Guidance Software GD0-100 Online Practice Questions and Exam Preparation

Guidance Software GD0-100 Online Questions & Answers

• Question 141:

  Changing the filename of a file will change the hash value of the file.

  A. True
  B. False
  B. False

• Question 142:

  A sector on a hard drive contains how many bytes?

  A. 2048
  B. 4096
  C. 1024
  D. 512
  D. 512

• Question 143:

  Will EnCase allow a user to write data into an acquired evidence file

  A. Yes, but only bookmarks.
  B. Yes, but only to resize the partitions.
  C. No. Data cannot be added to the evidence file after the acquisition is made.
  D. Yes, but only case information.
  E. No, unless the user established a writing privilege when the evidence was acquired.
  C. No. Data cannot be added to the evidence file after the acquisition is made.

• Question 144:

  Search results are found in which of the following files? Select all that apply.

  A. The evidence file
  B. The configuration Searches.ini file
  C. The case file
  C. The case file

• Question 145:

  The first sector on a hard drive is called the:

  A. Master file table
  B. Master boot record
  C. Volume boot record
  D. Volume boot sector
  B. Master boot record

• Question 146:

  A hard drive has been formatted as NTFS and Windows XP was installed. The user used fdisk to remove all partitions from that drive. Nothing else was done. You have imaged the drive and have opened the evidence file with EnCase. What would be the best way to examine this hard drive?

  A. Use the add Partition feature to rebuild the partition and then examine the system. Use the add Partition feature to rebuild the partition and then examine the system.
  B. EnCase will not see a drive that has beenfdisked.
  C. Conduct a physical search of the hard drive and bookmark any evidence.
  D. Use the Recovered Deleted Partitions feature and then examine the system.
  A. Use the add Partition feature to rebuild the partition and then examine the system. Use the add Partition feature to rebuild the partition and then examine the system.

• Question 147:

  The signature table data is found in which of the following files?

  A. The evidence file
  B. The configuration FileSignatures.ini file
  C. All of the above
  D. The case file
  B. The configuration FileSignatures.ini file

• Question 148:

  A file extension and signature can be manually added by:

  A. Using the new library feature under hash libraries.
  B. Right-clicking on a file and selecting dd.?
  C. Using the new set feature under hash sets.
  D. Using the new file signature feature under file signatures.
  D. Using the new file signature feature under file signatures.

• Question 149:

  Which of the following aspects of the EnCase evidence file can be changed during a reacquire of the evidence file

  A. The evidence number
  B. None of the above
  C. The acquisition notes
  D. The investigator name
  B. None of the above

• Question 150:

  Which of the following selections would be used to keep track of a fragmented file in the FAT file system?

  A. The directory entry for the fragmented file
  B. The partition table of extents
  C. The File Allocation Table
  D. All of the above
  C. The File Allocation Table