Guidance Software GD0-110 Online Practice Questions and Exam Preparation

Guidance Software GD0-110 Online Questions & Answers

• Question 1:

  How does EnCase verify that the case information (Case Number, Evidence Number, Investigator Name, etc) in an evidence file has not been damaged or changed, after the evidence file has been written?

  A. The .case file writes a CRC value for the case information and verifies it when the case is opened.
  B. EnCase does not verify the case information and case information can be changed by the user as it becomes necessary.
  C. EnCase writes a CRC value of the case information and verifies the CRC value when the evidence is added to a case.
  D. EnCase writes an MD5 hash value for the entire evidence file, which includes the case information, and verifies the MD5 hash when the evidence is added to a case.
  C. EnCase writes a CRC value of the case information and verifies the CRC value when the evidence is added to a case.

• Question 2:

  EnCase can make an image of a USB flash drive.

  A. True
  B. False
  B. False

• Question 3:

  The EnCase signature analysis is used to perform which of the following actions?

  A. Analyzing the relationship of a file signature to its file header.Analyzing the relationship of a file signature to its file header.
  B. Analyzing the relationship of a file signature to a list of hash sets.Analyzing the relationship of a file signature to a list of hash sets.
  C. Analyzing the relationship of a file signature to its computed MD5 hash value.Analyzing the relationship of a file signature to its computed MD5 hash value.
  A. Analyzing the relationship of a file signature to its file header.Analyzing the relationship of a file signature to its file header.

• Question 4:

  A signature analysis has been run on a case. The result *JPEG in the signature column means:

  A. The file signature is unknown and the file extension is JPEG.
  B. The file signature is unknown and the header is a JPEG.
  C. The file signature is a JPEG signature and the file extension is incorrect.
  D. None of the above.
  C. The file signature is a JPEG signature and the file extension is incorrect.

• Question 5:

  Which of the following is commonly used to encode e-mail attachments?

  A. GIF
  B. EMF
  C. JPEG
  D. Base64
  D. Base64

• Question 6:

  In Windows 2000 and XP, which of the following directories contain user personal folders?

  A. C:\WINNT\Profiles
  B. C:\Documents and Settings
  C. C:\Windows\Users
  D. C:\Personnel Folders
  B. C:\Documents and Settings

• Question 7:

  If cluster #3552 entry in the FAT table contains a value of this would mean:

  A. The cluster is allocated
  B. The cluster is marked bad
  C. The cluster is unallocated
  D. The cluster is the end of a file
  C. The cluster is unallocated

• Question 8:

  Select the appropriate name for the highlighted area of the binary numbers.

  A. Nibble
  B. Dword
  C. Word
  D. Byte
  E. Bit
  D. Byte

• Question 9:

  Pressing the power button on a computer that is running could have which of the following results?

  A. The operating system will shut down normally.
  B. The computer will instantly shut off.
  C. Nothing will happen.
  D. All of the above could happen.
  E. The computer will go into stand-by mode.
  D. All of the above could happen.

• Question 10:

  When a file is deleted in the FAT or NTFS file systems, what happens to the data on the hard drive?

  A. The file header is marked with a Sigma so the file is not recognized by the operating system.
  B. It is moved to a special area.
  C. It is overwritten with zeroes.
  D. Nothing.
  D. Nothing.