When an EnCase user double-clicks on a file within EnCase what determines the action that will result? A. The settings in the case file. B. The settings in the FileTypes.ini file. C. The setting in the evidence file.

B. The settings in the FileTypes.ini file

Search results are found in which of the following files?

Select all that apply.

A. The evidence file

B. The configuration Searches.ini file

C. The case file

C. The case file

If cluster #3552 entry in the FAT table contains a value of ?? this would mean:

A. The cluster is unallocated

B. The cluster is the end of a file

C. The cluster is allocated

D. The cluster is marked bad

A. The cluster is unallocated

The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. Bob@[a-z]+.com

A. Bob@New zealand.com

B. Bob@My-Email.com

C. Bob@America.com

D. Bob@a-z.com

C. Bob@America.com

You are an investigator and have encountered a computer that is running at the home of a suspect. The computer does not appear to be a part of a network. The operating system is Windows XP Home. No programs are visibly running. You should:

A. Pull the plug from the back of the computer.

B. Turn it off with the power button.

C. Pull the plug from the wall.

D. Shut it down with the start menu.

A. Pull the plug from the back of the computer.

A physical file size is:

A. The total size in sectors of an allocated file.

B. The total size of all the clusters used by the file measured in bytes.

C. The total size in bytes of a logical file.

D. The total size of the file including the ram slack in bytes.

B. The total size of all the clusters used by the file

In Unicode, one printed character is composed of ____ bytes of data.

A. 8

B. 4

C. 2

D. 1

C. 2

If cluster number 10 in the FAT contains the number 55, this means:

A. That cluster 10 is used and the file continues in cluster number 55.

B. That the file starts in cluster number 55 and continues to cluster number 10.

C. That there is a cross-linked file.

D. The cluster number 55 is the end of an allocated file.

A. That cluster 10 is used and the file continues in cluster number 55.

How are the results of a signature analysis examined?

A. By sorting on the category column in the Table view. By sorting on the category column in the Table view.

B. By sorting on the signature column in the Table view. By sorting on the signature column in the Table view.

C. By sorting on the hash sets column in the Table view. By sorting on the hash sets column in the Table view.

D. By sorting on the hash library column in the Table view. By sorting on the hash library column in the Table view.

B. By sorting on the signature column in the Table view. By sorting on the signature column in the Table view.

The acronym ASCII stands for:

A. American Standard Communication Information Index B. American Standard Code for Information Interchange C. Accepted Standard Code for Information Interchange D. Accepted Standard Communication Information Index

B. American Standard Code for Information Interchange

The default export folder remains the same for all cases.

A. True

B. False

B. False

The EnCase default export folder is:

A. A case-specific setting that cannot be changed.

B. A case-specific setting that can be changed.

C. A global setting that can be changed.

D. A global setting that cannot be changed.

B. A case-specific setting that can be changed.

Hash libraries are commonly used to:

A. Compare a file header to a file extension.

B. Identify files that are already known to the user.

C. Compare one hash set with another hash set.

D. Verify the evidence file.

B. Identify files that are already known to the user.

Which is the proper formula for determining the size in bytes of a hard drive that uses cylinders (C), heads (H), and sectors (S) geometry?

A. C X H + S

B. C X H X S + 512

C. C X H X S X 512

D. C X H X S

C. C X H X S X 512

Within EnCase, clicking on Save on the toolbar affects what file(s)?

A. All of the above

B. The evidence files

C. The open case file

D. The configuration .ini files

C. The open case file

EnCase uses the _________________ to conduct a signature analysis.

A. Both a and b

B. file signature table

C. hash library

D. file Viewers

B. file signature table

EnCase is able to read and examine which of the following file systems?

A. NTFS

B. EXT3

C. FAT

D. HFS

A. NTFS

B. EXT3

C. FAT

D. HFS

ROM is an acronym for:

A. Read Open Memory

B. Random Open Memory

C. Read Only Memory

D. Relative Open Memory

C. Read Only Memory

If a floppy diskette is in the ?drive, the computer will always boot to that drive before any other device. If a floppy diskette is in the ??drive, the computer will always boot to that drive before any other device.

A. False

B. True

B. True

A standard Windows 98 boot disk is acceptable for booting a suspect drive.

A. True

B. False

A. True

Search terms are case sensitive by default.

A. False

B. True

B. True

The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. Jan 1st , 2?0?00

A. Jan 1st , 1900

B. Jan 1st , 2100

C. Jan 1st , 2001

D. Jan 1st , 2000

D. Jan 1st , 2000

An evidence file can be moved to another directory without changing the file verification.

A. False

B. True

B. True

Pressing the power button on a computer that is running could have which of the following results?

A. The computer will instantly shut off.

B. The computer will go into stand-by mode.

C. Nothing will happen.

D. All of the above could happen. E. The operating system will shut down normally.

D. All of the above could happen.

How does EnCase verify that the evidence file contains an exact copy of the suspect hard drive? How does EnCase verify that the evidence file contains an exact copy of the suspect's hard drive?

A. By means of a CRC value of the suspect hard drive compared to a CRC value of the data stored in the evidence file.By means of a CRC value of the suspect? hard drive compared to a CRC value of the data stored in the evidence file.

B. By means of an MD5 hash of the suspect hard drive compared to an MD5 hash of the data stored in the evidence file. By means of an MD5 hash of the suspect? hard drive compared to an MD5 hash of the data stored in the evidence file.

C. By means of a CRC value of the evidence file itself.

D. By means of an MD5 hash value of the evidence file itself.

B. By means of an MD5 hash of the suspect hard drive compared to an MD5 hash of the data stored in the evidence file. By means of an MD5 hash of the suspect? Hard drive compared to an MD5 hash of the data stored in the evidence file.

By default, EnCase will display the data from the end of a logical file, to the end of the cluster, in what color:

A. Red

B. Red on black

C. Black on red

D. Black

A. Red

A SCSI drive is pinned as a master when it is:

A. The only drive on the computer.

B. The primary of two drives connected to one cable.

C. Whenever another drive is on the same cable and is pinned as a slave.

D. A SCSI drive is not pinned as a master.

D. A SCSI drive is not pinned as a master.

The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. [^a-z]Tom[^a-z]

A. Tomato

B. om? ? RP

C. Toms

D. Stomp

B. om? ? RP

This question addresses the EnCase for Windows search process. If a target word is within a logical file, and it begins in cluster 10 and ends in cluster 15 (the word is fragmented), the search:

A. Will not find it unlessile slack is checked on the search dialog box.

B. Will find it because EnCase performs a logical search. C. Will not find it because EnCase performs a physical search only.

