set would most accurately be described as:

Question153: Which of the following is found in the FileSignatures.ini configuration file

Question154: By default, EnCase will display the data from the end of a logical file, to the end of the cluster, in what color:

Question155: The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result.
[\x00-\x05]\x00\x00\x00

Question156: You are investigating a case of child pornography on a hard drive containing Windows XP. In the C:
\Documents and Settings\Bad Guy\Local Settings\Temporary Internet Files folder you find three images of child pornography. You find no other copies of the images on the suspect hard drive, and you find no other copies of the filenames. What can be deduced from your findings?

Question157: When undeleting a file in the FAT file system, EnCase will check the _____________ to see if it has already been overwritten.

Question158: Changing the filename of a file will change the hash value of the file.

Question159: A standard DOS 6.22 boot disk is acceptable for booting a suspect drive.

Question160: Within EnCase, what is purpose of the default export folder?

Question161: The EnCase signature analysis is used to perform which of the following actions?

Question162: In Windows 98 and ME, Internet based e-mail, such as Hotmail, will most likely be recovered in the
_____________________ folder.

Question163: Calls to the C:\ volume of the hard drive are not made by DOS when a computer is booted with a standard DOS
6.22 boot disk.

Question164: The signature table data is found in which of the following files?

Question165: The case number in an evidence file can be changed without causing the verification feature to report an error, if:

Question166: Creating an image of a hard drive that was seized as evidence:

Question167: A personal data assistant was placed in an evidence locker until an examiner has time to examine it.
Which of the following areas would require special attention?

Question168: Assume that MyNote.txt has been deleted. The FAT file system directory entry for that file has been overwritten.
The data for MyNote.txt is now:

Question169: The spool files that are created during a print job are __________ after the print job is completed.

Question170: EnCase uses the _________________ to conduct a signature analysis.