Guidance Software Guidance Software Certifications GD0-100 Questions & Answers

• Question 101:

  RAM is tested during which phase of the power-up sequence?

  A. Pre-POST

  B. After POST

  C. During POST

  D. None of the above.

  Correct Answer: C

• Question 102:

  This question addresses the EnCase for Windows search process. If a target word is located in the unallocated space, and the word is fragmented between clusters 10 and 15, the search:

  A. Will not find it because the letters of the keyword are not contiguous.

  B. Will not find it because EnCase performs a physical search only.

  C. Will find it because EnCase performs a logical search.

  D. Will not find it unlessile slack?is checked on the search dialog box. Will not find it unless ?ile slack?is checked on the search dialog box.

  Correct Answer: A

• Question 103:

  In Windows, the file MyNote.txt is deleted from C Drive and is automatically sent to the Recycle Bin. The long filename was MyNote.txt and the short filename was MYNOTE.TXT. When viewing the Recycle Bin with EnCase, how will the long filename and MyNote.txt and the short filename was MYNOTE.TXT?

  A. MyNote.txt, CD0.txt

  B. MyNote.txt, DC0.txt

  C. MyNote.del, DC1.del

  D. MyNote.del, DC0.del

  Correct Answer: B

• Question 104:

  A CPU is:

  A. A chip that would be considered the brain of a computer, which is installed on a motherboard.

  B. A Central Programming Unit.

  C. A motherboard with all required devices connected.

  D. An entire computer box, not including the monitor and other attached peripheral devices.

  Correct Answer: A

• Question 105:

  A SCSI host adapter would most likely perform which of the following tasks?

  A. Configure the motherboard settings to the BIOS.

  B. None of the above.

  C. Set up the connection of IDE hard drives.

  D. Make SCSI hard drives and other SCSI devices accessible to the operating system.

  Correct Answer: D

• Question 106:

  The EnCase signature analysis is used to perform which of the following actions?

  A. Analyzing the relationship of a file signature to its file extension.Analyzing the relationship of a file signature to its file extension.

  B. Analyzing the relationship of a file signature to its file header.Analyzing the relationship of a file signature to its file header.

  C. Analyzing the relationship of a file signature to a list of hash sets.Analyzing the relationship of a file signature to a list of hash sets.

  D. Analyzing the relationship of a file signature to its computed MD5 hash value.Analyzing the relationship of a file signature to its computed MD5 hash value.

  Correct Answer: A

• Question 107:

  You are assigned to assist with the search and seizure of several computers. The magistrate ordered that the computers cannot be seized unless they are found to contain any one of ten previously identified images. You currently have the ten images in JPG format. Using the EnCase methodology, how would you best handle this situation?

  A. UseFastBloc or a network/parallel port cable to preview the hard drives. Go to the Gallery view and search for the previously identified images.

  B. UseFastBloc or a network/parallel port cable to acquire forensic images of the hard drives, then search the evidence files for the previously identified images.

  C. UseFastBloc or a network/parallel port cable to preview the hard drives. Conduct a hash analysis of the files on the hard drives, using a hash library containing the hash values of the previously identified images.

  D. Use an EnCase DOS boot disk to conduct a text search for child porn. Use an EnCase DOS boot disk to conduct a text search for child porn?

  Correct Answer: C

• Question 108:

  When undeleting a file in the FAT file system, EnCase will check the _____________ to see if it has already been overwritten.

  A. data on the hard drive

  B. deletion table

  C. directory entry

  D. FAT

  Correct Answer: D

• Question 109:

  When an EnCase user double-clicks on a valid .jpg file, that file is:

  A. Copied to the default export folder and opened by an associated program.

  B. Renamed to JPG_0001.jpg and copied to the default export folder.

  C. Copied to the EnCase specified temp folder and opened by an associated program.

  D. Opened by EnCase.

  Correct Answer: C

• Question 110:

  To later verify the contents of an evidence file 7RODWHUYHULI\WKHFRQWHQWVRIDQHYLGHQFHILOH

  A. EnCase writes a CRC value for every 64 sectors copied.

  B. EnCase writes a CRC value for every 128 sectors copied.

  C. EnCase writes an MD5 hash value every 64 sectors copied.

  D. EnCase writes an MD5 hash value for every 32 sectors copied.

  Correct Answer: A