Guidance Software GD0-100 Online Practice Questions and Exam Preparation

Guidance Software GD0-100 Online Questions & Answers

• Question 111:

  Search terms are stored in what .ini configuration file

  A. FileSignatures.ini
  B. Keywords.ini
  C. TextStyle.ini
  D. FileTypes.ini
  B. Keywords.ini

• Question 112:

  An Enhanced Metafile would best be described as:

  A. A compressed zip file.
  B. A graphics file attached to an e-mail message.
  C. A compound e-mail attachment.
  D. A file format used in the printing process by Windows.
  D. A file format used in the printing process by Windows.

• Question 113:

  GREP terms are automatically recognized as GREP by EnCase.

  A. True
  B. False
  B. False

• Question 114:

  Bookmarks are stored in which of the following files?

  A. The case file
  B. The evidence file
  C. The configuration Bookmarks.ini file
  D. All of the above
  A. The case file

• Question 115:

  EnCase can make an image of a USB flash drive.

  A. False
  B. True
  B. True

• Question 116:

  In the FAT file system, the size of a deleted file can be found:

  A. In the FAT
  B. In the directory entry
  C. In the file footer
  D. In the file header
  B. In the directory entry

• Question 117:

  A hash library would most accurately be described as:

  A. A master table of file headers and extensions.
  B. A file containing hash values from one or more selected hash sets.
  C. Botha and b.
  D. A list of the all the MD5 hash values used to verify the evidence files.
  B. A file containing hash values from one or more selected hash sets.

• Question 118:

  The BIOS chip on an IBM clone computer is most commonly located on:

  A. The RAM chip
  B. The controller card
  C. The motherboard
  D. The microprocessor
  C. The motherboard

• Question 119:

  If cluster #3552 entry in the FAT table contains a value of ?? this would mean:

  A. The cluster is unallocated
  B. The cluster is the end of a file
  C. The cluster is allocated
  D. The cluster is marked bad
  A. The cluster is unallocated

• Question 120:

  Within EnCase for Windows, the search process is:

  A. None of the above
  B. both a and b
  C. a search of the physical disk in unallocated clusters and other unused disk areas
  D. a search of the logical files
  B. both a and b