EMT Practice Test

1. Question Content...

---

Question1: The Windows 98 Start Menu has a selection called documents which displays a list of recently used files.
Which of the following folders contain those files?

Question2: The Unicode system can address ____ characters?

Question3: The first sector on a volume is called the:

Question4: The following keyword was typed in exactly as shown. Choose the answer(s) that would result. All search criteria have default settings. Tom Jones

Question5: The first sector on a hard drive is called the:

Question6: If a hash analysis is run on a case, EnCase:

Question7: The results of a hash analysis on an evidence file that has been added to a case will be stored in which of the following files?

Question8: Search terms are stored in what .ini configuration file?

Question9: Assume that MyNote.txt was allocated to clusters 5, 9, and 11. Cluster 6, 7, and 8 belong to MyResume.doc. Both files have been deleted and the directory entry in the FAT file system for MyResume.doc has been overwritten. What clusters would EnCase use to undelete MyNote.txt?

Question10: During the power-up sequence, which of the following happens first?

Question11: Within EnCase, what is the purpose of the temp folder?

Question12: RAM is used by the computer to:

Question13: The EnCase case file can be best described as:

Question14: EnCase is able to read and examine which of the following file systems?

Question15: When a non-compressed evidence file is reacquired with compression, the acquisition and verification hash values for the evidence will remain the same for both files.

Question16: Before utilizing an analysis technique on computer evidence, the investigator should:

Question17: A hard drive was imaged using EnCase. The original drive was placed into evidence. The restore feature was used to make a copy of the original hard drive. EnCase verifies the restored copy using:

Question18: The EnCase default export folder is:

Question19: Creating an image of a hard drive that was seized as evidence:

Question20: All investigators using EnCase should run tests on the evidence file acquisition and verification process to:

Question21: Two allocated files can occupy one cluster, as long as they can both fit within the allotted number of bytes.

Question22: A suspect typed a file on his computer and saved it to a floppy diskette. The filename was MyNote.txt.
You receive the floppy and the suspect computer. The suspect denies that the floppy disk belongs to him.
You search the suspect computer and locate only the filename within a .LNK file. The .LNK file is located in the folder C:\Windows\Recent. How you would use the .LNK file to establish a connection between the file on the floppy diskette and the suspect computer?

Question23: Which of the following items could contain digital evidence?

Question24: The acronym ASCII stands for:

Question25: When an EnCase user double-clicks on a valid .jpg file, that file is:

Question26: When can an evidence file containing a NTFS partition be logically restored to a FAT 32 partition?

Question27: Which is the proper formula for determining the size in bytes of a hard drive that uses cylinders (C), heads (H), and sectors (S) geometry?

Question28: The temporary folder of a case cannot be changed once it has been set.

Question29: A sector on a hard drive contains how many bytes?

Question30: Pressing the power button on a computer that is running could have which of the following results?

Question31: Select the appropriate name for the highlighted area of the binary numbers.

Question32: A sector on a floppy disk is the same size as a sector on a NTFS formatted hard drive.

Question33: When handling computer evidence, an investigator should:

Question34: In Windows, the file MyNote.txt is deleted from C Drive and is automatically sent to the Recycle Bin. The long filename was MyNote.txt and the short filename was MYNOTE.TXT.
When viewing the Recycle Bin with EnCase, how will the long filename and MyNote.txt and the short filename was MYNOTE.TXT?

Question35: How many copies of the FAT are located on a FAT 32, Windows 98-formatted partition?

Question36: By default, what color does EnCase use for the contents of a logical file?

Question37: The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result.
Jan 1 st , 2?0?00

Question38: A physical file size is:

Question39: When Unicode is selected for a search keyword, EnCase:

Question40: An EnCase evidence file of a hard drive ________ be restored to another hard drive of equal or greater size.

Question41: If an evidence file has been added to a case and completely verified, what happens if the data area within the evidence file is later changed?

Question42: Will EnCase allow a user to write data into an acquired evidence file?