D. Will not find it because the letters of the keyword are not contiguous.

B. Will find it because EnCase performs a logical

An evidence file was archived onto five CD-Rom disks with the third file segment on disk number three. Can the contents of the third file segment be verified by itself while still on the CD?

A. No. Archived files are compressed and cannot be verified until un-archived.

B. No. All file segments must be put back together.

C. Yes. Any segment of an evidence file can be verified through re-computing and comparing the CRCs, even if it is on a CD.

D. No. EnCase cannot verify files on CDs.

C. Yes. Any segment of an evidence file can be verified through re-computing and comparing the CRCs, even if it is on a CD.

You are a computer forensic examiner tasked with determining what evidence is on a seized computer. On what part of the computer system will you find data of evidentiary value?

A. Microprocessor or CPU

B. USB controller

C. Hard drive

D. PCI expansion slots

C. Hard drive

You are a computer forensic examiner explaining how computers store and access the data you recovered as evidence during your examination. The evidence was a log file and was recovered as an artifact of user activity on the ____________, which was stored on the _____________, contained within a ____________ on the media.

A. partition, operating system, file system

B. operating system, file system, partition

C. file system, operating system, hard drive

D. operating system, partition, file system

B. operating system, file system, partition

You are a computer forensic examiner investigating a seized computer. You recovered a document containing potential evidence. EnCase reports the file system on the forensic image of the hard drive is FAT (File Allocation Table). What information about the document file can be found in the FAT on the media? (Choose all that apply.)

A. Name of the file

B. Date and time stamps of the file

C. Starting cluster of the file

D. Fragmentation of the file

E. Ownership of the file

C. Starting cluster of the file D. Fragmentation of the file

You are a computer forensic examiner investigating media on a seized computer. You recovered a document containing potential evidence. EnCase reports the file system on the forensic image of the hard drive is NTFS (New Technology File System). What information about the document file can be found in the NTFS master file table on the media? (Choose all that apply.)

A. Name of the file

B. Date and time stamps of the file

C. Starting cluster of the file

D. Fragmentation of the file

E. Ownership of the file

A. Name of the file

B. Date and time stamps of the file

C. Starting cluster of the file

D. Fragmentation of the file

E. Ownership of the file

You are preparing to lead a team to serve a search warrant on a business suspected of committing large-scale consumer fraud. Ideally, you would you assign which tasks to search team members? (Choose all that apply.)

A. Photographer

B. Search and seizure specialists

C. Recorder

D. Digital evidence search and seizure specialists

A. Photographer

B. Search and seizure specialists

C. Recorder

D. Digital evidence search and seizure specialists

You are a computer forensic examiner at a scene and have determined you will seize a Linux server, which according to your source of information contains the database records for the company under investigation for fraud. What is the best practice for “taking down” the server for collection?

A. Photograph the screen and note any running programs or messages, and so on, and use the normal shutdown procedure.

B. Photograph the screen and note any running programs or messages, and so on, and pull the plug from the wall.

C. Photograph the screen and note any running programs or messages, and so on, and pull the plug from the rear of the computer.

D. Photograph the screen and note any running programs or messages, and so on, and ask the user at the scene to shut down the server.

A. Photograph the screen and note any running programs or messages, and so on, and use the normal shutdown procedure.

You are a computer forensic examiner at a scene and are authorized to seize only media that can be determined to have evidence related to the investigation. What options do you have to determine whether evidence is present before seizure and a full forensic examination? (Choose all that apply.)

A. Use a DOS boot floppy or CD to boot the machine, and browse through the directory for evidence.

B. Use an EnCase boot floppy or CD to boot the machine into Linux, and use LinEn to preview the hard drive through a crossover cable with EnCase for Windows.

C. Remove the subject hard drive from the machine, and preview the hard drive in EnCase for Windows with a hardware write blocker such as FastBloc.

D. Use an EnCase boot floppy or CD to boot the machine into DOS, and use EnCase for DOS to preview the hard drive through a crossover cable with EnCase for Windows.

B. Use an EnCase boot floppy or CD to boot the machine into Linux, and use LinEn to preview the hard drive through a crossover cable with EnCase for Windows.

C. Remove the subject hard drive from the machine, and preview the hard drive in EnCase for Windows with a hardware write blocker such as FastBloc.

D. Use an EnCase boot floppy or CD to boot the machine into DOS, and use EnCase for DOS to preview the hard drive through a crossover cable with EnCase for Windows.

You are a computer forensic examiner at a scene and have determined you will need to image a hard drive in a workstation while on-site. What are your options for creating a forensically sound image of the hard drive? (Choose all that apply.)

A. Use a DOS boot floppy or CD to boot the machine, and use EnCase for DOS to image the subject hard drive to a second hard drive attached to the machine.

B. Use a forensically sound Linux boot CD to boot the machine into Linux, and use LinEn to image the subject hard drive to a second hard drive attached to the machine.

C. Remove the subject hard drive from the machine, and image the hard drive in EnCase for Windows with a hardware write blocker such as FastBloc.

D. Use an EnCase boot floppy or CD to boot the machine into DOS, and use EnCase for DOS to image the hard drive through a crossover cable with EnCase for Windows.

B. Use a forensically sound Linux boot CD to boot the machine into Linux, and use LinEn to image the subject hard drive to a second hard drive attached to the machine.

C. Remove the subject hard drive from the machine, and image the hard drive in EnCase for Windows with a hardware write blocker such as FastBloc.

D. Use an EnCase boot floppy or CD to boot the machine into DOS, and use EnCase for DOS to image the hard drive through a crossover cable with EnCase for Windows.

You are a computer forensic examiner and have imaged a hard drive on site. Before you leave the scene, you want to ensure the image completely verifies as an exact forensic duplicate of the original. To verify the EnCase evidence file containing the image, you should do which of the following?

A. Use a hex editor to compare a sample of sectors in the EnCase evidence file with that of the original.

B. Load the EnCase evidence files into EnCase for Windows, and after the verification is more than halfway completed, cancel the verification and spot-check the results for errors.

C. Load the EnCase evidence files into EnCase for DOS, and verify the hash of those files.

D. Load the EnCase evidence files into EnCase for Windows, allow the verification process to finish, and then check the results for complete verification.

