Computer Hacking Forensic Investigator (CHFI v10) — Question 513

Before performing a logical or physical search of a drive in Encase, what must be added to the program?

Answer options

• A. File signatures
• B. Keywords
• C. Hash sets
• D. Bookmarks

Correct answer: B

Explanation

Keywords are essential in Encase as they define the search criteria for finding specific data within the drive. While file signatures, hash sets, and bookmarks serve important roles, they do not directly facilitate the initial search parameters like keywords do.