1.
When undeleting a file in the FAT file system, EnCase will check the _____________ to see if it has already been overwritten.
2.
Select the appropriate name for the highlighted area of the binary numbers.
3.
A SCSI host adapter would most likely perform which of the following tasks?
4.
Assume that MyNote.txt has been deleted. The FAT file system directory entry for that file has been overwritten. The data for MyNote.txt is now:
5.
During the power-up sequence, which of the following happens first?
6.
The end of a logical file to the end of the cluster that the file ends in is called:
7.
By default, what color does EnCase use for slack?
8.
GREP terms are automatically recognized as GREP by EnCase.
9.
To undelete a file in the FAT file system, EnCase computes the number of _______ the file will use based on the file ______.
10.
You are at an incident scene and determine that a computer contains evidence as described in the search warrant. When you seize the computer, you should: