EnCE practice examsIn development
EnCase Certified Examiner
Court-defensible computer forensics with EnCase: the mindset of preserving the original and working on a verified copy, acquisition through a write blocker into an E01 image with matching source and image hashes as proof of authenticity, and an unbroken chain of custody that a gap can render evidence inadmissible; then file systems and the recovery of deleted data by carving and slack analysis, EnCase searching, hashing and timelining a read-only image, Windows artefacts across the registry, prefetch, link files and logs correlated into a timeline, and a clear defensible report and testimony.
What you get
Papers are cut from the bank and weighted like the real exam, and no question appears in two of them. Every wrong answer comes back on later days until you have it right.
What the exam covers
| Forensic principles, acquisition and evidence handling | Not published |
| Analysis, artefacts and reporting | Not published |
Two sample questions
1. Which limitation applies to private browsing mode?
- The browser does not record any of the history while it is enabled
- The examiner cannot determine which browser was being used
- The network connections made are not recorded in any log
- Some artefacts may still exist in memory or elsewhere on disk — correct
Why: Private mode reduces stored artefacts but traces can remain in memory, the page file, or other locations.
2. Why is a solid state drive a harder acquisition target than a spinning disk?
- Deleted files are never recoverable from any flash media
- The drive cannot be attached to a hardware write blocker
- Solid state drives cannot be hashed after being imaged
- The controller may erase deleted blocks without any instruction — correct
Why: Garbage collection and TRIM let the controller reclaim blocks on its own initiative, so unallocated content can disappear even with no host writing to the drive. That is why powering an SSD for longer than necessary is avoided and why recovery from unallocated space is much less reliable than on magnetic media.
The real EnCE exam
| Length | Phase I written exam, then a Phase II practical examination |
|---|---|
| Questions | Phase I is roughly 180 questions; Phase II is a hands-on investigation with a report |
| Pass mark | 80% on Phase I and 85% on Phase II |
| Price | Set by OpenText; training is available but not required to sit the exam |
| Recommended before you sit it | Either 64 hours of authorised training or 12 months of computer forensic experience. |
| Valid for | 3 years, renewed through continuing education |
Exam facts as published by OpenText; always check the vendor’s page before you book.
Study EnCE with Chiron
Chiron is invitation-only while we are in beta, and nothing is for sale yet: invited accounts use every paper, drill and course note for free.