Guidance Software GD0-100 Online Practice Questions and Exam Preparation

Guidance Software GD0-100 Online Questions & Answers

• Question 91:

  In DOS acquisition mode, if a physical drive is detected, but no partition information is displayed, what would be the cause:

  A. Both a and b
  B. The partition scheme is not recognized by DOS.
  C. Neither a or b
  D. There are no partitions present.
  A. Both a and b

• Question 92:

  You are examining a hard drive that has Windows XP installed as the operating system. You see a file that has a date and time in the deleted column. Where does that date and time come from?

  A. Directory Entry
  B. Master File Table
  C. Info2 file
  D. Inode Table
  C. Info2 file

• Question 93:

  The case number in an evidence file can be changed without causing the verification feature to report an error, if:

  A. The user utilizes a text editor.
  B. The case information cannot be changed in an evidence file, without causing the verification feature to report an error.
  C. The user utilizes the case information editor within EnCase.
  D. The evidence file is reacquired.
  B. The case information cannot be changed in an evidence file, without causing the verification feature to report an error.

• Question 94:

  If an evidence file has been added to a case and completely verified, what happens if the data area within the evidence file is later changed?

  A. EnCase will allow the examiner to continue to access the rest of the evidence file that has not been changed.
  B. EnCase detect the error if the evidence file is manually re-verified.
  C. EnCase will detect the error when that area of the evidence file is accessed by the user.
  D. All of the above.
  D. All of the above.

• Question 95:

  When a non-compressed evidence file is reacquired with compression, the acquisition and verification hash values for the evidence will remain the same for both files.

  A. True
  B. False
  A. True

• Question 96:

  Within EnCase, what is purpose of the default export folder?

  A. This is the folder that will be automatically selected when the copy/unerase feature is used.
  B. This is the folder that will automatically store an evidence file when the acquisition is made in DOS.
  C. This is the folder that temporarily stores all bookmark and search results.
  D. This is the folder used to hold copies of files that are sent to external viewers.
  A. This is the folder that will be automatically selected when the copy/unerase feature is used.

• Question 97:

  What information in a FAT file system directory entry refers to the location of a file on the hard drive?

  A. The file size
  B. The file attributes
  C. The starting cluster
  D. The fragmentation settings
  C. The starting cluster

• Question 98:

  The temporary folder of a case cannot be changed once it has been set.

  A. False
  B. True
  A. False

• Question 99:

  The MD5 hash algorithm produces a _____ number.

  A. 32 bit
  B. 256 bit
  C. 64 bit
  D. 128 bit
  D. 128 bit

• Question 100:

  The EnCase default export folder is:

  A. A case-specific setting that cannot be changed.
  B. A case-specific setting that can be changed.
  C. A global setting that can be changed.
  D. A global setting that cannot be changed.
  B. A case-specific setting that can be changed.