Question43: RAM is tested during which phase of the power-up sequence?

Question44: An evidence file was archived onto five CD-Rom disks with the third file segment on disk number three.
Can the contents of the third file segment be verified by itself while still on the CD?

Question45: Assume that MyNote.txt has been deleted. The FAT file system directory entry for that file has been overwritten. The data for MyNote.txt is now:

Question46: Which of the following would be a true statement about the function of the BIOS?

Question47: A restored floppy diskette will have the same hash value as the original diskette.

Question48: In Windows 2000 and XP, which of the following directories contain user personal folders?

Question49: Which of the following is commonly used to encode e-mail attachments?

Question50: How are the results of a signature analysis examined?

Question51: The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result.
800[) \-]+555-1212

Question52: The spool files that are created during a print job are __________ after the print job is completed.

Question53: This question addresses the EnCase for Windows search process. If a target word is located in the unallocated space, and the word is fragmented between clusters 10 and 15, the search:

Question54: When a drive letter is assigned to a logical volume, that information is temporarily written the volume boot record on the hard drive.

Question55: A hard drive has 8 sectors per cluster. File Mystuff.doc has a logical file size of 13,000 bytes. How many clusters will be used by Mystuff.doc?

Question56: You are at an incident scene and determine that a computer contains evidence as described in the search warrant. When you seize the computer, you should:

Question57: A standard Windows 98 boot disk is acceptable for booting a suspect drive.

Question58: A file extension and signature can be manually added by:

Question59: Temp files created by EnCase are deleted when EnCase is properly closed.

Question60: A CPU is:

Question61: You are investigating a case involving fraud. You seized a computer from a suspect who stated that the computer is not used by anyone other than himself. The computer has Windows 98 installed on the hard drive. You find the filename C:\downloads\check01.jpg that EnCase shows as being moved. The starting extent is 0C4057. You find another filename C:\downloads\chk1.dll with the starting extent 0C4057, which EnCase also shows as being moved. In the C:\windows\System folder you find an allocated file named chk1.dll with the starting extent 0C4057. The chk1.dll file is a JPEG image of a counterfeit check. Could this information be used to refute the suspect claim that he never knew it was on the computer?

Question62: A hash set would most accurately be described as:

Question63: EnCase can build a hash set of a selected group of files.

Question64: Which of the following statements is more accurate?

Question65: Within EnCase, you highlight a range of data within a file. The length indicator displays the value 30. How many bytes have you actually selected?

Question66: You are conducting an investigation and have encountered a computer that is running in the field. The operating system is Windows XP. A software program is currently running and is visible on the screen.
You should:

Question67: By default, EnCase will display the data from the end of a logical file, to the end of the cluster, in what color:

Question68: The BIOS chip on an IBM clone computer is most commonly located on:

Question69: What does the acronym BIOS stand for?

Question70: ROM is an acronym for:

Question71: A case file can contain ____ hard drive images?

Question72: When a file is deleted in the FAT or NTFS file systems, what happens to the data on the hard drive?

Question73: Within EnCase, what is purpose of the default export folder?

Question74: When an EnCase user double-clicks on a file within EnCase what determines the action that will result?

Question75: The EnCase evidence file is best described as:

Question76: By default, what color does EnCase use for slack?

Question77: If a floppy diskette is in the a drive, the computer will always boot to that drive before any other device.

Question78: In DOS and Windows, how many bytes are in one FAT directory entry?

Question79: What are the EnCase configuration .ini files used for?

Question80: If a hard drive is left in a room while acquiring, and several persons have access to that room, which of the following areas would be of most concern?

Question81: Bookmarks are stored in which of the following files?

Question82: The signature table data is found in which of the following files?

Question83: Search results are found in which of the following files?

Question84: In the EnCase environment, the term external viewers is best described as?

Question85: How does EnCase verify that the case information (Case Number, Evidence Number, Investigator Name, etc) in an evidence file has not been damaged or changed, after the evidence file has been written?