D. Load the EnCase evidence files into EnCase for Windows, allow the verification process to finish, and then check the results for complete verification.

You are a computer forensic examiner and need to verify the integrity of an EnCase evidence file. To completely verify the file’s integrity, which of the following must be true?

A. The MD5 hash value must verify.

B. The CRC values and the MD5 hash value both must verify.

C. Either the CRC or MD5 hash values must verify.

D. The CRC values must verify.

B. The CRC values and the MD5 hash value both must verify.

You are a computer forensic examiner and need to determine what files are contained within a folder called Business documents. What EnCase pane will you use to view the names of the files in the folder?

A. Tree pane

B. Table pane

C. View pane

D. Filter pane

B. Table pane

You are a computer forensic examiner and need to view the contents of a file contained within a folder called Business documents. What EnCase pane will you use to view the contents of the file?

A. Tree pane

B. Table pane

C. View pane

D. Filter pane

C. View pane

You are a computer forensic examiner and are viewing a file in an EnCase evidence file. With your cursor, you have selected one character in the file. What binary term is used for the amount of data that represents a single character?

A. A byte

B. A nibble

C. A byte

You are a computer forensic examiner and need to search for the name of a suspect in an EnCase evidence file. You enter the name of the suspect into the EnCase keyword interface as John Doe. What search hits will be found with this search term with the default settings? (Choose all that apply.)

A. john doe 

B. John D. 

C. John Doe

D. John.Doe

A. John Doe

C. john doe

You are a computer forensic examiner and need to determine whether any Microsoft Office documents have been renamed with image extensions to obscure their presence. What EnCase process would you use to find such files?

A. File signature analysis

B. Recover Folders feature  

C. File content search

D. File hash analysis

A. File signature analysis

You are a computer forensic examiner and want to reduce the number of files required for examination by identifying and filtering out known good or system files. What EnCase process would you use to identify such files?

A. File signature analysis

B. Recover Folders feature

C. File content search

D. File hash analysis

D. File hash analysis

You are a computer forensic examiner and want to determine whether a user has opened or double-clicked a file. What folder would you look in for an operating system artifact for this user activity?

A. Temp

B. Recent

C. Cookies

D. Desktop

B. Recent

You are a computer forensic examiner and want to determine when a user deleted a file contained in a Windows XP Recycle Bin. In what file is the date and time information about the file deletion contained?

A. index.dat

B. Link file

C. INFO2

D. deleted.ini

C. INFO2

You are a computer forensic examiner and want to determine how many times a program was executed. Where would you find information?

A. Temp folder

B. Registry

C. Recycle Bin

D. Program Files

B. Registry

You are a computer forensic examiner and want to examine any email sent and received by the user of the computer system under investigation. What email formats are supported by EnCase?

(Choose all that apply.)

A. Outlook

B. Outlook Express

C. America Online

D. Hotmail

E. Yahoo!

F. Mozilla Thunderbird

A. Outlook

B. Outlook Express

C. America Online

D. Hotmail

E. Yahoo!

F. Mozilla Thunderbird

What is the definition of a CPU?

A. The physical computer case that contains all its internal components

B. The computer’s internal hard drive

C. A part of the computer whose function is to perform data processing

D. A part of the computer that stores and manages memory

C. A part of the computer whose function is to perform data processing

What is the BIOS?

A. BIOS stands for Basic Input Output System and is a combination of low-level software and drivers that function as the interface, intermediary, or layer between a computer’s hardware and its operating system.

B. BIOS stands for Bootstrap Initialization Operating System and is a combination of lowlevel software and drivers that function as the interface, intermediary, or layer between a computer’s hardware and its operating system.

C. BIOS stands for Boot-level Input Output System and is a combination of low-level software and drivers that function as the interface, intermediary, or layer between a computer’s hardware and its operating system.

D. BIOS stands for Boot Initialization Operating System and is a combination of low-level software and drivers that function as the interface, intermediary, or layer between a computer’s hardware and its operating system.

A. BIOS stands for Basic Input Output System and is a combination of low-level software and drivers that function as the interface, intermediary, or layer between a computer’s hardware and its operating system.

Is the information stored on a computer’s ROM chip lost during a proper shutdown?

A. Yes

B. No

B. No

Is the information contained on a computer’s RAM chip accessible after a proper shutdown?

A. Yes

B. No

B. No

Can information stored in the BIOS ever change?

A. Yes

B. No

A. Yes

What is the purpose or function of a computer’s ROM chip?

A. Long-term or permanent storage of information and instructions

B. Temporary storage area to run applications

C. Permanent storage area for programs and files

D. A portable storage device

A. Long-term or permanent storage of information and instructions

Information contained in RAM memory (system’s main memory), which is located on the

motherboard, is _________.

A. volatile

B. nonvolatile

A. volatile

What is the maximum number of drive letters assigned to hard drive(s) partitions on a system?

A. 4

B. 16

C. 24

D. Infinity

C. 24

The smallest area on a drive that data can be written to is a _______, while the smallest area on a drive that a file can be written to is a ________.

A. bit and byte

B. sector and cluster

C. volume and drive

D. memory and disk

B. sector and cluster

The size of a physical hard drive can be determined by which of the following?

A. The cylinder × head × sector

B. The cylinder × head × sector × 512 bytes

C. The total LBA sectors ×512 bytes

D. Adding the total size of partitions

E. Both B and C

E. Both B and C

The electrical pathway used to transport data from one computer component to another is called what?

A. Bus

B. RAM

C. CMOS

A. Bus

What is the main component of a computer to which essential internal devices such as CPU, memory chips, and other chipsets are attached?

A. BIOS

B. Motherboard

C. Expansion card

D. Processor

B. Motherboard

IDE, SCSI, and SATA are different types of interfaces describing what device?

A. RAM chips

B. Flash memory

C. CPUs

D. Hard drives

D. Hard drives

What do the terms master, slave, and Cable Select refer to?

A. External SCSI devices

B. Cable types for external hardware

C. Jumper settings for internal hardware such as IDE hard drives and CD drives

D. Jumper settings for internal expansion cards

C. Jumper settings for internal hardware such as IDE hard drives and CD drives

What can you assume about a hard drive that is pinned as CS?

A. It’s an IDE drive.

B. It’s a SATA drive.

C. It’s a SCSI drive.

D. All of the above.

A. It’s an IDE drive.

What is found at Cylinder 0, Head 0, Sector 1 on a hard drive?

