By default, what color does EnCase use for the contents of a logical file?
4 bits allows what number of possibilities?
A hard drive has been formatted as NTFS and Windows XP was installed. The user used fdisk to remove all partitions from that drive. Nothing else was done.You have imaged the drive and have opened the evidence file with EnCase. What would be the best way to examine this hard drive?
For an EnCase evidence file acquired with a hash value to pass verification, which of the following must be true?
Which of the following selections would be used to keep track of a fragmented file in the FAT file system?
A FAT directory has as a logical size of:
