An EnCase evidence file of a hard drive ________ be restored to another hard drive of equal or greater size.
How many partitions can be found in the boot partition table found at the beginning of the drive?
The boot partition table found at the beginning of a hard drive is located in what sector?
Assume that MyNote.txt has been deleted. The FAT file system directory entry for that file has been overwritten. The data for MyNote.txt is now:
An evidence file can be moved to another directory without changing the file verification.
What files are reconfigured or deleted by EnCase during the creation of an EnCase boot disk?