A. Master boot record

B. Master file table

C. Volume boot record

D. Volume boot sector

A. Master boot record

What is the first sector on a volume called?

A. File allocation table

B. Volume boot record or sector

C. Master boot record

D. Volume boot device

B. Volume boot record or sector

Which of the following is incorrect?

A. The MBR is typically written when the drive is partitioned with FDISK or DISKPART.

B. A file system is a system or method of storing and retrieving data on a computer system that allows for a hierarchy of directories, subdirectories, and files.

C. The VBR is typically written when the drive is high-level formatted with a utility such

as format.

D. The partition table is contained within the MBR and consists of a total of 16 bytes, which describes up to four partitions using 4 bytes each to do so.

D. The partition table is contained within the MBR and consists of a total of 16 bytes, which describes up to four partitions using 4 bytes each to do so.

FAT is defined as which of the following?

A. A table consisting of master boot record and logical partitions

B. A table created during the format that the operating system reads to locate data on a drive

C. A table consisting of file names and file attributes

D. A table consisting of file names, deleted file names, and their attributes

B. A table created during the format that the operating system reads to locate data on a drive

How does a corrupted sector located in the data area of a hard drive affect the corresponding cluster number on a FAT table?

A. It does not affect the corresponding cluster number on a FAT table; therefore, the rest of the sectors associated with the assigned cluster can still be written to.

B. It does not affect the corresponding cluster number on a FAT table; only the corrupted portion of the sector is prevented from being written to.

C. It does affect the FAT table. The corresponding cluster number is marked as bad; however, only the corrupted sector within the cluster is prevented from being written to.

D. It does affect the FAT table. The corresponding cluster number is marked as bad, and the entire cluster is prevented from being written to.

D. It does affect the FAT table. The corresponding cluster number is marked as bad, and the entire cluster is prevented from being written to.

Which of the following describes a partition table?

A. It is located at cylinder 0, head 0, sector 1.

B. Is located in the master boot record.

C. It keeps track of the partitions on a hard drive.

D. All of the above.

D. All of the above.

Which selection keeps track of a fragmented file in a FAT file system?

A. File allocation table

B. Directory structure

C. Volume boot record

D. Master file table

A. File allocation table

If the FAT table lists cluster number 2749 with a value of 0, what does this mean about this specific cluster?

A. It is blank and contains no data.

B. It is marked as bad and cannot be written to.

C. It is allocated to a file.

D. It is unallocated and is available to store data.

D. It is unallocated and is available to store data.

Which of the following is true about a volume boot record?

A. It is always located at the first sector of its logical partition.

B. It immediately follows the master boot record.

C. It contains BIOS parameter block and volume boot code.

D. A and C.

D. A and C.

The NTFS file system does which of the following?

A. Supports long file names

B. Compresses individual files and directories

C. Supports large file sizes in excess of 4GB

D. All of the above

D. All of the above

How many clusters can a FAT32 file system manage?

A. 2 × 32 = 64 clusters

B. 232 = 4,294,967,296 clusters

C. 2 × 28 = 56 clusters

D. 228 = 268,435,456 clusters

D. 228 = 268,435,456 clusters

The FAT tracks the ________ while the directory entry tracks the ________.

A. file name and file size

B. file’s starting cluster and file’s last cluster (EOF)

C. file’s last cluster (EOF) and file’s starting cluster

D. file size and file fragmentation

C. file’s last cluster (EOF) and file’s starting cluster

How many copies of the FAT does each FAT32 volume maintain in its default configuration?

A. One

B. Two

C. Three

D. Four

B. Two

A file’s logical size is displayed as?

A. The number of sectors needed that the logical file contains

B. The number of clusters that the logical file contains

C. The number of bytes that the logical file contains

D. The number of bits that the logical file contains

C. The number of bytes that the logical file contains

A file’s physical size is?

A. Always greater than the file’s logical size

B. The number of bytes in the logical file plus all slack space from the end of the logical file to the end of the last cluster

C. Both A and B

D. None of the above

B. The number of bytes in the logical file plus all slack space from the end of the logical file to the end of the last cluster

A directory entry in a FAT file system has a logical size of which of the following?

A. 0 bytes

B. 8 bytes

C. 16 bytes

D. One sector

A. 0 bytes

Each directory entry in a FAT file system is ____ bytes in length.

A. 0

B. 8

C. 16

D. 32

D. 32

By default, what color does EnCase use to display directory entries within a directory structure?

A. Black

B. Red

C. Gray

D. Yellow

B. Red

What is the area between the end of a file’s logical size and the file’s physical size called?

A. Unused disk area

B. Unallocated clusters

C. Unallocated sectors

D. Slack space

D. Slack space

What three things occur when a file is created in a FAT32 file system?

A. Directory entry for the file is created, the FAT assigns the necessary clusters to the file, and the file’s data is filled in to the assigned clusters.

B. The file name is entered in to the FAT, the directory structure assigns the number of

clusters, and the file’s data is filled in to the assigned clusters.

C. The directory entry for the file is created, the number of clusters is assigned by the directory structure, and the file’s data is filled in to the FAT.

D. The directory structure maintains the amount of clusters needed, the file name is recorded in the FAT, and the file’s data is filled in to the assigned clusters.

A. Directory entry for the file is created, the FAT assigns the necessary clusters to the file, and the file’s data is filled in to the assigned clusters.

How does EnCase recover a deleted file?

A. It reads the deleted file name in the FAT and searches for the file by its starting cluster number and logical size.

B. It reads the deleted file name in the directory entry and searches for the corresponding file name in unallocated clusters.

C. It obtains the deleted file’s starting cluster number and size from the directory entry to obtain the data’s starting location and number of clusters required.

D. It obtains the deleted file’s starting cluster number and size from the FAT to locate the starting location and amount of clusters needed.

C. It obtains the deleted file’s starting cluster number and size from the directory entry to obtain the data’s starting location and number of clusters required.

What does EnCase do when a deleted file’s starting cluster number is assigned to another file?

A. EnCase reads the entire existing data as belonging to the deleted file.

B. EnCase only reads the amount of data from the existing file that is associated with the deleted file.

C. EnCase marks the deleted file as being overwritten.

D. EnCase does not display a deleted file name when the data has been overwritten.

C. EnCase marks the deleted file as being overwritten.

What information does a file’s directory entry in a FAT file system store about itself?

