How many clusters can a FAT 16 system address?
RAM is tested during which phase of the power-up sequence?
If cluster #3552 entry in the FAT table contains a value of ?? this would mean:
Which of the following directories contain the information that is found on a Windows 98 Desktop?
EnCase can make an image of a USB flash drive.
The temporary folder of a case cannot be changed once it has been set.
You are working in a computer forensic lab. A law enforcement investigator brings you a computer and a valid search warrant. You have legal authority to search the computer. The investigator hands you a piece of paper that has three printed checks on it. All three checks have the same check and account number. You image the suspect computer and open the evidence file with EnCase. You checks have the same check and account number. You image the suspect's computer and open the evidence file with EnCase. You perform a text search for the account number and check number. Nothing returns on the search results. You perform a text search for all other information found on the printed checks and there is still nothing returned in the search results. You run a signature analysis and check the gallery. You cannot locate any graphical copies of the printed checks in the gallery. At this point, is it safe to say that the checks are not located on the suspect computer?
A file extension and signature can be manually added by:
In Windows 98 and ME, Internet based e-mail, such as Hotmail, will most likely be recovered in the _____________________ folder.
To undelete a file in the FAT file system, EnCase computes the number of _______ the file will use based on the file ______.
