Guidance Software GD0-100 Online Practice Questions and Exam Preparation

Guidance Software GD0-100 Online Questions & Answers

• Question 51:

  The maximum file segment size for an EnCase evidence file is:

  A. 1500 MB
  B. 1000 MB
  C. 2000 MB
  D. There is no limit.
  E. 500 MB
  C. 2000 MB

• Question 52:

  Within EnCase, you highlight a range of data within a file. The length indicator displays the value 30. How many bytes have you actually selected?

  A. 30
  B. 3
  C. 60
  D. 15
  A. 30

• Question 53:

  To later verify the contents of an evidence file 7RODWHUYHULI\WKHFRQWHQWVRIDQHYLGHQFHILOH

  A. EnCase writes a CRC value for every 64 sectors copied.
  B. EnCase writes a CRC value for every 128 sectors copied.
  C. EnCase writes an MD5 hash value every 64 sectors copied.
  D. EnCase writes an MD5 hash value for every 32 sectors copied.
  A. EnCase writes a CRC value for every 64 sectors copied.

• Question 54:

  If a hash analysis is run on a case, EnCase:

  A. Will compute a hash value of the evidence file and begin a verification process.
  B. Will generate a hash set for every file in the case.
  C. Will compare the hash value of the files in the case to the hash library.
  D. Will create a hash set to the user specifications. Will create a hash set to the user?specifications.
  C. Will compare the hash value of the files in the case to the hash library.

• Question 55:

  In DOS and Windows, how many bytes are in one FAT directory entry?

  A. Variable
  B. 32
  C. 16
  D. 64
  E. 8
  B. 32

• Question 56:

  EnCase is able to read and examine which of the following file systems?

  A. NTFS
  B. EXT3
  C. FAT
  D. HFS
  A. NTFS
  B. EXT3
  C. FAT
  D. HFS

• Question 57:

  An evidence file was archived onto five CD-Rom disks with the third file segment on disk number three. Can the contents of the third file segment be verified by itself while still on the CD?

  A. No. Archived files are compressed and cannot be verified until un-archived.
  B. No. All file segments must be put back together.
  C. Yes. Any segment of an evidence file can be verified through re-computing and comparing the CRCs, even if it is on a CD.
  D. No. EnCase cannot verify files on CDs.
  C. Yes. Any segment of an evidence file can be verified through re-computing and comparing the CRCs, even if it is on a CD.

• Question 58:

  In Windows 2000 and XP, which of the following directories contain user personal folders?

  A. C:\Personnel Folders
  B. C:\WINNT\Profiles
  C. C:\Windows\Users
  D. C:\Documents and Settings
  D. C:\Documents and Settings

• Question 59:

  EnCase can build a hash set of a selected group of files.

  A. True
  B. False
  A. True

• Question 60:

  A signature analysis has been run on a case. The result "Bad Signature " means:

  A. The file signature is known and does not match a known file header.
  B. The file signature is known and the file extension is known.
  C. The file signature is known and does not match a known file extension.
  D. The file signature is unknown and the file extension is known.
  D. The file signature is unknown and the file extension is known.