A. File name

B. Date/time

C. File extension

D. Starting cluster (extent)

E. All of the above

E. All of the above

What is the first consideration when responding to a scene?

A. Your safety

B. The safety of others

C. The preservation of evidence

D. Documentation

A. Your safety

What are some variables regarding a facility that you should consider prior to responding to a scene?

A. What type of structure is it?

B. How large is the structure?

C. What are the hours of operation?

D. Is there a helpful person present to aid in your task?

E. All of the above.

E. All of the above.

What are some variables regarding items to be seized that you should consider prior to

responding to a scene?

A. Location(s) of computers

B. Type of operating system

C. Workstations or mainframes

D. System-critical or auxiliary machine

E. All of the above

E. All of the above

Generally speaking, if you encounter a desktop computer running Windows XP, how should you take down the machine?

A. Shut down using Windows XP.

B. Shut down by pulling the power cord from the outlet.

C. Shut down by pulling the plug from the computer box.

D. All of the above.

C. Shut down by pulling the plug from the computer box.

Generally speaking, if you encounter a computer running Windows 2000 Server, how should you take down the machine?

A. Shut down using its operating system.

B. Shut down by pulling the power cord from the outlet.

C. Shut down by pulling the plug from the computer box.

D. All of the above.

A. Shut down using its operating system.

Generally speaking, if you encounter a Unix/Linux machine, how should you take down the machine?

A. Shut down using its operating system.

B. Shut down by pulling the power cord from the outlet.

C. Shut down by pulling the plug from the computer box.

D. All of the above.

A. Shut down using its operating system.

When unplugging a desktop computer, from where is it best to pull the plug?

A. The back of the computer

B. The wall outlet

C. A or B

A. The back of the computer

What is the best method to shut down a notebook computer?

A. Unplug from the back of the computer.

B. Unplug from the wall.

C. Remove the battery.

D. Both A and C.

D. Both A and C.

Generally speaking, if you encounter a Macintosh computer, how should you take down the machine?

A. Shut down using the operating system.

B. Shut down by pulling the power cord from the outlet.

C. Shut down by pulling the plug from the computer box.

D. All of the above.

C. Shut down by pulling the plug from the computer box.

Which selection displays the incorrect method for shutting down a computer?

A. DOS: Pull the plug.

B. Windows 2000: Pull the plug.

C. Windows XP: Pull the plug.

D. Linux: Pull the plug.

D. Linux: Pull the plug.

When shutting down a computer, what information is typically lost?

A. Data in RAM memory

B. Running processes

C. Current network connections

D. Current logged-in users

E. All of the above

E. All of the above

Which of the following is not acceptable for “bagging” a computer workstation?

A. Large paper bag.

B. Brown wrapping paper.

C. Plastic garbage bag.

D. Large antistatic plastic bag.

E. All of the above are acceptable for bagging a workstation.

C. Plastic garbage bag.

SCSI

Small Computer Systems Interface

IDE

Integrated Drive Electronics

SATA

Serial Advanced Technology Attachment

RAID

Redundant Array of Inexpensive Disks

DVD

Digital Versatile Disc

USB

Universal serial bus

IEEE

Institute of Electrical and Electronics Engineers

IEEE 1394

Firewire

ISA

Industry Standard Architecture

MCA

IBM Micro Channel Architecture

EISA

Extended Industry Standard Architecture

PCI

Peripheral Component Interconnect

AGP

Accelerated Graphics Port

PCMCIA

Personal Computer Memory Card International Association

PCI

Peripheral Component Interconnect

CMOS

Complementary Metal-Oxide Semiconductor

EFI

Extensible Firmware Interface

POST

Power On Self-Test

MBR

Master Boot Record

VBR

Volume Boot Record

FAT

File Allocation Table (12, 16 or 32)

MFT

Master File Table

POST

Power On Self-Test

0000 0001

Read only

Bit Flag Values for Attribute Field at Byte Offset 11

0000 0010

Hidden File

0000 0100

System File

0000 1000

Volume label

0000 1111

Long File Name

0001 0000

Directory

0010 0000

Archive

In which circumstance is pulling the plug to shut down a computer system considered the best practice?

A. When the OS is Linux/Unix

B. When the OS is Windows 2000 and known to be running a large business database

application

C. When the OS is Windows (NT/2K/2003) Server

D. When Mac OS X Server is running as a web server

E. None of the above

E. None of the above

How is the chain of custody maintained?

A. By bagging evidence and sealing it to protect it from contamination or tampering

B. By documenting what, when, where, how, and by whom evidence was seized

C. By documenting in a log the circumstances under which evidence was removed from the evidence control room

D. By documenting the circumstances under which evidence was subjected to analysis

E. All of the above

E. All of the above

It is always safe to pull the plug on a Windows 2000 Professional operating system.

A. True

B. False

B. False

On a production Linux/Unix server, you must generally be which user to shut down the system?

A. sysadmin

B. administrator

C. root

D. system

C. root

When would it be acceptable to navigate through a live system?

A. To observe the operating system to determine the proper shutdown process

B. To document currently opened files (if Enterprise/FIM edition is not available)

C. To observe an encryption program running

D. To access virtual storage facility (if search warrant permits; some are very specific about physical location)

E. All of the above

E. All of the above

A console prompt that displayed backslashes (\) as part of its display would most likely be which of the following?

A. Red Hat Linux operating system

B. Unix operating system

C. Linux or Unix operating system logged in as root

D. MS-DOS

D. MS-DOS

When called to a large office complex with numerous networked machines, is it always a good idea to request the assistance of the network administrator.

A. True

B. False

B. False

Subsequent to a search warrant where evidence is seized, what items should be left behind?

A. Copy of the affidavit

B. Copy of the search warrant

C. List of items seized

D. A and B

E. B and C

E. B and C

SAFE

Secure Authentication for EnCase

HPA

Host Protected Area

DCO

Device Configuration Overlay

MD5

Message-Digest algorithm 5.

The odds of any two files having the same MD5 are 1 in 2128, which is, more graphically, 1 in 340,282,366,920,938,000,000,000,000,000,000,000,000.

CRC

cyclic redundancy check (CRC) or polynomial code checksum

When acquiring a hard drive in the DOS mode, what would be the cause of EnCase not detecting partition information?

