Guidance Software GD0-100 Online Practice Questions and Exam Preparation

Guidance Software GD0-100 Online Questions & Answers

• Question 121:

  A suspect typed a file on his computer and saved it to a floppy diskette. The filename was MyNote.txt. You receive the floppy and the suspect computer. The suspect denies that the floppy disk belongs to him. You search the suspect computer and locate only the suspect? computer. The suspect denies that the floppy disk belongs to him. You search the suspect? computer and locate only the filename within a .LNK file. The .LNK file is located in the folder C:\Windows \Recent. How you would use the .LNK file to establish a connection between the file on the floppy diskette and the suspect computer? connection between the file on the floppy diskette and the suspect? computer?

  A. Both a and b
  B. The dates and time of the file found in the .LNK file, at file offset 28
  C. The full path of the file, found in the .LNK file
  D. The file signature found in the .LNK file
  A. Both a and b

• Question 122:

  In the EnCase environment, the term xternal viewers?is best described as: In the EnCase environment, the term ?xternal viewers?is best described as:

  A. Programs that are exported out of an evidence file.
  B. Any program that will work with EnCase.
  C. Any program that is loaded on the lab hard drive.
  D. Programsthat are associated with EnCase to open specific file types.
  D. Programsthat are associated with EnCase to open specific file types.

• Question 123:

  The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result.[\x00- \x05]\x00\x00?andgt;[?[@?[?[?[

  A. FF 0000 00 00 FF BA
  B. 0000 00 01 FF FF BA
  C. 04 06 0000 00 FF FF BA
  D. 04 0000 00 FF FF BA
  D. 04 0000 00 FF FF BA

• Question 124:

  The FAT in the File Allocation Table file system keeps track of:

  A. All of the above.
  B. File fragmentation
  C. Clusters marked as bad
  D. Every addressable cluster on the partition
  A. All of the above.

• Question 125:

  The EnCase methodology dictates that ________ be created prior to acquiring evidence.

  A. a unique directory on the lab drive for case management
  B. a text file for notes
  C. All of the above
  D. an .E01 file on the lab drive
  A. a unique directory on the lab drive for case management

• Question 126:

  The BIOS chip on an IBM clone computer is most commonly located on:

  A. The RAM chip
  B. The controller card
  C. The motherboard
  D. The microprocessor
  C. The motherboard

• Question 127:

  You are assigned to assist with the search and seizure of several computers. The magistrate ordered that the computers cannot be seized unless they are found to contain any one of ten previously identified images. You currently have the ten images in JPG format. Using the EnCase methodology, how would you best handle this situation?

  A. UseFastBloc or a network/parallel port cable to preview the hard drives. Go to the Gallery view and search for the previously identified images.
  B. UseFastBloc or a network/parallel port cable to acquire forensic images of the hard drives, then search the evidence files for the previously identified images.
  C. UseFastBloc or a network/parallel port cable to preview the hard drives. Conduct a hash analysis of the files on the hard drives, using a hash library containing the hash values of the previously identified images.
  D. Use an EnCase DOS boot disk to conduct a text search for child porn. Use an EnCase DOS boot disk to conduct a text search for child porn?
  C. UseFastBloc or a network/parallel port cable to preview the hard drives. Conduct a hash analysis of the files on the hard drives, using a hash library containing the hash values of the previously identified images.

• Question 128:

  When Unicode is selected for a search keyword, EnCase:

  A. None of the above.
  B. Will find the keyword if it is either Unicode or ASCII.
  C. Unicode is not a search option for EnCase.
  D. Will only find the keyword if it is Unicode.
  B. Will find the keyword if it is either Unicode or ASCII.

• Question 129:

  The Windows 98 Start Menu has a selection called documents which displays a list of recently used files. Which of the following The Windows 98 Start Menu has a selection called documents which displays a list of recently used files. Which of the following folders contain those files?

  A. C:\Windows\History
  B. C:\Windows\Start menu\Documents
  C. C:\Windows\Documents
  D. C:\Windows\Recent
  D. C:\Windows\Recent

• Question 130:

  To generate an MD5 hash value for a file, EnCase:

  A. Computes the hash value including the logical file and filename.
  B. Computes the hash value including the physical file and filename.
  C. Computes the hash value based on the logical file.
  D. Computes the hash value based on the physical file.
  C. Computes the hash value based on the logical file.