Guidance Software Guidance Software Certification GD0-110 Questions & Answers

• Question 41:

  An EnCase evidence file of a hard drive be restored to another hard drive of equal or greater size.

  A. cannot

  B. can

  Correct Answer: B

• Question 42:

  How are the results of a signature analysis examined?

  A. By sorting on the signature column in the table view.

  B. By sorting on the hash library column in the table view.

  C. By sorting on the hash sets column in the table view

  D. By sorting on the category column in the table view.

  Correct Answer: C

• Question 43:

  If a hard drive is left in a room while acquiring, and several persons have access to that room, which of the following areas would be of most concern?

  A. Storage

  B. There is no concern

  C. Cross-contamination

  D. Chain-of-custody

  Correct Answer: D

• Question 44:

  The following keyword was typed in exactly as shown. Choose the answer(s) that would result. All search criteria have default settings.

  A. Meth Speed

  B. Speed and Meth

  C. Meth

  D. Speed

  Correct Answer: B

• Question 45:

  A standard Windows 98 boot disk is acceptable for booting a suspect drive.

  A. True

  B. False

  Correct Answer: A

• Question 46:

  The following keyword was typed in exactly as shown. Choose the answer(s) that would be found. All search criteria have default settings.

  A. [email protected]

  B. Tomorrow

  C. Tom

  D. Stomp

  Correct Answer: ABCD

• Question 47:

  You are an investigator and have encountered a computer that is running at the home of a suspect. The computer does not appear to be a part of a network. The operating system is Windows XP Home. No programs are visibly running. You should:

  A. Pull the plug from the back of the computer.

  B. Shut it down with the start menu.

  C. Pull the plug from the wall.

  D. Turn it off with the power button.

  Correct Answer: A

• Question 48:

  Save on the toolbar affects what file(s). Within EnCase, clicking on Within EnCase, clicking on saveon the toolbar affects what file(s)?

  A. All of the above

  B. The open case file

  C. The configuration .ini files

  D. The evidence files

  Correct Answer: B

• Question 49:

  You are assigned to assist with the search and seizure of several computers. The magistrate ordered that the computers cannot be seized unless they are found to contain any one of ten previously identified images. You currently have the ten images in JPG format. Using the EnCase methodology, how would you best handle this situation?

  A. Use FastBloc or a network/parallel port cable to acquire forensic images of the hard drives, then search the evidence files for the previously identified images.

  B. Use FastBloc or a network/parallel port cable to preview the hard drives. Go to the Gallery view and search for the previously identified images.

  C. Use FastBloc or a network/parallel port cable to preview the hard drives. Conduct a hash analysis of the files on the hard drives, using a hash library containing the hash values of the previously identified images.

  D. Use an EnCase DOS boot disk to conduct a text search for hild porn. Use an EnCase DOS boot disk to

  conduct a text search for child porn?

  Correct Answer: C

• Question 50:

  To generate an MD5 hash value for a file, EnCase: A. Computes the hash value based on the physical file.

  B. Computes the hash value including the physical file and filename.

  C. Computes the hash value including the logical file and filename.

  D. Computes the hash value based on the logical file.

  Correct Answer: D