A. The drive has been FDisked and the partition(s) removed.

B. The partition(s) are not recognized by DOS.

C. Both A and B.

D. None of the above.

C. Both A and B.

A standard DOS 6.22 boot disk does not make calls to the C: volume of a hard drive when the diskette is booted.

A. True

B. False

B. False

As a good forensic practice, why would it be a good idea to wipe a forensic drive before reusing it?

A. Chain-of-custody

B. Cross-contamination

C. Different file and operating systems

D. Chain of evidence

E. No need to wipe

B. Cross-contamination

If the number of sectors reported by EnCase does not match the number reported by the manufacturer for the drive, what should you do?

A. Suspect HPA

B. Suspect DCO

C. Boot with EnCase for DOS and switch to Direct ATA access

D. Boot with LinEn in Linux

E. All of the above

E. All of the above

What system files are changed or in any way modified by EnCase when creating an EnCase boot disk?

A. IO.SYS

B. COMMAND.COM

C. DRVSPACE.BIN

D. All of the above

E. None of the above

D. All of the above

Reacquiring an image and adding compression will change the MD5 value of the acquisition hash.

A. True

B. False

B. False

When reacquiring an image, you can change the name of the evidence.

A. True

B. False

B. False

Which of the following should you do when creating a storage volume to hold an EnCase evidence file that will be created with EnCase for DOS or LinEn? (Choose all that apply.)

A. Format the volume with the FAT file system.

B. Give the volume a unique label to identify it.

C. Wipe the volume before formatting to conform to best practices, and avoid claims of crosscontamination.

D. Create a directory to contain the evidence file.

E. Format the volume with the NTFS file system.

F. All of the above.

A. Format the volume with the FAT file system.

B. Give the volume a unique label to identify it.

C. Wipe the volume before formatting to conform to best practices, and avoid claims of crosscontamination.

D. Create a directory to contain the evidence file.

In Linux, what describes hdb2? (Choose all that apply.)

A. Refers to the primary master

B. Refers to the primary slave

C. Refers to hard drive number 2

D. Refers to the second partition

E. Refers to the secondary master

B. Refers to the primary slave

D. Refers to the second partition

When acquiring USB flash memory, you should write-protect it by doing what?

A. Engaging the write-protect switch, if equipped

B. Modifying the registry in Windows XP SP2 (or higher) to make USB read-only

C. Using ENBD/ENBCD USB DOS drivers and having EnCase for DOS “lock” the Flash media

D. Using LinEn in Linux with automount of file system disabled

E. Using FastBloc SE to write-block USB, FireWire, SCSI drives

F. All of the above

F. All of the above

Which type or types of cables can be used in a network cable acquisition?

A. Standard network patch cable

B. CAT-6 network cable

C. Network crossover cable

D. Standard network patch cable used with a crossover adaptor

D. Standard network patch cable used with a crossover adaptor

Should Zip/Jaz disks be acquired with EnCase in DOS or Windows?

A. DOS

B. Windows

A. DOS

When using LinEn, the level of support for USB, FireWire, and SCSI devices is determined by what?

A. The drivers built into LinEn

B. The drivers provided with the ENBCD

C. The distribution of Linux being used

D. A and B

E. None of the above

C. The distribution of Linux being used

How should CDs be acquired using EnCase?

A. DOS

B. Windows

B. Windows

Select all that are true about EE and FIM.

A. They can acquire or preview a system live without shutting it down.

B. They can capture live system-state volatile data using the Snapshot feature.

C. With EE, the SAFE is on a separate PC, administered by the keymaster.

D. With FIM, the SAFE is on the examiner’s PC and the keymaster and the examiner are the same person.

E. FIM can be licensed to private individuals.

A. They can acquire or preview a system live without shutting it down.

B. They can capture live system-state volatile data using the Snapshot feature.

C. With EE, the SAFE is on a separate PC, administered by the keymaster.

D. With FIM, the SAFE is on the examiner’s PC and the keymaster and the examiner are the same person.

How does an EnCase boot disk differ from a DOS 6.22 disk?

A. EnCase boot disk adds the EnCase executable, EN.EXE.

B. EnCase boot disk switches all calls from C: to A:.

C. Both A and B.

D. None of the above.

C. Both A and B.

The EnCase evidence file is best described as follows:

A. A mirror image of the source device written to a hard drive

B. A sector-by-sector image of the source device written to corresponding sectors of a secondary hard drive

C. A bitstream image of a source device written to the corresponding sectors of a secondary hard drive

D. A bitstream image of a source device written to a file or several file segments

D. A bitstream image of a source device written to a file or several file segments

How does EnCase verify the contents of an evidence file?

A. EnCase writes an MD5 hash value for every 32 sectors copied.

B. EnCase writes an MD5 value for every 64 sectors copied.

C. EnCase writes a CRC value for every 32 sectors copied.

D. EnCase writes a CRC value for every 64 sectors copied.

D. EnCase writes a CRC value for every 64 sectors copied.

What is the smallest file size that an EnCase evidence file can be saved as?

A. 64 sectors

B. 512 sectors

C. 1 MB

D. 2 MB

E. 640 MB

C. 1 MB

What is the largest file segment size that an EnCase evidence file can be saved as?

A. 640 MB

B. 1 GB

C. 2 GB

D. No maximum limit

C. 2 GB

How does EnCase verify that the evidence file contains an exact copy of the source device?

A. By comparing the MD5 hash value of the source device to the MD5 hash value of the data stored in the evidence file

B. By comparing the CRC value of the source device to the CRC of the data stored in the evidence file

C. By comparing the MD5 hash value of the source device to the MD5 hash value of the entire evidence file

D. By comparing the CRC value of the source device to the CRC value of the entire evidence file

A. By comparing the MD5 hash value of the source device to the MD5 hash value of the data stored in the evidence file

How does EnCase verify that the case information—such as case number, evidence number, notes, and so on—in an evidence file has not been damaged or altered after the evidence file has been written?

A. The case file writes a CRC value for the case information and verifies it when the case is opened.

B. EnCase does not verify the case information because it can be changed at any time.

C. EnCase writes a CRC value for the case information and verifies the CRC value when the evidence is added to a case.

D. EnCase writes an MD5 value of the case information and verifies the MD5 value when the evidence is added to a case.

C. EnCase writes a CRC value for the case information and verifies the CRC value when the evidence is added to a case.

For an EnCase evidence file to successfully pass the file verification process, which of the following must be true?

