When a file is deleted in the FAT file system, what happens to the filename?
A. It is zeroed out.
B. The first character of the directory entry is marked with a hex 00.
C. It is wiped from the directory.
D. The first character of the directory entry is marked with a hex E5.
In Windows 98 and ME, Internet based e-mail, such as Hotmail, will most likely be recovered in the _____________________ folder.
A. C:\Windows\Online\Applications\email
B. C:\Windows\Temporary Internet files
C. C:\Windows\History\Email
D. C:\Windows\Temp
For an EnCase evidence file acquired with a hash value to pass verification, which of the following must be true?
A. The MD5 hash value must verify.
B. The CRC values must verify.
C. The CRC values and the MD5 hash value both must verify.
D. Either the CRC or MD5 hash values must verify.
Which of the following aspects of the EnCase evidence file can be changed during a reacquire of the evidence file
A. The evidence number
B. None of the above
C. The acquisition notes
D. The investigator name
You are investigating a case of child pornography on a hard drive containing Windows XP. In the :\Documents and Settings\Bad You are investigating a case of child pornography on a hard drive containing Windows XP. In the C:\Documents
and Settings\Bad Guy\Local Settings\Temporary Internet Files folder you find three images of child pornography. You find no other copies of the images on the suspect hard drive, and you find no other copies of the filenames.
What can be deduced from your findings?
A. The presence and location of the images is not strong evidence of possession.
B. The presence and location of the images is strong evidence of possession.
C. The presence and location of the images proves the images were intentionally downloaded.
D. Both a and c
Which of the following would be a true statement about the function of the BIOS?
A. Botha and c.
B. The BIOS integrates compressed executable files with memory addresses for faster execution.
C. The BIOS is responsible for checking and configuring the system after the power is turned on.
D. The BIOS is responsible for swapping out memory pages when RAM fills up.
Will EnCase allow a user to write data into an acquired evidence file
A. Yes, but only bookmarks.
B. Yes, but only to resize the partitions.
C. No. Data cannot be added to the evidence file after the acquisition is made.
D. Yes, but only case information.
E. No, unless the user established a writing privilege when the evidence was acquired.
The Windows 98 Start Menu has a selection called documents which displays a list of recently used files. Which of the following The Windows 98 Start Menu has a selection called documents which displays a list of recently used files. Which of the following folders contain those files?
A. C:\Windows\History
B. C:\Windows\Start menu\Documents
C. C:\Windows\Documents
D. C:\Windows\Recent
Which of the following would most likely be an add-in card?
A. A video card that is connected to the motherboard in the AGP slot
B. Anything plugged into socket 7
C. A motherboard
D. The board that connects to the power supply
How many partitions can be found in the boot partition table found at the beginning of the drive?
A. 8
B. 4
C. 6
D. 2
Nowadays, the certification exams become more and more important and required by more and more enterprises when applying for a job. But how to prepare for the exam effectively? How to prepare for the exam in a short time with less efforts? How to get a ideal result and how to find the most reliable resources? Here on Vcedump.com, you will find all the answers. Vcedump.com provide not only Guidance Software exam questions, answers and explanations but also complete assistance on your exam preparation and certification application. If you are confused on your GD0-100 exam preparations and Guidance Software certification application, do not hesitate to visit our Vcedump.com to find your solutions here.