By default, what color does EnCase use for the contents of a logical file
A. Red
B. Red on black
C. Black
D. Black on red
In Windows 2000 and XP, which of the following directories contain user personal folders?
A. C:\Personnel Folders
B. C:\WINNT\Profiles
C. C:\Windows\Users
D. C:\Documents and Settings
The MD5 hash algorithm produces a _____ number.
A. 32 bit
B. 256 bit
C. 64 bit
D. 128 bit
An EnCase evidence file of a hard drive ________ be restored to another hard drive of equal or greater size.
A. can
B. cannot
Searches and bookmarks are stored in the evidence file.
A. False
B. True
The EnCase evidence file is best described as:
A. A clone of the source hard drive.
B. A sector-by-sector copy of the source hard drive written to the corresponding sectors of the target hard drive.
C. A bit stream image of the source hard drive written to a file, or several file segments.
D. A bit stream image of the source hard drive written to the corresponding sectors of the target hard drive.
4 bits allows what number of possibilities?
A. 16
B. 4
C. 2
D. 8
If an evidence file has been added to a case and completely verified, what happens if the data area within the evidence file is later changed?
A. EnCase will allow the examiner to continue to access the rest of the evidence file that has not been changed.
B. EnCase detect the error if the evidence file is manually re-verified.
C. EnCase will detect the error when that area of the evidence file is accessed by the user.
D. All of the above.
Creating an image of a hard drive that was seized as evidence:
A. May be done by anyone because it is a relatively simple procedure.
B. May only be done by trained personnel because the process has the potential to alter the original evidence.
C. May only be done by computer scientists.
D. Should be done by the user, as they are most familiar with the hard drive.
The signature table data is found in which of the following files?
A. The evidence file
B. The configuration FileSignatures.ini file
C. All of the above
D. The case file
Nowadays, the certification exams become more and more important and required by more and more enterprises when applying for a job. But how to prepare for the exam effectively? How to prepare for the exam in a short time with less efforts? How to get a ideal result and how to find the most reliable resources? Here on Vcedump.com, you will find all the answers. Vcedump.com provide not only Guidance Software exam questions, answers and explanations but also complete assistance on your exam preparation and certification application. If you are confused on your GD0-100 exam preparations and Guidance Software certification application, do not hesitate to visit our Vcedump.com to find your solutions here.