A. The MD5 hash value must verify.

B. The CRC values and the MD5 hash value both must verify.

C. Either the CRC or MD5 hash values must verify.

D. The CRC values must verify.

B. The CRC values and the MD5 hash value both must verify.

The MD5 hash algorithm produces a _____ value.

A. 32-bit

B. 64-bit

C. 128-bit

D. 256-bit

C. 128-bit

The MD5 hash algorithm is ___ hexadecimal characters in length.

A. 16

B. 32

C. 64

D. 128

B. 32

If an evidence file has been added to a case and completely verified, what happens if the data area within the evidence file is later altered?

A. EnCase will detect the error when that area of the evidence file is accessed by the user.

B. EnCase will detect the error if the evidence file is manually reverified.

C. EnCase will allow the examiner to continue to access the rest of the evidence file that has not been changed.

D. All of the above.

D. All of the above.

Which of the following aspects of the EnCase evidence file can be changed during a reacquire of the evidence file?

A. Investigator’s name

B. Evidence number

C. Notes

D. Evidence file size

E. All of the above

D. Evidence file size

An evidence file was archived onto five CD-ROMs with the third file segment on disc 3. Can the contents of the third file segment be verified by itself while still on the CD-ROM?

A. No. All evidence file segments must be put back together.

B. Yes. Any evidence file segment can be verified independently by comparing the CRC values.

B. Yes. Any evidence file segment can be verified independently by comparing the CRC values.

Will EnCase allow a user to write data into an acquired evidence file?

A. Yes, when adding notes or comments to bookmarks.

B. Yes, when adding search results.

C. A and B.

D. No, data cannot be added to the evidence file after the acquisition is made.

D. No, data cannot be added to the evidence file after the acquisition is made.

All investigators using EnCase should run tests on the evidence file acquisition and verification process to do which of the following?

A. To further the investigator’s understanding of the evidence file

B. To give more weight to the investigator’s testimony in court

C. To verify that all hardware and software is functioning properly

D. All of the above

D. All of the above

When a noncompressed evidence file is reacquired with compression, the acquisition and verification hash values for the evidence file will remain the same for both files.

A. True

B. False

A. True

Search hit results and bookmarks are stored in the evidence file.

A. True

B. False

B. False

The EnCase evidence file’s logical file name can be changed without affecting the verification of the acquired evidence.

A. True

B. False

A. True

An evidence file can be moved to another directory without changing the file verification.

A. True

B. False

B. False

What happens when EnCase attempts to reopen a case once the evidence file has been moved?

A. EnCase reports that the file’s integrity has been compromised and renders the file useless.

B. EnCase reports a different hash value for the evidence file.

C. EnCase prompts for the location of the evidence file.

D. EnCase opens the case, excluding the moved evidence file.

C. EnCase prompts for the location of the evidence file.

During reacquisition, you can change which of the following? (Choose all that apply.)

A. Block size and error granularity

B. Add or remove a password

C. Investigator’s name

D. Compression

E. File segment size

A. Block size and error granularity

B. Add or remove a password

D. Compression

E. File segment size

In the EnCase Windows environment, must an examiner first create a new case before adding a device to examine?

A. Yes

B. No

A. Yes

Proper file management and organization require that which of the following should be created prior to acquiring evidence?

A. Evidence, Export, Temp, and Index folders

B. Unique naming conventions for folders belonging to the same case

C. All subfolders saved under one folder with the same unique name

D. All of the above

D. All of the above

The EnCase methodology dictates that the lab drive used to store EnCase evidence files must have which of the following prior to acquiring an image?

A. FAT 32 partition

B. NTFS partition

C. Clean format

D. Previously wiped and sterile partition

D. Previously wiped and sterile partition

When creating a new case, the Case Options dialog box prompts for which of the following?

A. Name or (case name)

B. Examiner name

C. Default export folder

D. Temporary folder

E. All of the above

E. All of the above

What determines the action that will result when a user double-clicks a file within EnCase?

A. The settings in the TEXTSTYLES.INI file

B. The settings in the FILETYPES.INI file

C. The settings in the FILESIGNATURES.INI file

D. The settings in the VIEWERS.INI file

B. The settings in the FILETYPES.INI file

In the EnCase environment, the term external viewers is best described as which of the following?

A. Internal programs that are copied out of an evidence file

B. External programs loaded in the evidence file to open specific file types

C. External programs that are associated with EnCase to open specific file types

D. External viewers used to open a file that has been copied out of an evidence file

C. External programs that are associated with EnCase to open specific file types

Where is the list of external viewers kept within EnCase?

A. The settings in the TEXTSTYLES.INI file

B. The settings in the FILETYPES.INI file

C. The settings in the FILESIGNATURES.INI file

D. The settings in the VIEWERS.INI file

D. The settings in the VIEWERS.INI file

When the copy/unerase feature is used, EnCase saves the selected file(s) to which folder?

A. Evidence

B. Export

C. Temp

D. None of the above

B. Export

Can the Export folder be moved once it is saved within a case?

A. Yes

B. No

A. Yes

Files that have been sent to external viewers are copied to which folder?

A. Evidence

B. Export

C. Temp

D. None of the above

C. Temp

The Temp folder of a case cannot be changed once the case has been saved.

A. True

B. False

B. False

Files stored in the Temp folder are removed once EnCase is properly closed.

A. True

B. False

A. True

How do you access the setting to adjust how often a backup file (.cbak) is saved?

A. Select Tools _ Options _ Case Options

B. Select View _ Options _ Case Options

C. Select Tools _ Options _ Global

D. Select View _ Options _ Global

C. Select Tools _ Options _ Global

What is the maximum number of columns that can be sorted simultaneously in the Table view tab?

A. Two

B. Three

C. Five

D. 28 (maximum number of tabs)

C. Five

How would a user reverse-sort on a column in the Table view?

A. Hold down the Ctrl key, and double-click the selected column header.

B. Right-click the selected column, select Sort, and select either Sort Ascending or Sort Descending.

C. Both A and B.

C. Both A and B.

How can you hide a column in the Table view?

A. Place the cursor on the selected column, and press Ctrl+H.

B. Right-click on the selected column, select Column, and select Hide.

C. Right-click on the selected column, select Show Columns, and uncheck the desired fields to be hidden.

D. All of the above.

D. All of the above.

What does the Gallery view tab use to determine graphics files?

