GD0-100 Exam Questions

Within EnCase, you highlight a range of data within a file. The length indicator displays the value 30. How many bytes have you actually selected?

A sector on a floppy disk is the same size as a sector on a NTFS formatted hard drive.

Pressing the power button on a computer that is running could have which of the following results?

In the EnCase environment, the term uxternal viewers is best described as:

A SCSI drive is pinned as a master when it is:

When Unicode is selected for a search keyword, EnCase:

How many clusters can a FAT 16 system address?

A file extension and signature can be manually added by:

In Windows, the file MyNote.txt is deleted from C Drive and is automatically sent to the recycle Bin. The long filename was MyNote.txt and the short filename was MYNOTE.TXT. When v...

You are investigating a case involving fraud. You seized a computer from a suspect who stated that the computer is not used by anyone other than himself. The computer has Windows 9...

To undelete a file in the FAT file system, EnCase obtains the starting extent from the:

Which of the following would most likely be an add-in card?

Which of the following is found in the FileSignatures.ini configuration file?

The default export folder remains the same for all cases.

Assume that MyNote.txt was allocated to clusters 5, 9, and 11. Cluster 6, 7, and 8 belong to MyResume.doc. Both files have been deleted and the directory entry in the FAT file syst...

Which of the following directories contain the information that is found on a Windows 98 Desktop?

If a hard drive is left in a room while acquiring, and several persons have access to that room, which of the following areas would be of most concern?

In Windows 2000 and XP, which of the following directories contain user personal folders?

By default, what color does EnCase use for the contents of a logical file?

A hash library would most accurately be described as:

A standard DOS 6.22 boot disk is acceptable for booting a suspect drive.

By default, EnCase will display the data from the end of a logical file, to the end of the cluster, in what color:

If a hash analysis is run on a case, EnCase:

Creating an image of a hard drive that was seized as evidence:

Which of the following selections would be used to keep track of a fragmented file in the FAT file system?

A suspect typed a file on his computer and saved it to a floppy diskette. The filename was MyNote.txt. You receive the floppy and the suspect's computer. The suspect denies that th...

Using good forensic practices, when seizing a computer at a business running Windows 2000 Server you should:

A signature analysis has been run on a case. The result !Bad Signature means:

A FAT directory has as a logical size of:

What are the EnCase configuration .ini files used for?

Assume that an evidence file is added to a case, the case is saved, and the case is closed. What happens if the evidence file is moved, and the case is then opened?

The EnCase case file can be best described as:

The case file should be archived with the evidence files at the termination of a case.

Select the appropriate name for the highlighted area of the binary numbers.

You are conducting an investigation and have encountered a computer that is running in the field. The operating system is Windows XP. A software program is currently running and is...

An Enhanced Metafile would best be described as:

Changing the filename of a file will change the hash value of the file.

The results of a hash analysis on an evidence file that has been added to a case will be stored in which of the following files?

In Unicode, one printed character is composed of ____ bytes of data.

To generate an MD5 hash value for a file, EnCase:

What does the acronym BIOS stand for?

The EnCase signature analysis is used to perform which of the following actions?

The spool files that are created during a print job are __________ after the print job is completed.

The following keyword was typed in exactly as shown. Choose the answer(s) that would result. All search criteria have default settings. credit card

What files are reconfigured or deleted by EnCase during the creation of an EnCase boot disk?

A hard drive was imaged using EnCase. The original drive was placed into evidence. The restore feature was used to make a copy of the original hard drive. EnCase verifies the resto...

Which of the following would be a true statement about the function of the BIOS?

Within EnCase, what is purpose of the default export folder?

The following keyword was typed in exactly as shown. Choose the answer(s) that would result. All search criteria have default settings. Speed and Meth

You are assigned to assist with the search and seizure of several computers. The magistrate ordered that the computers cannot be seized unless they are found to contain any one of...