Guidance Software GD0-110 - Certification Exam for EnCE Outside North America
The first sector on a hard drive is called the:
The Windows 98 Start Menu has a selection called documents which displays a list of recently used files. Which of the following folders contain those files?
Calls to the C:\ volume of the hard drive are not made by DOS when a computer is booted with a standard DOS 6.22 boot disk.
A suspect typed a file on his computer and saved it to a floppy diskette. The filename was MyNote.txt. You receive the floppy and the suspect's computer. The suspect denies that the floppy disk belongs to him. You search the suspect's computer and locate only the filename within a .LNK file. The .LNK file is located in the folder C:\Windows\Recent. How you would use the .LNK file to establish a connection between the file on the floppy diskette and the suspect computer?
A CPU is:
A hash set would most accurately be described as:
The EnCase methodology dictates that ________ be created prior to acquiring evidence.
You are working in a computer forensic lab. A law enforcement investigator brings you a computer and a valid search warrant. You have legal authority to search the computer. The investigator hands you a piece of paper that has three printed checks on it. All three checks have the same check and account number. You image the suspect's computer and open the evidence file with EnCase. You perform a text search for the account number and check number. Nothing returns on the search results. You perform a text search for all other information found on the printed checks and there is still nothing returned in the search results. You run a signature analysis and check the gallery. You cannot locate any graphical copies of the printed checks in the gallery. At this point, is it safe to say that the checks are not located on the suspect computer?
Creating an image of a hard drive that was seized as evidence:
What information in a FAT file system directory entry refers to the location of a file on the hard drive?