Question86: The following keyword was typed in exactly as shown. Choose the answer(s) that would result. All search criteria have default settings. Speed and Meth

Question87: A FAT directory has as a logical size of:

Question88: You are working in a computer forensic lab. A law enforcement investigator brings you a computer and a valid search warrant. You have legal authority to search the computer. The investigator hands you a piece of paper that has three printed checks on it. All three checks have the same check and account number.
You image the suspect's computer and open the evidence file with EnCase. You perform a text search for the account number and check number. Nothing returns on the search results. You perform a text search for all other information found on the printed checks and there is still nothing returned in the search results.
You run a signature analysis and check the gallery. You cannot locate any graphical copies of the printed checks in the gallery. At this point, is it safe to say that the checks are not located on the suspect computer?

Question89: GREP terms are automatically recognized as GREP by EnCase.

Question90: Which statement would most accurately describe a motherboard?

Question91: Which of the following is found in the FileSignatures.ini configuration file?

Question92: Calls to the C:\ volume of the hard drive are not made by DOS when a computer is booted with a standard DOS 6.22 boot disk.

Question93: Consider the following path in a FAT file system: C:\My Documents\My Pictures\Bikes. Where does the directory Bikes receive its name?

Question94: The maximum file segment size for an EnCase evidence file is:

Question95: When a document is printed using EMF in Windows, what file(s) are generated in the spooling process?

Question96: Select the appropriate name for the highlighted area of the binary numbers.

Question97: The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result.
Bob@[a-z]+.com

Question98: To generate an MD5 hash value for a file, EnCase:

Question99: If cases are worked on a lab drive in a secure room, without any cleaning of the contents of the drive, which of the following areas would be of most concern?

Question100: A signature analysis has been run on a case. The result "Bad Signature" means:

Question101: How many clusters can a FAT 16 system address?

Question102: Select the appropriate name for the highlighted area of the binary numbers.

Question103: Within EnCase, clicking on save on the toolbar affects what file(s)

Question104: Which of the following aspects of the EnCase evidence file can be changed during a reacquire of the evidence file?

Question105: A SCSI drive is pinned as a master when it is:

Question106: In the FAT file system, the size of a deleted file can be found:

Question107: If cluster number 10 in the FAT contains the number 55, this means:

Question108: How does EnCase verify that the evidence file contains an exact copy of the suspect hard drive?

Question109: The term signature and reader as they relate to a signature analysis are:

Question110: If cluster #3552 entry in the FAT table contains a value of ?? this would mean:

Question111: Which of the following selections is NOT found in the case file?

Question112: A SCSI host adapter would most likely perform which of the following tasks?

Question113: The EnCase methodology dictates that ________ be created prior to acquiring evidence.

Question114: What information in a FAT file system directory entry refers to the location of a file on the hard drive?

Question115: RAM is an acronym for:

Question116: The default export folder remains the same for all cases.

Question117: You are an investigator and have encountered a computer that is running at the home of a suspect. The computer does not appear to be a part of a network. The operating system is Windows XP Home. No programs are visibly running. You should:

Question118: The case number in an evidence file can be changed without causing the verification feature to report an error, if:

Question119: The FAT in the File Allocation Table file system keeps track of:

Question120: A personal data assistant was placed in a evidence locker until an examiner has time to examine it. Which of the following areas would require special attention?

Question121: EnCase marks a file as overwritten when _____________ has been allocated to another file.

Question122: Select the appropriate name for the highlighted area of the binary numbers.

Question123: The case file should be archived with the evidence files at the termination of a case.

Question124: Select the appropriate name for the highlighted area of the binary numbers.

Question125: Search terms are case sensitive by default.

Question126: The following keyword was typed in exactly as shown. Choose the answer(s) that would be found. All search criteria have default settings. Tom

Question127: The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result.
[^a-z]Tom[^a-z]

Question128: To later verify the contents of an evidence file? 7RODWHUYHULI
\WKHFRQWHQWVRIDQHYLGHQFHILOH

Question129: Changing the filename of a file will change the hash value of the file.

