Guidance Software GD0-110 - Certification Exam for EnCE Outside North America

EnCase can make an image of a USB flash drive.

Select the appropriate name for the highlighted area of the binary numbers.

Within EnCase, you highlight a range of data within a file. The length indicator displays the value 30. How many bytes have you actually selected?

RAM is an acronym for:

Using good forensic practices, when seizing a computer at a business running Windows 2000 Server you should:

The FAT in the File Allocation Table file system keeps track of:

A restored floppy diskette will have the same hash value as the original diskette.

Which of the following selections would be used to keep track of a fragmented file in the FAT file system?

In the EnCase environment, the term uxternal viewers is best described as:

You are examining a hard drive that has Windows XP installed as the operating system. You see a file that has a date and time in the deleted column. Where does that date and time come from?