Understanding, Searching for, and Bookmarking Data - Review Questions

16 important questions on Understanding, Searching for, and Bookmarking Data - Review Questions

Computers use a numbering system with only two digits, 0 and 1. This system is referred toas which of the following?

A. Hexadecimal
B. ASCII
C. Binary

C.  Binary is a numbering system consisting of 0 and 1 used by computers to
      process information.


3. A byte consists of ___ bits.

A. 2
B. 4
C. 8
D. 16

C.  A bytes consists of 8 bits or two 4 bit nibbles, commonly referred to as the left nibble or right nibble.


4. If 1 bit can have two unique possibilities, 2 bits can have four unique possibilities, and 3 bits can have eight unique possibilities. This is known as the power of 2. How many unique
possibilities are there in 8 bits (2^8)?

A. 16
B. 64
C. 128
D. 256

D. 2 (to the 8th) is 2 x 2 eight times, or 2x2x2x2x2x2x2x2=256
  • Higher grades + faster learning
  • Never study anything twice
  • 100% sure, 100% understanding
Discover Study Smart


5. When the letter A is represented as 41h, it is displayed in which of the following?

A. Hexadecimal
B. ASCII
C. Binary
D. Decimal

A. values expressed with the letter "h" as a suffix are hexadecimal characters.  EnCase can display the letter A in text or hexadecimal formats.


6. What is the decimal integer value for the binary code 0000-1001?

A. 7
B. 9
C. 11
D. 1001


B.  Starting from the right, the bits are "on" for bit positions 1 and 8, which totals 9.


7. Select all of the following that depict a Dword value.

A. 0000 0001
B. 0001
C. FF 00 10 AF
D. 0000 0000 0000 0000 0000 0000 0000 0001


C and D...  A Dword is a 32 bit value.  A is incorrect because it depicts 8 binary bits or one byte.  B is incorrect because it depict 4 binary bits or one nibble.  C is correct because it represents four hexadecimal values with each being 8 bits (4 x 8 = 32 bits).  D is correct because it represents 32 binary bits.


8. How many characters can be addressed by the 7-bit ASCII character table? 16-bit Unicode?

A. 64 and 256
B. 128 and 256
C. 64 and 65,536
D. 128 and 65,536

D.  2 (to the 7th) is 2 x2 seven times = 128, while 2(to the 16th) is 2x2 sixteen times = 65,536.


10. When performing a keyword search in Windows, EnCase searches which of the following?

A. The logical files
B. The physical disk in unallocated clusters and other unused disk areas
C. Both A and B
D. None of the above


C.  EnCase performs a search no  only of logical files but of the entire disk to include unallocated clusters and unused disk areas outside the logical partition.


12. By selecting the Unicode box for a raw search, EnCase searches for both ASCII and Unicode formats.


A. True
B. False

A.  True, by selecting the Unicode box, EnCase will search for both ASCII and Unicode formats.


13. With regard to a search using EnCase in the Windows environment, can EnCase find a word or phrase that is fragmented or spans in noncontiguous clusters?

A. No, because the letters are located in noncontiguous clusters.
B. No, EnCase performs a physical search only.
C. No, unless the File Slack option is deselected in the dialog box before the search.
D. Yes, EnCase performs both physical and logical searches.

D.  EnCase can perform both physical searches as well as logical searches for keyword(s) that span noncontiguous clusters.


14. Which of the following would be a raw search hit for the His keyword?

A. this
B. His
C. history
D. Bill_Chisholm@gmail.
E. All of the above.


E. All of the above.  Since the entry allows for characters to precede and follow the keyword and the default setting does not have the the Case Sensitive option enabled, all the selections apply.



15. Which of the following would be a search hit for the following GREP expression? [^a-z]Liz[^a-z]

A. Elizabeth
B. Lizzy
C. Liz1
D. None of the above

C.  The GREP symbol ^ means to exclude the following characters.  So, the GReP expression in the question exclude the alpha characters (a through z) before and after the keyword but will find non-alpha characters such as numbers.

16. Which of the following would be a search hit for the following GREP expression? [x00-x07]x00x00x00…


A. 00 00 00 01 A0 EE F1
B. 06 00 00 00 A0 EE F1
C. 0A 00 00 00 A0 EE F1D. 08 00 00 00 A0 EE F1



B.  The GREP expression in the question permits a hexadecimal range from 00 through 07 followedd by hexadecimal values 00 00 00 and any other characters.


17. Which of the following would be a search hit for the following index search expression? <c>Saddam npre/3 Hussein

A. Saddam Alfonso Adolph Cano Hitler Hussein
B. saddam alfonso adolph cano hitler hussein
C. Saddam Alfonso Hussein Adolph Cano Hitler
D. Hussein Hitler Cano Adolph Alfonso Saddam
E. saddam alfonso hussein adolph cano hitler
F. None of the above

A.  This index search expression calls first for a case-sensitive search, because of the <c>.  The npre/3 means at least three words apart and Saddam must precede Hussein.  Only A meets this query.

18. Which of the following will not be a search hit for the following GREP expression? [^#]123[ -]45[ -]6789[^#]


A. A1234567890
B. A123 45-6789
C. A123-45-6789D. A123 45 6789

A.  The GREP expression [^#] means that it cannot be a number, meaning the first character and last character following the 9 can't be numbers.  Therefore, A will not return as a search hit because the number 0 follows the number 9.


19. A sweep or highlight of a specific range of text is referred to as which of the following?

A. Table view bookmark
B. Single item bookmark
C. Highlighted data bookmark
D. Notes bookmark
E. Notable file bookmark

C.  The highlighted data bookmark is a sweep or highlight of a specific test fragment.

The question on the page originate from the summary of the following study material:

  • A unique study and practice tool
  • Never study anything twice again
  • Get the grades you hope for
  • 100% sure, 100% understanding
Remember faster, study better. Scientifically proven.
Trustpilot Logo