Guidance Software GD0-100 Online Practice Questions and Exam Preparation

Guidance Software GD0-100 Online Questions & Answers

• Question 81:

  You are investigating a case of child pornography on a hard drive containing Windows XP. In the :\Documents and Settings\Bad You are investigating a case of child pornography on a hard drive containing Windows XP. In the C:\Documents

  and Settings\Bad Guy\Local Settings\Temporary Internet Files folder you find three images of child pornography. You find no other copies of the images on the suspect hard drive, and you find no other copies of the filenames.

  What can be deduced from your findings?

  A. The presence and location of the images is not strong evidence of possession.
  B. The presence and location of the images is strong evidence of possession.
  C. The presence and location of the images proves the images were intentionally downloaded.
  D. Both a and c
  A. The presence and location of the images is not strong evidence of possession.

• Question 82:

  You are conducting an investigation and have encountered a computer that is running in the field. The operating system is Windows XP. A software program is currently running and is visible on the screen. You should:

  A. Navigate through the program and see what the program is all about, then pull the plug.
  B. Pull the plug from the back of the computer.
  C. Photograph the screen and pull the plug from the back of the computer.
  D. Pull the plug from the wall.
  C. Photograph the screen and pull the plug from the back of the computer.

• Question 83:

  Which is the proper formula for determining the size in bytes of a hard drive that uses cylinders (C), heads (H), and sectors (S) geometry?

  A. C X H + S
  B. C X H X S + 512
  C. C X H X S X 512
  D. C X H X S
  C. C X H X S X 512

• Question 84:

  A hard drive was imaged using EnCase. The original drive was placed into evidence. The restore feature was used to make a copy of the original hard drive. EnCase verifies the restored copy using:

  A. An MD5 hash
  B. A 32 bit CRC
  C. Nothing. Restored volumes are not verified.
  D. A running log
  A. An MD5 hash

• Question 85:

  You are at an incident scene and determine that a computer contains evidence as described in the search warrant. When you seize the computer, you should:

  A. Record nothing to avoid inaccuracies that might jeopardize the use of the evidence.
  B. Record the location that the computer was recovered from.
  C. Record the identity of the person(s) involved in the seizure.
  D. Record the date and time the computer was seized.
  B. Record the location that the computer was recovered from.
  C. Record the identity of the person(s) involved in the seizure.
  D. Record the date and time the computer was seized.

• Question 86:

  What does the acronym BIOS stand for?

  A. Basic Integrated Operating System
  B. Basic Input/Output System
  C. Binary Input/Output System
  D. Binary Integrated Operating System
  B. Basic Input/Output System

• Question 87:

  When a file is deleted in the FAT file system, what happens to the FAT?

  A. The FAT entries for that file are marked as allocated.
  B. Nothing.
  C. It is deleted as well.
  D. The FAT entries for that file are marked as available.
  D. The FAT entries for that file are marked as available.

• Question 88:

  When can an evidence file containing a NTFS partition be logically restored to a FAT 32 partition?

  A. Never
  B. When the FAT 32 has the same number of sectors / clusters.
  C. When the FAT 32 is the same size or bigger.
  D. Both a and b
  A. Never

• Question 89:

  In hexadecimal notation, one byte is represented by _____ character(s).

  A. 2
  B. 1
  C. 8
  D. 4
  A. 2

• Question 90:

  The case file should be archived with the evidence files at the termination of a case.

  A. True
  B. False
  A. True