Guidance Software GD0-100 Online Practice Questions and Exam Preparation

Guidance Software GD0-100 Online Questions & Answers

• Question 71:

  When undeleting a file in the FAT file system, EnCase will check the _____________ to see if it has already been overwritten.

  A. data on the hard drive
  B. deletion table
  C. directory entry
  D. FAT
  D. FAT

• Question 72:

  In Windows 98 and ME, Internet based e-mail, such as Hotmail, will most likely be recovered in the _____________________ folder.

  A. C:\Windows\Online\Applications\email
  B. C:\Windows\Temporary Internet files
  C. C:\Windows\History\Email
  D. C:\Windows\Temp
  B. C:\Windows\Temporary Internet files

• Question 73:

  Assume that an evidence file is added to a case, the case is saved, and the case is closed. What happens if the evidence file is moved, and the case is then opened?

  A. EnCase reports that the file integrity has been compromised and renders the file useless. EnCase reports that the file integrity has been compromised and renders the file useless.
  B. EnCase opens the case, excluding the moved evidence.
  C. EnCase asks for the location of the evidence file the next time the case is opened.
  D. EnCase reports a different hash value for the evidence file.
  C. EnCase asks for the location of the evidence file the next time the case is opened.

• Question 74:

  RAM is tested during which phase of the power-up sequence?

  A. Pre-POST
  B. After POST
  C. During POST
  D. None of the above.
  C. During POST

• Question 75:

  The term signature and reader as they relate to a signature analysis are

  A. None of the above
  B. The signature is the file extension. The header is a standard pattern normally found at the beginning of a file.
  C. Synonymous.
  D. Areas compared with each other to verify the correct file type.
  C. Synonymous.

• Question 76:

  A physical file size is:

  A. The total size in sectors of an allocated file.
  B. The total size of all the clusters used by the file measured in bytes.
  C. The total size in bytes of a logical file.
  D. The total size of the file including the ram slack in bytes.
  B. The total size of all the clusters used by the file measured in bytes.

• Question 77:

  Creating an image of a hard drive that was seized as evidence:

  A. May be done by anyone because it is a relatively simple procedure.
  B. May only be done by trained personnel because the process has the potential to alter the original evidence.
  C. May only be done by computer scientists.
  D. Should be done by the user, as they are most familiar with the hard drive.
  B. May only be done by trained personnel because the process has the potential to alter the original evidence.

• Question 78:

  During the power-up sequence, which of the following happens first?

  A. The boot sector is located on the hard drive.
  B. Theower On Self-Test.? 7KH ? RZHU2Q6HOI7HVW
  C. The floppy drive is checked for a diskette.
  D. The BIOS on an add-in card is executed.
  B. Theower On Self-Test.? 7KH ? RZHU2Q6HOI7HVW

• Question 79:

  A personal data assistant was placed in a evidence locker until an examiner has time to examine it. Which of the following areas would require special attention?

  A. Chain-of-custody
  B. Storage
  C. There is no concern
  D. Cross-contamination
  B. Storage

• Question 80:

  Select the appropriate name for the highlighted area of the binary numbers.

  A. Bit
  B. Nibble
  C. Word
  D. Dword
  E. Byte
  C. Word