A picture file is recovered from a computer under investigation. During the investigation process, the file is
enlarged 500% to get a better view of its contents. The picture quality is not degraded at all from this process.
What kind of picture is this file. What kind of picture is this file?

Preparing an image drive to copy files to is the first step in Linux forensics. For this purpose, what would the
following command accomplish?dcfldd if=/dev/zero of=/dev/hda bs=4096 conv=noerror, sync

What will the following command accomplish?
dd if=/dev/xxx of=mbr.backup bs=512 count=1

What is the slave device connected to the secondary IDE controller on a Linux OS referred to?

Why should you never power on a computer that you need to acquire digital evidence from?

A forensics investigator is searching the hard drive of a computer for files that were recently moved to the
Recycle Bin. He searches for files in C:\\RECYCLED using a command line tool but does not find anything.
What is the reason for this?

Travis, a computer forensics investigator, is finishing up a case he has been working on for over a month
involving copyright infringement and embezzlement. His last task is to prepare an investigative report for the
president of the company he has been working for. Travis must submit a hard copy and an electronic copy to
this president. In what electronic format should Travis send this report?

Given the drive dimensions as follows and assuming a sector has 512 bytes, what is the capacity of the
described hard drive?
22,164 cylinders/disk
80 heads/cylinder
63 sectors/track

Where does Encase search to recover NTFS files and folders?

Under confession, an accused criminal admitted to encrypting child pornography pictures and then hiding them
within other pictures. What technique did the accused criminal employ?