Guidance Software GD0-100 Exam Questions Free Practice Test

Viewing page 3 out of 6 pages

Viewing questions 21-30 out of questions

Questions # 21:

How does EnCase verify that the case information (Case Number, Evidence Number, Investigator Name, etc) in an evidence file has not been damaged or changed, after the evidence file has been written?

Options:

EnCase writes a CRC value of the case information and verifies the CRC value when the evidence is added to a case.

EnCase does not verify the case information and case information can be changed by the user as it becomes necessary.

The .case file writes a CRC value for the case information and verifies it when the case is opened.

EnCase writes an MD5 hash value for the entire evidence file, which includes the case information, and verifies the MD5 hash when the evidence is added to a case.

Expert Solution

Questions # 22:

In hexadecimal notation, one byte is represented by _____ character(s).

Options:

Expert Solution

Questions # 23:

When a file is deleted in the FAT file system, what happens to the FAT?

Options:

The FAT entries for that file are marked as allocated.

Nothing.

It is deleted as well.

The FAT entries for that file are marked as available.

Expert Solution

Questions # 24:

GREP terms are automatically recognized as GREP by EnCase.

Options:

True

False

Expert Solution

Questions # 25:

The acronym ASCII stands for:

Options:

American Standard Communication Information Index

American Standard Code for Information Interchange

Accepted Standard Code for Information Interchange

Accepted Standard Communication Information Index

Expert Solution

Questions # 26:

A logical file would be best described as:

Options:

The data taken from the starting cluster to the end of the last cluster that is occupied by the file.

A file including any RAM and disk slack.

A file including only RAM slack.

The data from the beginning of the starting cluster to the length of the file.

Expert Solution

Questions # 27:

By default, EnCase will display the data from the end of a logical file, to the end of the cluster, in what color:

Options:

Red

Red on black

Black on red

Black

Expert Solution

Questions # 28:

How does EnCase verify that the case information (Case Number, Evidence Number, Investigator Name, etc) in an evidence file has not been damaged or changed, after the evidence file has been written?

Options:

a search of the physical disk in unallocated clusters and other unused disk areas

a search of the logical files

both a and b

None of the above

Expert Solution

Questions # 29:

The first sector on a hard drive is called the:

Options:

Master file table

Master boot record

Volume boot record

Volume boot sector

Expert Solution

Questions # 30:

Pressing the power button on a computer that is running could have which of the following results?

Options:

The computer will instantly shut off.

The computer will go into stand-by mode.

Nothing will happen.

All of the above could happen.

The operating system will shut down normally.

Expert Solution

Viewing page 3 out of 6 pages

Viewing questions 21-30 out of questions

Pass the Guidance Software EnCE GD0-100 Questions and answers with CertsForce