GD0-100 Exam Questions

You are working in a computer forensic lab. A law enforcement investigator brings you a computer and a valid search warrant. You have legal authority to search the computer. The in...

You are investigating a case involving fraud. You seized a computer from a suspect who stated that the computer is not used by anyone other than himself. The computer has Windows 9...

How many partitions can be found in the boot partition table found at the beginning of the drive?

In hexadecimal notation, one byte is represented by _____ character(s).

The EnCase evidence file is best described as:

In Windows 98 and ME, Internet based e-mail, such as Hotmail, will most likely be recovered in the _____________________ folder.

When an EnCase user double-clicks on a valid .jpg file, that file is:

When a drive letter is assigned to a logical volume, that information is temporarily written the volume boot record on the hard drive.

A hash set would most accurately be described as:

Temp files created by EnCase are deleted when EnCase is properly closed.

For an EnCase evidence file acquired with a hash value to pass verification, which of the following must be true?

The EnCase default export folder is:

A standard Windows 98 boot disk is acceptable for booting a suspect drive.

Which of the following aspects of the EnCase evidence file can be changed during a reacquire of the evidence file?

EnCase can build a hash set of a selected group of files.

The signature table data is found in which of the following files?

The following keyword was typed in exactly as shown. Choose the answer(s) that would result. All search criteria have default settings. Tom Jones

When a document is printed using EMF in Windows, what file(s) are generated in the spooling process?

EnCase uses the _________________ to conduct a signature analysis.

The MD5 hash algorithm produces a _____ number.

The Windows 98 Start Menu has a selection called documents which displays a list of recently used files. Which of the following folders contain those files?

The first sector on a hard drive is called the:

Before utilizing an analysis technique on computer evidence, the investigator should:

A signature analysis has been run on a case. The result ?*JPEG ?in the signature column means:

EnCase marks a file as overwritten when _____________ has been allocated to another file.

Will EnCase allow a user to write data into an acquired evidence file?

When undeleting a file in the FAT file system, EnCase will check the _____________ to see if it has already been overwritten.

4 bits allows what number of possibilities?

An evidence file can be moved to another directory without changing the file verification.

If cases are worked on a lab drive in a secure room, without any cleaning of the contents of the drive, which of the following areas would be of most concern?

A personal data assistant was placed in a evidence locker until an examiner has time to examine it. Which of the following areas would require special attention?

Which statement would most accurately describe a motherboard?

The EnCase methodology dictates that the lab drive for evidence have a __________ prior to making an image.

When a file is deleted in the FAT file system, what happens to the filename?

Which of the following is commonly used to encode e-mail attachments?

The FAT in the File Allocation Table file system keeps track of:

What information should be obtained from the BIOS during computer forensic investigations?

Search terms are stored in what .ini configuration file?

Search results are found in which of the following files?

You are at an incident scene and determine that a computer contains evidence as described in the search warrant. When you seize the computer, you should:

EnCase is able to read and examine which of the following file systems?

The Unicode system can address ____ characters?

The following keyword was typed in exactly as shown. Choose the answer(s) that would be found. All search criteria have default settings. Tom

The temporary folder of a case cannot be changed once it has been set.

A restored floppy diskette will have the same hash value as the original diskette.

GREP terms are automatically recognized as GREP by EnCase.

How many copies of the FAT are located on a FAT 32, Windows 98-formatted partition?

By default, what color does EnCase use for slack?

RAM is tested during which phase of the power-up sequence?

Searches and bookmarks are stored in the evidence file.