Guidance Software GD0-100 Online Practice Questions and Exam Preparation

Guidance Software GD0-100 Online Questions & Answers

• Question 11:

  What files are reconfigured or deleted by EnCase during the creation of an EnCase boot disk?

  A. command.com
  B. autoexec.bat
  C. drvspace.bin
  D. io.sys
  A. command.com
  C. drvspace.bin
  D. io.sys

• Question 12:

  How many partitions can be found in the boot partition table found at the beginning of the drive?

  A. 8
  B. 4
  C. 6
  D. 2
  B. 4

• Question 13:

  The default export folder remains the same for all cases.

  A. True
  B. False
  B. False

• Question 14:

  4 bits allows what number of possibilities?

  A. 16
  B. 4
  C. 2
  D. 8
  A. 16

• Question 15:

  If a floppy diskette is in the ?drive, the computer will always boot to that drive before any other device. If a floppy diskette is in the drive, the computer will always boot to that drive before any other device.

  A. False
  B. True
  A. False

• Question 16:

  Using good forensic practices, when seizing a computer at a business running Windows 2000 Server you should:

  A. Pull the plug from the back of the computer.
  B. Press the power button and hold it in.
  C. Shut it down normally.
  D. Pull the plug from the wall.
  C. Shut it down normally.

• Question 17:

  The following keyword was typed in exactly as shown. Choose the answer(s) that would be found. All search criteria have default settings. Tom A. Tomorrow

  B. [email protected]
  C. Tom
  D. Stomp
  B. [email protected]
  C. Tom
  D. Stomp

• Question 18:

  This question addresses the EnCase for Windows search process. If a target word is located in the unallocated space, and the word is fragmented between clusters 10 and 15, the search:

  A. Will not find it because the letters of the keyword are not contiguous.
  B. Will not find it because EnCase performs a physical search only.
  C. Will find it because EnCase performs a logical search.
  D. Will not find it unlessile slack?is checked on the search dialog box. Will not find it unless ?ile slack?is checked on the search dialog box.
  A. Will not find it because the letters of the keyword are not contiguous.

• Question 19:

  All investigators using EnCase should run tests on the evidence file acquisition and verification process to:

  A. Insure that the investigator is using the proper method of acquisition.
  B. All of the above.
  C. Further the investigator understanding of the evidence file. Further the investigator?understanding of the evidence file.
  D. Give more weight to the investigator testimony in court. Give more weight to the investigator?testimony in court.
  B. All of the above.

• Question 20:

  By default, what color does EnCase use for slack?

  A. Black on red
  B. Red on black
  C. Red
  D. Black
  C. Red