GD0-100 Exam Questions

The end of a logical file to the end of the cluster that the file ends in is called:

The boot partition table found at the beginning of a hard drive is located in what sector?

What information in a FAT file system directory entry refers to the location of a file on the hard drive?

A logical file would be best described as:

A case file can contain ____ hard drive images?

Calls to the C:\ volume of the hard drive are not made by DOS when a computer is booted with a standard DOS 6.22 boot disk.

Select the appropriate name for the highlighted area of the binary numbers.

If an evidence file has been added to a case and completely verified, what happens if the data area within the evidence file is later changed?

The BIOS chip on an IBM clone computer is most commonly located on:

Consider the following path in a FAT file system: C:\My Documents\My Pictures\Bikes. Where does the directory bikes receive its name?

The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. 800[) \-]+555-1212

How does EnCase verify that the case information (Case Number, Evidence Number, Investigator Name, etc) in an evidence file has not been damaged or changed, after the evidence file...

Which of the following statements is more accurate?

The first sector on a volume is called the:

When an EnCase user double-clicks on a file within EnCase what determines the action that will result?

The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. Bob@[a-z]+.com

The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. [^a-z]Tom[^a-z]

The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. [\x00-\x05]\x00\x00\x00?[\x00-\x05]\x00\x00\x00

This question addresses the EnCase for Windows search process. If a target word is within a logical file, and it begins in cluster 10 and ends in cluster 15 (the word is fragmented...

When a file is deleted in the FAT file system, what happens to the FAT?

In DOS and Windows, how many bytes are in one FAT directory entry?

When a non-compressed evidence file is reacquired with compression, the acquisition and verification hash values for the evidence will remain the same for both files.

An EnCase evidence file of a hard drive ________ be restored to another hard drive of equal or greater size.

A hard drive has been formatted as NTFS and Windows XP was installed. The user used fdisk to remove all partitions from that drive. Nothing else was done. You have imaged the drive...

How are the results of a signature analysis examined?

If a floppy diskette is in the a drive, the computer will always boot to that drive before any other device.

During the power-up sequence, which of the following happens first?

A hard drive has 8 sectors per cluster. File Mystuff.doc has a logical file size of 13,000 bytes. How many clusters will be used by Mystuff.doc?

Select the appropriate name for the highlighted area of the binary numbers.

The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. Jan 1 st , 2?0?00

When does the POST operation occur?

Which is the proper formula for determining the size in bytes of a hard drive that uses cylinders (C), heads (H), and sectors (S) geometry?

Within EnCase, clicking on save on the toolbar affects what file(s)?

Hash libraries are commonly used to:

You are investigating a case of child pornography on a hard drive containing Windows XP. In the C:\Documents and Settings\Bad Guy\Local Settings\Temporary Internet Files folder you...

Which of the following items could contain digital evidence?

Bookmarks are stored in which of the following files?

Two allocated files can occupy one cluster, as long as they can both fit within the allotted number of bytes.

A SCSI host adapter would most likely perform which of the following tasks?

How does EnCase verify that the evidence file contains an exact copy of the suspect hard drive?

In DOS acquisition mode, if a physical drive is detected, but no partition information is displayed, what would be the cause:

RAM is used by the computer to:

If cluster number 10 in the FAT contains the number 55, this means:

Within EnCase for Windows, the search process is:

A physical file size is:

When can an evidence file containing a NTFS partition be logically restored to a FAT 32 partition?

Select the appropriate name for the highlighted area of the binary numbers.

To undelete a file in the FAT file system, EnCase computes the number of _______ the file will use based on the file ______.

ROM is an acronym for:

Search terms are case sensitive by default.