Guidance Software Guidance Software Certifications GD0-100 Questions & Answers

• Question 151:

  Which of the following selections would be used to keep track of a fragmented file in the FAT file system?

  A. The directory entry for the fragmented file

  B. The partition table of extents

  C. The File Allocation Table

  D. All of the above

  Correct Answer: C

• Question 152:

  When can an evidence file containing a NTFS partition be logically restored to a FAT 32 partition?

  A. Never

  B. When the FAT 32 has the same number of sectors / clusters.

  C. When the FAT 32 is the same size or bigger.

  D. Both a and b

  Correct Answer: A

• Question 153:

  A standard DOS 6.22 boot disk is acceptable for booting a suspect drive.

  A. True

  B. False

  Correct Answer: B

• Question 154:

  The case file should be archived with the evidence files at the termination of a case.

  A. True

  B. False

  Correct Answer: A

• Question 155:

  A signature analysis has been run on a case. The result "Bad Signature " means:

  A. The file signature is known and does not match a known file header.

  B. The file signature is known and the file extension is known.

  C. The file signature is known and does not match a known file extension.

  D. The file signature is unknown and the file extension is known.

  Correct Answer: D

• Question 156:

  An evidence file was archived onto five CD-Rom disks with the third file segment on disk number three. Can the contents of the third file segment be verified by itself while still on the CD?

  A. No. Archived files are compressed and cannot be verified until un-archived.

  B. No. All file segments must be put back together.

  C. Yes. Any segment of an evidence file can be verified through re-computing and comparing the CRCs, even if it is on a CD.

  D. No. EnCase cannot verify files on CDs.

  Correct Answer: C

• Question 157:

  This question addresses the EnCase for Windows search process. If a target word is within a logical file, and it begins in cluster 10 and ends in cluster 15 (the word is fragmented), the search:

  A. Will not find it unlessile slack is checked on the search dialog box.

  B. Will find it because EnCase performs a logical search.

  C. Will not find it because EnCase performs a physical search only.

  D. Will not find it because the letters of the keyword are not contiguous.

  Correct Answer: B

• Question 158:

  The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. [^a-z] Tom[^a-z]

  A. Tomato

  B. om RP

  C. Toms

  D. Stomp

  Correct Answer: B

• Question 159:

  A SCSI drive is pinned as a master when it is:

  A. The only drive on the computer.

  B. The primary of two drives connected to one cable.

  C. Whenever another drive is on the same cable and is pinned as a slave.

  D. A SCSI drive is not pinned as a master.

  Correct Answer: D

• Question 160:

  By default, EnCase will display the data from the end of a logical file, to the end of the cluster, in what color:

  A. Red

  B. Red on black

  C. Black on red

  D. Black

  Correct Answer: A