Guidance Software GD0-100 Online Practice Questions and Exam Preparation

Guidance Software GD0-100 Online Questions & Answers

• Question 161:

  The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. Jan 1 st , 2?0?00

  A. Jan 1st , 1900
  B. Jan 1st , 2100
  C. Jan 1st , 2001
  D. Jan 1st , 2000
  D. Jan 1st , 2000

• Question 162:

  The following keyword was typed in exactly as shown. Choose the answer(s) that would result. All search criteria have default settings. Tom Jones

  A. tom jones
  B. Tom
  C. Jones
  D. Tom Jones
  A. tom jones
  D. Tom Jones

• Question 163:

  Select the appropriate name for the highlighted area of the binary numbers.

  A. Byte
  B. Dword
  C. Word
  D. Bit
  E. Nibble
  D. Bit

• Question 164:

  How does EnCase verify that the evidence file contains an exact copy of the suspect hard drive? How does EnCase verify that the evidence file contains an exact copy of the suspect's hard drive?

  A. By means of a CRC value of the suspect hard drive compared to a CRC value of the data stored in the evidence file.By means of a CRC value of the suspect? hard drive compared to a CRC value of the data stored in the evidence file.
  B. By means of an MD5 hash of the suspect hard drive compared to an MD5 hash of the data stored in the evidence file.By means of an MD5 hash of the suspect? hard drive compared to an MD5 hash of the data stored in the evidence file.
  C. By means of a CRC value of the evidence file itself.
  D. By means of an MD5 hash value of the evidence file itself.
  B. By means of an MD5 hash of the suspect hard drive compared to an MD5 hash of the data stored in the evidence file.By means of an MD5 hash of the suspect? hard drive compared to an MD5 hash of the data stored in the evidence file.

• Question 165:

  The EnCase evidence file is best described as:

  A. A clone of the source hard drive.
  B. A sector-by-sector copy of the source hard drive written to the corresponding sectors of the target hard drive.
  C. A bit stream image of the source hard drive written to a file, or several file segments.
  D. A bit stream image of the source hard drive written to the corresponding sectors of the target hard drive.
  C. A bit stream image of the source hard drive written to a file, or several file segments.

• Question 166:

  Which of the following statements is more accurate?

  A. The Recycle Bin increases the chance of locating the existence of a file on a computer.
  B. The Recycle Bin reduces the chance of locating the existence of a file on a computer.
  A. The Recycle Bin increases the chance of locating the existence of a file on a computer.

• Question 167:

  A SCSI drive is pinned as a master when it is:

  A. The only drive on the computer.
  B. The primary of two drives connected to one cable.
  C. Whenever another drive is on the same cable and is pinned as a slave.
  D. A SCSI drive is not pinned as a master.
  D. A SCSI drive is not pinned as a master.

• Question 168:

  Select the appropriate name for the highlighted area of the binary numbers.

  A. Byte
  B. Dword
  C. Bit
  D. Word
  E. Nibble
  E. Nibble

• Question 169:

  Assume that MyNote.txt was allocated to clusters 5, 9, and 11. Cluster 6, 7, and 8 belong to MyResume.doc. Both files have been deleted and the directory entry in the FAT file system for MyResume.doc has been overwritten. What clusters would EnCase use to undelete MyNote.txt?

  A. 5,9,11
  B. 5,6,7
  C. 7,8,9
  D. 6,7,8
  B. 5,6,7

• Question 170:

  When a drive letter is assigned to a logical volume, that information is temporarily written the volume boot record on the hard drive.

  A. True
  B. False
  B. False