Guidance Software GD0-100 - Certification Exam For ENCE North America

What files are reconfigured or deleted by EnCase during the creation of an EnCase boot disk?

EnCase can build a hash set of a selected group of files.

This question addresses the EnCase for Windows search process. If a target word is located in the unallocated space, and the word is fragmented between clusters 10 and 15, the search:

Searches and bookmarks are stored in the evidence file.

You are investigating a case of child pornography on a hard drive containing Windows XP. In the :\Documents and Settings\Bad You are investigating a case of child pornography on a hard drive containing Windows XP. In the C:\Documents and Settings\Bad Guy\Local Settings\Temporary Internet Files folder you find three images

of child pornography. You find no other copies of the images on the suspect hard drive, and you find no other copies of the filenames. What can be deduced from your findings?

By default, what color does EnCase use for slack?

If a hard drive is left in a room while acquiring, and several persons have access to that room, which of the following areas would be of most concern?

If a hash analysis is run on a case, EnCase:

By default, EnCase will display the data from the end of a logical file, to the end of the cluster, in what color:

By default, what color does EnCase use for the contents of a logical file