Guidance Software Certification Exam for EnCE Outside North America - GD0-110 Exam Practice Test
CORRECT TEXT
Changing the filename of a file will change the hash value of the file.
Changing the filename of a file will change the hash value of the file.
Correct Answer: B
Vote an answer
The end of a logical file to the end of the cluster that the file ends in is called:
Correct Answer: C
Vote an answer
Using good forensic practices, when seizing a computer at a business running Windows 2000 Server you should:
Correct Answer: A
Vote an answer
A hard drive was imaged using EnCase. The original drive was placed into evidence. The restore feature was used to make a copy of the original hard drive. EnCase verifies the restored copy using:
Correct Answer: D
Vote an answer
If cases are worked on a lab drive in a secure room, without any cleaning of the contents of the drive, which of the following areas would be of most concern?
Correct Answer: C
Vote an answer
The FAT in the File Allocation Table file system keeps track of:
Correct Answer: A
Vote an answer
CORRECT TEXT
A standard Windows 98 boot disk is acceptable for booting a suspect drive.
A standard Windows 98 boot disk is acceptable for booting a suspect drive.
Correct Answer: B
Vote an answer
The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. [\x00-\x05]\x00\x00\x00? >?[?[@?[?[?[
Correct Answer: A
Vote an answer