dumpspedia logo
The Windows 98 Start Menu has a selection called documents which displays a list of recently used files. Which of the following The Windows 98 Start Menu has a selection called documents which displays a list of recently used files. Which of the following folders contain those files?
The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. 800[) \-]+555-1212
If cases are worked on a lab drive in a secure room, without any cleaning of the contents of the drive, which of the following areas would be of most concern?
Two allocated files can occupy one cluster, as long as they can both fit within the allotted number of bytes.
Assume that MyNote.txt was allocated to clusters 5, 9, and 11. Cluster 6, 7, and 8 belong to MyResume.doc. Both files have been deleted and the directory entry in the FAT file system for MyResume.doc has been overwritten. What clusters would EnCase use to undelete MyNote.txt?
If cluster #3552 entry in the FAT table contains a value of ?? this would mean:
A personal data assistant was placed in a evidence locker until an examiner has time to examine it. Which of the following areas would require special attention?
To undelete a file in the FAT file system, EnCase obtains the starting extent from the:
In Windows, the file MyNote.txt is deleted from C Drive and is automatically sent to the Recycle Bin. The long filename was MyNote.txt and the short filename was MYNOTE.TXT. When viewing the Recycle Bin with EnCase, how will the long filename and MyNote.txt and the short filename was MYNOTE.TXT?
In Windows 98 and ME, Internet based e-mail, such as Hotmail, will most likely be recovered in the _____________________ folder.
Using good forensic practices, when seizing a computer at a business running Windows 2000 Server you should:
If an evidence file has been added to a case and completely verified, what happens if the data area within the evidence file is later changed?
When an EnCase user double-clicks on a file within EnCase what determines the action that will result? Select all that apply
The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result.[\x00-\x05]\x00\x00?>[?[@?[?[?[
The spool files that are created during a print job are __________ after the print job is completed.
The EnCase signature analysis is used to perform which of the following actions?
By default, EnCase will display the data from the end of a logical file, to the end of the cluster, in what color:
How many copies of the FAT are located on a FAT 32, Windows 98-formatted partition?
Which of the following directories contain the information that is found on a Windows 98 Desktop?
To later verify the contents of an evidence file 7RODWHUYHULI\WKHFRQWHQWVRIDQHYLGHQFHILOH
How does EnCase verify that the case information (Case Number, Evidence Number, Investigator Name, etc) in an evidence file has not been damaged or changed, after the evidence file has been written?
You are conducting an investigation and have encountered a computer that is running in the field. The operating system is Windows XP. A software program is currently running and is visible on the screen. You should:
How does EnCase verify that the case information (Case Number, Evidence Number, Investigator Name, etc) in an evidence file has not been damaged or changed, after the evidence file has been written?
TESTED 23 Nov 2024