GD0-100 by Guidance Software Actual Free Exam Q&As

Question 1

When an EnCase user double-clicks on a file within EnCase what determines the action that will result? Select all that apply

A. The settings in the case file. B. The setting in the evidence file. C. The settings in the FileTypes.ini file.

Discussion 0

Correct Answer: C Vote an answer

Question 2

Within EnCase, what is purpose of the default export folder?

A. This is the folder used to hold copies of files that are sent to external viewers. B. This is the folder that will be automatically selected when the copy/unerase feature is used. C. This is the folder that will automatically store an evidence file when the acquisition is made in DOS. D. This is the folder that temporarily stores all bookmark and search results.

Discussion 0

Correct Answer: B Vote an answer

Question 3

The term signature and reader as they relate to a signature analysis are

A. None of the above B. Synonymous. C. Areas compared with each other to verify the correct file type. D. The signature is the file extension. The header is a standard pattern normally found at the beginning of a file.

Discussion 0

Correct Answer: B Vote an answer

Question 4

Select the appropriate name for the highlighted area of the binary numbers.

A. Word B. Dword C. Nibble D. Byte E. Bit

Discussion 0

Correct Answer: B Vote an answer

Question 5

Using good forensic practices, when seizing a computer at a business running Windows 2000 Server you should

A. Shut it down normally. B. Pull the plug from the wall. C. Press the power button and hold it in. D. Pull the plug from the back of the computer.

Discussion 0

Correct Answer: A Vote an answer

Question 6

When a file is deleted in the FAT file system, what happens to the filename?

A. The first character of the directory entry is marked with a hex E5. B. The first character of the directory entry is marked with a hex 00. C. It is wiped from the directory. D. It is zeroed out.

Discussion 0

Correct Answer: A Vote an answer

Question 7

The EnCase default export folder is

A. A case-specific setting that can be changed. B. A global setting that can be changed. C. A global setting that cannot be changed. D. A case-specific setting that cannot be changed.

Discussion 0

Correct Answer: A Vote an answer

Question 8

This question addresses the EnCase for Windows search process. If a target word is located in the unallocated space, and the word is fragmented between clusters 10 and 15, the search

A. Will not find it unlessile slack?is checked on the search dialog box. Will not find it unless ?ile slack?is checked on the search dialog box. B. Will not find it because the letters of the keyword are not contiguous. C. Will not find it because EnCase performs a physical search only. D. Will find it because EnCase performs a logical search.

Discussion 0

Correct Answer: B Vote an answer

Question 9

If cluster number 10 in the FAT contains the number 55, this means

A. That cluster 10 is used and the file continues in cluster number 55. B. The cluster number 55 is the end of an allocated file. C. That the file starts in cluster number 55 and continues to cluster number 10. D. That there is a cross-linked file.

Discussion 0

Correct Answer: A Vote an answer

Guidance Software Certification Exam For ENCE North America - GD0-100 Exam Practice Test