Guidance Software GD0-100 Online Practice Questions and Exam Preparation

Guidance Software GD0-100 Online Questions & Answers

• Question 131:

  Temp files created by EnCase are deleted when EnCase is properly closed.

  A. True
  B. False
  A. True

• Question 132:

  The following keyword was typed in exactly as shown. Choose the answer(s) that would result. All search criteria have default settings. Speed and Meth

  A. Meth
  B. Meth Speed
  C. Speed andMeth
  D. Speed
  C. Speed andMeth

• Question 133:

  A hash set would most accurately be described as:

  A. A group of hash libraries organized by category.
  B. A group of hash values that can be added to the hash library.
  C. A table of file headers and extensions.
  D. Botha and b.
  B. A group of hash values that can be added to the hash library.

• Question 134:

  When does the POST operation occur?

  A. When SCSI devices are configured.
  B. When Windows starts up.
  C. After a computer begins to boot from a device.
  D. When the power button to a computer is turnedon.
  D. When the power button to a computer is turnedon.

• Question 135:

  By default, what color does EnCase use for the contents of a logical file

  A. Red
  B. Red on black
  C. Black
  D. Black on red
  C. Black

• Question 136:

  If cluster number 10 in the FAT contains the number 55, this means:

  A. That cluster 10 is used and the file continues in cluster number 55.
  B. That the file starts in cluster number 55 and continues to cluster number 10.
  C. That there is a cross-linked file.
  D. The cluster number 55 is the end of an allocated file.
  A. That cluster 10 is used and the file continues in cluster number 55.

• Question 137:

  The acronym ASCII stands for:

  A. American Standard Communication Information Index
  B. American Standard Code for Information Interchange
  C. Accepted Standard Code for Information Interchange
  D. Accepted Standard Communication Information Index
  B. American Standard Code for Information Interchange

• Question 138:

  A signature analysis has been run on a case. The result ?*JPEG ?in the signature column means:

  A. The file signature is unknown and the header is a JPEG.
  B. The file signature is a JPEG signature and the file extension is incorrect.
  C. The file signature is unknown and the file extension is JPEG.
  D. None of the above.
  B. The file signature is a JPEG signature and the file extension is incorrect.

• Question 139:

  When a file is deleted in the FAT or NTFS file systems, what happens to the data on the hard drive?

  A. Nothing.
  B. It is moved to a special area.
  C. It is overwritten with zeroes.
  D. The file header is marked with a Sigma so the file is not recognized by the operating system.
  A. Nothing.

• Question 140:

  How does EnCase verify that the case information (Case Number, Evidence Number, Investigator Name, etc) in an evidence file has not been damaged or changed, after the evidence file has been written?

  A. EnCase writes a CRC value of the case information and verifies the CRC value when the evidence is added to a case.
  B. EnCase does not verify the case information and case information can be changed by the user as it becomes necessary.
  C. The .case file writes a CRC value for the case information and verifies it when the case is opened.
  D. EnCase writes an MD5 hash value for the entire evidence file, which includes the case information, and verifies the MD5 hash when the evidence is added to a case.
  A. EnCase writes a CRC value of the case information and verifies the CRC value when the evidence is added to a case.