312-49 · Question #199
What technique used by Encase makes it virtually impossible to tamper with evidence once it has been acquired?
The correct answer is B. Every byte of the file(s) is verified using 32-bit CRC. EnCase uses 32-bit CRC (Cyclic Redundancy Check) on blocks of acquired data to verify integrity. When evidence is acquired, the data is divided into blocks, and a CRC-32 value is computed for each block and stored within the EnCase Evidence File (.E01). Any post-acquisition…
Question
What technique used by Encase makes it virtually impossible to tamper with evidence once it has been acquired?
Options
- AEvery byte of the file(s) is given an MD5 hash to match against a master file
- BEvery byte of the file(s) is verified using 32-bit CRC
- CEvery byte of the file(s) is copied to three different hard drives
- DEvery byte of the file(s) is encrypted using three different methods
How the community answered
(46 responses)- A2% (1)
- B93% (43)
- D4% (2)
Explanation
EnCase uses 32-bit CRC (Cyclic Redundancy Check) on blocks of acquired data to verify integrity. When evidence is acquired, the data is divided into blocks, and a CRC-32 value is computed for each block and stored within the EnCase Evidence File (.E01). Any post-acquisition tampering with the evidence data would cause the recalculated CRC to mismatch the stored value, immediately revealing the alteration. EnCase also computes an MD5 hash of the overall evidence file, but the block-level CRC-32 verification is the specific mechanism that makes tampering with individual portions of evidence detectable.
Topics
Community Discussion
No community discussion yet for this question.