A hard drive has 8 sectors per cluster. File Mystuff.doc has a logical file size of 13,000 bytes. How many clusters will be used by Mystuff.doc?
A. 4
B. 1
C. 3
D. 2
A sector on a floppy disk is the same size as a sector on a NTFS formatted hard drive.
A. True
B. False
Assume that an evidence file is added to a case, the case is saved, and the case is closed. What happens if the evidence file is moved, and the case is then opened?
A. EnCase reports that the file integrity has been compromised and renders the file useless.
B. EnCase asks for the location of the evidence file the next time the case is opened.
C. EnCase reports a different hash value for the evidence file.
D. EnCase opens the case, excluding the moved evidence.
The following keyword was typed in exactly as shown. Choose the answer(s) that would result. All search criteria have default settings.
A. Tom
B. tom jones
C. Tom Jones
D. Jones
Which of the following statements is more accurate?
A. The ecycle Bin increases the chance of locating the existence of a file on a computer. The recycle Bin increases the chance of locating the existence of a file on a computer.
B. The ecycle Bin reduces the chance of locating the existence of a file on a computer. The recycle Bin reduces the chance of locating the existence of a file on a computer.
The BIOS chip on an IBM clone computer is most commonly located on:
A. The RAM chip
B. The microprocessor
C. The controller card
D. The motherboard
Using good forensic practices, when seizing a computer at a business running Windows 2000 Server you should:
A. Shut it down normally.
B. Press the power button and hold it in.
C. Pull the plug from the back of the computer.
D. Pull the plug from the wall.
You are examining a hard drive that has Windows XP installed as the operating system. You see a file that has a date and time in the eletedcolumn. Where does that date and time come from ? Where does that date and time come from?
A. Directory Entry
B. Info2 file
C. Inode Table
D. Master File Table
If a hash analysis is run on a case, EnCase:
A. Will create a hash set to the user specifications. Will create a hash set to the user specifications.
B. Will compare the hash value of the files in the case to the hash library.
C. Will compute a hash value of the evidence file and begin a verification process.
D. Will generate a hash set for every file in the case.
When a file is deleted in the FAT file system, what happens to the FAT?
A. It is deleted as well.
B. The FAT entries for that file are marked as allocated.
C. Nothing.
D. The FAT entries for that file are marked as available.
Nowadays, the certification exams become more and more important and required by more and more enterprises when applying for a job. But how to prepare for the exam effectively? How to prepare for the exam in a short time with less efforts? How to get a ideal result and how to find the most reliable resources? Here on Vcedump.com, you will find all the answers. Vcedump.com provide not only Guidance Software exam questions, answers and explanations but also complete assistance on your exam preparation and certification application. If you are confused on your GD0-110 exam preparations and Guidance Software certification application, do not hesitate to visit our Vcedump.com to find your solutions here.