Guidance Software Guidance Software Certification GD0-110 Questions & Answers

• Question 161:

  A personal data assistant was placed in a evidence locker until an examiner has time to examine it. Which of the following areas would require special attention?

  A. Chain-of-custody

  B. Cross-contamination

  C. Storage

  D. There is no concern

  Correct Answer: C

• Question 162:

  Hash libraries are commonly used to:

  A. Compare a file header to a file extension.

  B. Compare one hash set with another hash set.

  C. Identify files that are already known to the user.

  D. Verify the evidence file.

  Correct Answer: C

• Question 163:

  In hexadecimal notation, one byte is represented by character(s).

  A. 8

  B. 4

  C. 2

  D. 1

  Correct Answer: C

• Question 164:

  In Windows, the file MyNote.txt is deleted from C Drive and is automatically sent to the ecycle Bin. The long filename was In Windows, the file MyNote.txt is deleted from C Drive and is automatically sent to the recycle Bin. The long filename was MyNote.txt and the short filename was MYNOTE.TXT. When viewing the ecycle Bin with EnCase, how will the long filename and MyNote.txt and the short filename was MYNOTE.TXT. When viewing the recycle Bin with EnCase, how will the long filename and short filename appear?

  A. MyNote.txt, DC0.txt

  B. MyNote.del, DC1.del

  C. MyNote.txt, CD0.txt

  D. MyNote.del, DC0.del

  Correct Answer: A

• Question 165:

  For an EnCase evidence file acquired with a hash value to pass verification, which of the following must be true?

  A. Either the CRC or MD5 hash values must verify.

  B. The CRC values must verify.

  C. The CRC values and the MD5 hash value both must verify.

  D. The MD5 hash value must verify.

  Correct Answer: C

• Question 166:

  Which of the following selections would be used to keep track of a fragmented file in the FAT file system?

  A. All of the above

  B. The partition table of extents

  C. The File Allocation Table

  D. The directory entry for the fragmented file

  Correct Answer: C

• Question 167:

  Within EnCase for Windows, the search process is:

  A. a search of the logical files

  B. a search of the physical disk in unallocated clusters and other unused disk areas

  C. both a and b

  D. None of the above

  Correct Answer: C

• Question 168:

  A hard drive has been formatted as NTFS and Windows XP was installed. The user used fdisk to remove all partitions from that drive. Nothing else was done. You have imaged the drive and have opened the evidence file with EnCase.

  What would be the best way to examine this hard drive?

  A. EnCase will not see a drive that has been fdisked.

  B. Use the ecovered Deleted Partitionsfeature and then examine the system. Use the recovered Deleted Partitions feature and then examine the system.

  C. Conduct a physical search of the hard drive and bookmark any evidence.

  D. Use the dd Partitionfeature to rebuild the partition and then examine the system. Use the add Partitionfeature to rebuild the partition and then examine the system.

  Correct Answer: D

• Question 169:

  4 bits allows what number of possibilities?

  B. 2

  C. 4

  D. 8

  Correct Answer: A

• Question 170:

  EnCase is able to read and examine which of the following file systems?

  A. HFS

  B. FAT

  C. NTFS

  D. EXT3

  Correct Answer: ABCD