What technique used by Encase makes it virtually impossible to tamper with evidence once it has been acquired?

• A.Every byte of the file(s) is verified using 32-bit CRC
• B.Every byte of the file(s) is given an MD5 hash to match against a master file
• C.Every byte of the file(s) is copied to three different hard drives
• D.Every byte of the file(s) is encrypted using three different methods

Comment: *

Name: *

Email: *

Verification: *

Which of the following tools is not a data acquisition hardware tool?

• A.UltraKit
• B.F-Response Imager
• C.Triage-Responder
• D.Atola Insight Forensic

Comment: *

Name: *

Email: *

Verification: *

What feature of Windows is the following command trying to utilize?

• A.ADS
• B.Slack file
• C.White space
• D.AFS

Comment: *

Name: *

Email: *

Verification: *

In which registry does the system store the Microsoft security IDs?

• A.HKEY_CLASSES_ROOT (HKCR)
• B.HKEY_CURRENT_USER (HKCU)
• C.HKEY_CURRENT_CONFIG (HKCC)
• D.HKEY_LOCAL_MACHINE (HKLM)

Comment: *

Name: *

Email: *

Verification: *

Corporate investigations are typically easier than public investigations because:

• A.the users can load whatever they want on their machines
• B.the investigator has to get a warrant
• C.the users have standard corporate equipment and software
• D.the investigator does not have to get a warrant

Comment: *

Name: *

Email: *

Verification: *