312-49 · Question #369
Before performing a logical or physical search of a drive in Encase, what must be added to the program?
The correct answer is B. Keywords. In EnCase forensic software, keywords must be defined and added before initiating a logical or physical drive search. Keywords tell the search engine exactly what strings, patterns, or terms to look for across the evidence. Without keywords, EnCase has no criteria to search…
Question
Before performing a logical or physical search of a drive in Encase, what must be added to the program?
Options
- AFile signatures
- BKeywords
- CHash sets
- DBookmarks
How the community answered
(29 responses)- A3% (1)
- B93% (27)
- C3% (1)
Explanation
In EnCase forensic software, keywords must be defined and added before initiating a logical or physical drive search. Keywords tell the search engine exactly what strings, patterns, or terms to look for across the evidence. Without keywords, EnCase has no criteria to search against. File signatures are used for file type identification, hash sets are used for known-file filtering (e.g., NIST NSRL), and bookmarks are used to annotate findings after the fact - none of these are prerequisites for initiating a search.
Topics
Community Discussion
No community discussion yet for this question.