Guidance Software Guidance Software Certification GD0-100 Questions & Answers

• Question 41:

  Search terms are stored in what .ini configuration file

  A. FileSignatures.ini

  B. Keywords.ini

  C. TextStyle.ini

  D. FileTypes.ini

  Correct Answer: B

• Question 42:

  Within EnCase for Windows, the search process is:

  A. None of the above

  B. both a and b

  C. a search of the physical disk in unallocated clusters and other unused disk areas

  D. a search of the logical files

  Correct Answer: B

• Question 43:

  GREP terms are automatically recognized as GREP by EnCase.

  A. True

  B. False

  Correct Answer: B

• Question 44:

  By default, what color does EnCase use for slack?

  A. Black on red

  B. Red on black

  C. Red

  D. Black

  Correct Answer: C

• Question 45:

  When a file is deleted in the FAT or NTFS file systems, what happens to the data on the hard drive?

  A. Nothing.

  B. It is moved to a special area.

  C. It is overwritten with zeroes.

  D. The file header is marked with a Sigma so the file is not recognized by the operating system.

  Correct Answer: A

• Question 46:

  Assume that MyNote.txt was allocated to clusters 5, 9, and 11. Cluster 6, 7, and 8 belong to MyResume.doc. Both files have been deleted and the directory entry in the FAT file system for MyResume.doc has been overwritten. What clusters would EnCase use to undelete MyNote.txt?

  A. 5,9,11

  B. 5,6,7

  C. 7,8,9

  D. 6,7,8

  Correct Answer: B

• Question 47:

  EnCase can build a hash set of a selected group of files.

  A. True

  B. False

  Correct Answer: A

• Question 48:

  When handling computer evidence, an investigator should:

  A. Both a and b

  B. Make any changes to the evidence that will further the investigation.

  C. Neither a or b

  D. Avoid making any changes to the original evidence.

  Correct Answer: D

• Question 49:

  RAM is an acronym for: A. Random Addressable Memory

  B. Relative Addressable Memory

  C. Random Access Memory

  D. Relative Address Memory

  Correct Answer: C

• Question 50:

  The term signature and reader as they relate to a signature analysis are

  A. None of the above

  B. The signature is the file extension. The header is a standard pattern normally found at the beginning of a file.

  C. Synonymous.

  D. Areas compared with each other to verify the correct file type.

  Correct Answer: C