Guidance Software GD0-100 Online Practice Questions and Exam Preparation

Guidance Software GD0-100 Online Questions & Answers

• Question 1:

  In the FAT file system, the size of a deleted file can be found:

  A. In the FAT
  B. In the directory entry
  C. In the file footer
  D. In the file header
  B. In the directory entry

• Question 2:

  A standard DOS 6.22 boot disk is acceptable for booting a suspect drive.

  A. True
  B. False
  B. False

• Question 3:

  Within EnCase, clicking on Save on the toolbar affects what file(s)?

  A. All of the above
  B. The evidence files
  C. The open case file
  D. The configuration .ini files
  C. The open case file

• Question 4:

  The spool files that are created during a print job are __________ after the print job is completed.

  A. moved
  B. wiped
  C. deleted and wiped
  D. deleted
  D. deleted

• Question 5:

  Select the appropriate name for the highlighted area of the binary numbers.

  A. Bit
  B. Nibble
  C. Word
  D. Dword
  E. Byte
  C. Word

• Question 6:

  RAM is an acronym for:

  A. Random Addressable Memory
  B. Relative Addressable Memory
  C. Random Access Memory
  D. Relative Address Memory
  C. Random Access Memory

• Question 7:

  A FAT directory has as a logical size of:

  A. 0 bytes
  B. One cluster
  C. 128 bytes
  D. 64 bytes
  A. 0 bytes

• Question 8:

  How many clusters can a FAT 16 system address?

  A. 65,536
  B. 4,096
  C. 268,435,456
  D. 4,294,967,296
  A. 65,536

• Question 9:

  What information should be obtained from the BIOS during computer forensic investigations?

  A. The video caching information
  B. The date and time
  C. The port assigned to the serial port
  D. The boot sequence
  B. The date and time
  D. The boot sequence

• Question 10:

  EnCase uses the _________________ to conduct a signature analysis.

  A. Both a and b
  B. file signature table
  C. hash library
  D. file Viewers
  B. file signature table