Guidance Software Guidance Software Certifications GD0-100 Questions & Answers

• Question 81:

  When a file is deleted in the FAT file system, what happens to the filename?

  A. It is zeroed out.

  B. The first character of the directory entry is marked with a hex 00.

  C. It is wiped from the directory.

  D. The first character of the directory entry is marked with a hex E5.

  Correct Answer: D

• Question 82:

  In Windows 98 and ME, Internet based e-mail, such as Hotmail, will most likely be recovered in the _____________________ folder.

  A. C:\Windows\Online\Applications\email

  B. C:\Windows\Temporary Internet files

  C. C:\Windows\History\Email

  D. C:\Windows\Temp

  Correct Answer: B

• Question 83:

  For an EnCase evidence file acquired with a hash value to pass verification, which of the following must be true?

  A. The MD5 hash value must verify.

  B. The CRC values must verify.

  C. The CRC values and the MD5 hash value both must verify.

  D. Either the CRC or MD5 hash values must verify.

  Correct Answer: C

• Question 84:

  Which of the following aspects of the EnCase evidence file can be changed during a reacquire of the evidence file

  A. The evidence number

  B. None of the above

  C. The acquisition notes

  D. The investigator name

  Correct Answer: B

• Question 85:

  You are investigating a case of child pornography on a hard drive containing Windows XP. In the :\Documents and Settings\Bad You are investigating a case of child pornography on a hard drive containing Windows XP. In the C:\Documents

  and Settings\Bad Guy\Local Settings\Temporary Internet Files folder you find three images of child pornography. You find no other copies of the images on the suspect hard drive, and you find no other copies of the filenames.

  What can be deduced from your findings?

  A. The presence and location of the images is not strong evidence of possession.

  B. The presence and location of the images is strong evidence of possession.

  C. The presence and location of the images proves the images were intentionally downloaded.

  D. Both a and c

  Correct Answer: A

• Question 86:

  Which of the following would be a true statement about the function of the BIOS?

  A. Botha and c.

  B. The BIOS integrates compressed executable files with memory addresses for faster execution.

  C. The BIOS is responsible for checking and configuring the system after the power is turned on.

  D. The BIOS is responsible for swapping out memory pages when RAM fills up.

  Correct Answer: C

• Question 87:

  Will EnCase allow a user to write data into an acquired evidence file

  A. Yes, but only bookmarks.

  B. Yes, but only to resize the partitions.

  C. No. Data cannot be added to the evidence file after the acquisition is made.

  D. Yes, but only case information.

  E. No, unless the user established a writing privilege when the evidence was acquired.

  Correct Answer: C

• Question 88:

  The Windows 98 Start Menu has a selection called documents which displays a list of recently used files. Which of the following The Windows 98 Start Menu has a selection called documents which displays a list of recently used files. Which of the following folders contain those files?

  A. C:\Windows\History

  B. C:\Windows\Start menu\Documents

  C. C:\Windows\Documents

  D. C:\Windows\Recent

  Correct Answer: D

• Question 89:

  Which of the following would most likely be an add-in card?

  A. A video card that is connected to the motherboard in the AGP slot

  B. Anything plugged into socket 7

  C. A motherboard

  D. The board that connects to the power supply

  Correct Answer: A

• Question 90:

  How many partitions can be found in the boot partition table found at the beginning of the drive?

  A. 8

  B. 4

  C. 6

  D. 2

  Correct Answer: B