What technique used by Encase makes it virtually impossible to tamper with evidence once it has been acquired?
When carrying out a forensics investigation, why should you never delete a partition on a dynamic disk?
What type of file is represented by a colon (:) with a name following it in the Master File Table (MFT) of an NTFS disk?