1. Home
  2. Guidance Software
  3. EnCE
  4. GD0-110
  5. Certification Exam for EnCE Outside North America Questions and Answers

Pass the Guidance Software EnCE GD0-110 Questions and answers with CertsForce

 Guidance Software Exams      Go to Exam Detail      Get Premium Access
Viewing page 2 out of 6 pages
Viewing questions 11-20 out of questions
Questions # 11:

You are investigating a case of child pornography on a hard drive containing Windows XP. In the C:\Documents and Settings\Bad Guy\Local Settings\Temporary Internet Files folder you find three images of child pornography. You find no other copies of the images on the suspect hard drive, and you find no other copies of the filenames. What can be deduced from your findings?

Options:
A.

The presence and location of the images is strong evidence of possession.

B.

The presence and location of the images is not strong evidence of possession.

C.

The presence and location of the images proves the images were intentionally downloaded.

D.

Both a and c

Expert Solution
Questions # 12:

The temporary folder of a case cannot be changed once it has been set.

Options:
A.

True

B.

False

Expert Solution
Questions # 13:

A CPU is:

Options:
A.

An entire computer box, not including the monitor and other attached peripheral devices.

B.

A motherboard with all required devices connected.

C.

A Central Programming Unit.

D.

A chip that would be considered the brain of a computer, which is installed on a motherboard.

Expert Solution
Questions # 14:

To generate an MD5 hash value for a file, EnCase:

Options:
A.

Computes the hash value based on the logical file.

B.

Computes the hash value based on the physical file.

C.

Computes the hash value including the logical file and filename.

D.

Computes the hash value including the physical file and filename.

Expert Solution
Questions # 15:

A hash set would most accurately be described as:

Options:
A.

A group of hash libraries organized by category.

B.

A table of file headers and extensions.

C.

A group of hash values that can be added to the hash library.

D.

Both a and b.

Expert Solution
Questions # 16:

You are an investigator and have encountered a computer that is running at the home of a suspect. The computer does not appear to be a part of a network. The operating system is Windows XP Home. No programs are visibly running. You should:

Options:
A.

Shut it down with the start menu.

B.

Pull the plug from the wall.

C.

Turn it off with the power button.

D.

Pull the plug from the back of the computer.

Expert Solution
Questions # 17:

The first sector on a volume is called the:

Options:
A.

Volume boot device

B.

Master boot record

C.

Master file table

D.

Volume boot sector or record

Expert Solution
Questions # 18:

A hard drive has 8 sectors per cluster. File Mystuff.doc has a logical file size of 13,000 bytes. How many clusters will be used by Mystuff.doc?

Options:
A.

1

B.

2

C.

3

D.

4

Expert Solution
Questions # 19:

An Enhanced Metafile would best be described as:

Options:
A.

A file format used in the printing process by Windows.

B.

A compound e-mail attachment.

C.

A compressed zip file.

D.

A graphics file attached to an e-mail message.

Expert Solution
Questions # 20:

Which of the following directories contain the information that is found on a Windows 98 Desktop?

Options:
A.

C:\Windows\Desktop

B.

C:\Desktop

C.

C:\Program files\Programs\Desktop

D.

C:\Startup\Desktop\Items

Expert Solution
Viewing page 2 out of 6 pages
Viewing questions 11-20 out of questions