Guidance Software GD0-100 Online Practice Questions and Exam Preparation

Guidance Software GD0-100 Online Questions & Answers

• Question 41:

  You are working in a computer forensic lab. A law enforcement investigator brings you a computer and a valid search warrant. You have legal authority to search the computer. The investigator hands you a piece of paper that has three printed checks on it. All three checks have the same check and account number. You image the suspect computer and open the evidence file with EnCase. You checks have the same check and account number. You image the suspect's computer and open the evidence file with EnCase. You perform a text search for the account number and check number. Nothing returns on the search results. You perform a text search for all other information found on the printed checks and there is still nothing returned in the search results. You run a signature analysis and check the gallery. You cannot locate any graphical copies of the printed checks in the gallery. At this point, is it safe to say that the checks are not located on the suspect computer?

  A. No. The images could be located a compressed file.
  B. No. The images could be embedded in a document.
  C. No. The images could be in unallocated clusters.
  D. No. The images could be in an image format not viewable inside EnCase.
  E. All of the above.
  E. All of the above.

• Question 42:

  Two allocated files can occupy one cluster, as long as they can both fit within the allotted number of bytes.

  A. True
  B. False
  B. False

• Question 43:

  Calls to the C:\ volume of the hard drive are not made by DOS when a computer is booted with a standard DOS 6.22 boot disk.

  A. False
  B. True
  A. False

• Question 44:

  The results of a hash analysis on an evidence file that has been added to a case will be stored in which of the following files?

  A. The evidence file
  B. All of the above
  C. The case file
  D. The configuration HashAnalysis.ini file
  C. The case file

• Question 45:

  If cluster #3552 entry in the FAT table contains a value of ?? this would mean:

  A. The cluster is unallocated
  B. The cluster is the end of a file
  C. The cluster is allocated
  D. The cluster is marked bad
  A. The cluster is unallocated

• Question 46:

  You are an investigator and have encountered a computer that is running at the home of a suspect. The computer does not appear to be a part of a network. The operating system is Windows XP Home. No programs are visibly running. You should:

  A. Pull the plug from the back of the computer.
  B. Turn it off with the power button.
  C. Pull the plug from the wall.
  D. Shut it down with the start menu.
  A. Pull the plug from the back of the computer.

• Question 47:

  Searches and bookmarks are stored in the evidence file.

  A. False
  B. True
  A. False

• Question 48:

  The EnCase methodology dictates that the lab drive for evidence have a __________ prior to making an image.

  A. FAT 16 partition
  B. NTFS partition
  C. unique volume label
  D. bare, unused partition
  C. unique volume label

• Question 49:

  The end of a logical file to the end of the cluster that the file ends in is called:

  A. Allocated space
  B. Slack
  C. Unallocated space
  D. Available space
  B. Slack

• Question 50:

  Select the appropriate name for the highlighted area of the binary numbers.

  A. Word
  B. Dword
  C. Byte
  D. Nibble
  E. Bit
  B. Dword