Question130: How many partitions can be found in the boot partition table found at the beginning of the drive?

Question131: When undeleting a file in the FAT file system, EnCase will check the _____________ to see if it has already been overwritten.

Question132: Hash libraries are commonly used to:

Question133: Which of the following would most likely be an add-in card?

Question134: Which of the following directories contain the information that is found on a Windows 98 Desktop?

Question135: To undelete a file in the FAT file system, EnCase computes the number of _______ the file will use based on the file ______.

Question136: When a file is deleted in the FAT file system, what happens to the filename?

Question137: An evidence file can be moved to another directory without changing the file verification.

Question138: A hard drive has been formatted as NTFS and Windows XP was installed. The user used fdisk to remove all partitions from that drive. Nothing else was done. You have imaged the drive and have opened the evidence file with EnCase. What would be the best way to examine this hard drive?

Question139: The EnCase signature analysis is used to perform which of the following actions?

Question140: In DOS acquisition mode, if a physical drive is detected, but no partition information is displayed, what would be the cause:

Question141: What information should be obtained from the BIOS during computer forensic investigations?

Question142: The EnCase methodology dictates that the lab drive for evidence have a __________ prior to making an image.

Question143: Which of the following selections would be used to keep track of a fragmented file in the FAT file system?

Question144: A hash library would most accurately be described as:

Question145: A logical file would be best described as:

Question146: A signature analysis has been run on a case. The result "*JPEG " in the signature column means:

Question147: To undelete a file in the FAT file system, EnCase obtains the starting extent from the:

Question148: You are investigating a case of child pornography on a hard drive containing Windows XP. In the C:
\Documents and Settings\Bad Guy\Local Settings\Temporary Internet Files folder you find three images of child pornography. You find no other copies of the images on the suspect hard drive, and you find no other copies of the filenames. What can be deduced from your findings?

Question149: An Enhanced Metafile would best be described as:

Question150: When a file is deleted in the FAT file system, what happens to the FAT?

Question151: This question addresses the EnCase for Windows search process. If a target word is within a logical file, and it begins in cluster 10 and ends in cluster 15 (the word is fragmented), the search:

Question152: EnCase uses the _________________ to conduct a signature analysis.

Question153: Using good forensic practices, when seizing a computer at a business running Windows 2000 Server you should:

Question154: The EnCase evidence file logical filename can be changed without affecting the verification of the acquired evidence.

Question155: 4 bits allows what number of possibilities?

Question156: The end of a logical file to the end of the cluster that the file ends in is called:

Question157: In hexadecimal notation, one byte is represented by _____ character(s).

Question158: Searches and bookmarks are stored in the evidence file.

Question159: Assume that an evidence file is added to a case, the case is saved, and the case is closed. What happens if the evidence file is moved, and the case is then opened?

Question160: The MD5 hash algorithm produces a _____ number.

Question161: What files are reconfigured or deleted by EnCase during the creation of an EnCase boot disk?

Question162: In Unicode, one printed character is composed of ____ bytes of data.

Question163: When does the POST operation occur?

Question164: You are examining a hard drive that has Windows XP installed as the operating system. You see a file that has a date and time in the deleted column. Where does that date and time come from?

Question165: The boot partition table found at the beginning of a hard drive is located in what sector?

Question166: You are assigned to assist with the search and seizure of several computers. The magistrate ordered that the computers cannot be seized unless they are found to contain any one of ten previously identified images. You currently have the ten images in JPG format. Using the EnCase methodology, how would you best handle this situation?

Question167: Within EnCase for Windows, the search process is:

Question168: For an EnCase evidence file acquired with a hash value to pass verification, which of the following must be true?

Question169: EnCase can make an image of a USB flash drive.

Question170: The following keyword was typed in exactly as shown. Choose the answer(s) that would result. All search criteria have default settings. credit card