New Year Sale Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: xmas50

Guidance Software GD0-100 - Certification Exam For ENCE North America

Guidance Software GD0-100 Premium Access     Download Demo    
Page: 4 / 6
Total 176 questions

Within EnCase for Windows, the search process is:

A.

a search of the physical disk in unallocated clusters and other unused disk areas

B.

a search of the logical files

C.

None of the above

D.

both a and b

A signature analysis has been run on a case. The result "Bad Signature " means:

A.

The file signature is known and does not match a known file header.

B.

The file signature is known and the file extension is known.

C.

The file signature is known and does not match a known file extension.

D.

The file signature is unknown and the file extension is known.

The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. [^a-z] Tom[^a-z]

A.

Tomato

B.

om? ? RP

C.

Toms

D.

Stomp

A case file can contain ____ hard drive images?

A.

5

B.

1

C.

any number of

D.

10

You are conducting an investigation and have encountered a computer that is running in the field. The operating system is Windows XP. A software program is currently running and is visible on the screen. You should:

A.

Navigate through the program and see what the program is all about, then pull the plug.

B.

Pull the plug from the back of the computer.

C.

Photograph the screen and pull the plug from the back of the computer.

D.

Pull the plug from the wall.

How are the results of a signature analysis examined?

A.

By sorting on the category column in the Table view. By sorting on the category column in the Table view.

B.

By sorting on the signature column in the Table view. By sorting on the signature column in the Table view.

C.

By sorting on the hash sets column in the Table view. By sorting on the hash sets column in the Table view.

D.

By sorting on the hash library column in the Table view. By sorting on the hash library column in the Table view.

In Windows, the file MyNote.txt is deleted from C Drive and is automatically sent to the Recycle Bin. The long filename was MyNote.txt and the short filename was MYNOTE.TXT. When viewing the Recycle Bin with EnCase, how will the long filename and MyNote.txt and the short filename was MYNOTE.TXT?

A.

MyNote.txt, CD0.txt

B.

MyNote.txt, DC0.txt

C.

MyNote.del, DC1.del

D.

MyNote.del, DC0.del

The following keyword was typed in exactly as shown. Choose the answer(s) that would be found. All search criteria have default settings. Tom

A.

Tomorrow

B.

TomJ@hotmail.com

C.

Tom

D.

Stomp

If cluster #3552 entry in the FAT table contains a value of ?? this would mean:

A.

The cluster is unallocated

B.

The cluster is the end of a file

C.

The cluster is allocated

D.

The cluster is marked bad

In DOS and Windows, how many bytes are in one FAT directory entry?

A.

Variable

B.

32

C.

16

D.

64

E.

8