A. Header or file signature

B. File extension

C. File name

D. File size

B. File extension

Will the EnCase Gallery view display a .jpeg file if its file extension was renamed to .txt?

A. No, because EnCase will treat it as a text file.

B. Yes, because the Gallery view looks at a file’s header information and not the file extension.

C. Yes, but only if a signature analysis is performed to correct the “File Category” to “Picture” based on its file header information.

D. Yes, but only after a hash analysis is performed to determine the file’s true identity.

C. Yes, but only if a signature analysis is performed to correct the “File Category” to “Picture” based on its file header information.

How would a user change the default colors and text fonts within EnCase?

A. The user cannot change the default colors and fonts settings.

B. The user can change the default colors and fonts settings by right-clicking the selected items and scrolling down to Change Colors and Fonts.

C. The user can change the default colors and fonts settings by clicking the View tab on the menu bar and selecting the Colors tab or Fonts tab.

D. The user can change default colors and fonts settings by clicking the Tools tab on the menu bar, selecting Options, and selecting the Colors tab or Fonts tab.

D. The user can change default colors and fonts settings by clicking the Tools tab on the menu bar, selecting Options, and selecting the Colors tab or Fonts tab.

An EnCase user will always know the exact location of the selected data in the evidence file by looking at which of the following?

A. Data bar

B. Dixon box

C. Disk view

D. Hex view

A. Data bar

Computers use a numbering system with only two digits, 0 and 1. This system is referred to as which of the following?

A. Hexadecimal

B. ASCII

C. Binary

D. FAT

C. Binary

A bit can have a binary value of which of the following?

A. 0 or 1

B. 0–9

C. 0–9 and A–F

D. On or Off

A. 0 or 1

A byte consists of ___ bits.

A. 2

B. 4

C. 8

D. 16

C. 8

If 1 bit can have two unique possibilities, 2 bits can have four unique possibilities, and 3 bits can have eight unique possibilities. This is known as the power of 2. How many unique possibilities are there in 8 bits (28)?

A. 16

B. 64

C. 128

D. 256

D. 256

When the letter A is represented as 41h, it is displayed in which of the following?

A. Hexadecimal

B. ASCII

C. Binary

D. Decimal

A. Hexadecimal

What is the decimal integer value for the binary code 0000-1001?

A. 7

B. 9

C. 11

D. 1001

B. 9

Select all of the following that depict a Dword value.

A. 0000 0001

B. 0001

C. FF 00 10 AF

D. 0000 0000 0000 0000 0000 0000 0000 0001

C. FF 00 10 AF

D. 0000 0000 0000 0000 0000 0000 0000 0001

How many characters can be addressed by the 7-bit ASCII character table? 16-bit Unicode?

A. 64 and 256

B. 128 and 256

C. 64 and 65,536

D. 128 and 65,536

D. 128 and 65,536

Where does EnCase (Version 5 or 6) store keywords?

A. Within each specific case file (.case and .cbak)

B. In the KEYWORDS.INI file

C. Both A and B

D. None of the above

C. Both A and B

When performing a keyword search in Windows, EnCase searches which of the following?

A. The logical files

B. The physical disk in unallocated clusters and other unused disk areas

C. Both A and B

D. None of the above

C. Both A and B

By default, search terms are case sensitive.

A. True

B. False

B. False

By selecting the Unicode box, EnCase searches for both ASCII and Unicode formats.

A. True

B. False

A. True

With regard to a search using EnCase in the Windows environment, can EnCase find a word or phrase that is fragmented or spans in noncontiguous clusters?

A. No, because the letters are located in noncontiguous clusters.

B. No, EnCase performs a physical search only.

C. No, unless the File Slack option is deselected in the dialog box before the search.

D. Yes, EnCase performs both physical and logical searches.

D. Yes, EnCase performs both physical and logical searches.

Which of the following would be a search hit for the His keyword?

A. this

B. His

C. history

D. Bill_Chisholm@gmail.com

E. All of the above

E. All of the above

Which of the following would be a search hit for the following GREP expression?   [^a-z]Liz[^a-z]

A. Elizabeth

B. Lizzy

C. Liz1

D. None of the above

C. Liz1

Which of the following would be a search hit for the following GREP expression?

[\x00-\x07]\x00\x00\x00…

A. 00 00 00 01 A0 EE F1

B. 06 00 00 00 A0 EE F1

C. 0A 00 00 00 A0 EE F1

D. 08 00 00 00 A0 EE F1

B. 06 00 00 00 A0 EE F1

Which of the following would be a search hit for the following GREP expression?

Jan 1st, 2?0?06

A. Jan 1st, 2006

B. Jan 1st, 06

C. Both A and B

D. None of the above

C. Both A and B

Which of the following will not be a search hit for the following GREP expression?

[^#]123[ \-]45[ \-]6789[^#]

A. A1234567890

B. A123 45-6789

C. A123-45-6789

D. A123 45 6789

A. A1234567890

A sweep or highlight of a specific range of text is referred to as which of the following?

A. File group bookmark

B. Folder information bookmark

C. Highlighted data bookmark

D. Notable file bookmark

E. Notes bookmark

C. Highlighted data bookmark

Which of the following is not correct regarding building and querying indexes?

A. To search an index, click the Search button on the toolbar.

B. Search hits will appear in the Docs tab and in the Transcript tab.

C. The Hits tab appears in the Filters pane and is used to navigate among search hits.

D. The indexing tool is an EnScript.

E. Conditions are used to query an index.

A. To search an index, click the Search button on the toolbar.

When running a signature analysis, EnCase will do which of the following?

A. Compare a file’s header to its hash value.

B. Compare a file’s header to its file signature.

C. Compare a file’s hash value to its file extension.

D. Compare a file’s header to its file extension.

D. Compare a file’s header to its file extension.

A file header is which of the following?

A. A unique set of characters at the beginning of a file that identifies the file type

B. A unique set of characters following the file name that identifies the file type

C. A 128-bit value that is unique to a specific file based on its data

D. Synonymous with file extension

The Windows operating system uses a file name’s _______ to associate files with the proper applications.

A. signature

B. MD5 hash value

C. extension

D. metadata

C. extension

Unix (including Linux) operating systems use a file’s _______ to associate file types to specific applications.

A. metadata

B. header

C. extension

D. hash value

B. header

The Mac OS X operating system uses which of the following file information to associate a file to a specific application?

A. The “user defined” setting