GD0-100 Exam Questions

RAM is an acronym for:

When handling computer evidence, an investigator should:

The case number in an evidence file can be changed without causing the verification feature to report an error, if:

In the FAT file system, the size of a deleted file can be found:

A sector on a hard drive contains how many bytes?

You are an investigator and have encountered a computer that is running at the home of a suspect. The computer does not appear to be a part of a network. The operating system is Wi...

The EnCase methodology dictates that ________ be created prior to acquiring evidence.

This question addresses the EnCase for Windows search process. If a target word is located in the unallocated space, and the word is fragmented between clusters 10 and 15, the sear...

If cluster #3552 entry in the FAT table contains a value of this would mean:

The acronym ASCII stands for:

You are examining a hard drive that has Windows XP installed as the operating system. You see a file that has a date and time in the deleted column. Where does that date and time c...

Within EnCase, what is the purpose of the temp folder?

Select the appropriate name for the highlighted area of the binary numbers.

To later verify the contents of an evidence file?

Assume that MyNote.txt has been deleted. The FAT file system directory entry for that file has been overwritten. The data for MyNote.txt is now:

An evidence file was archived onto five CD-Rom disks with the third file segment on disk number three. Can the contents of the third file segment be verified by itself while still...

The EnCase evidence file logical filename can be changed without affecting the verification of the acquired evidence.

When a file is deleted in the FAT or NTFS file systems, what happens to the data on the hard drive?

EnCase can make an image of a USB flash drive.

All investigators using EnCase should run tests on the evidence file acquisition and verification process to:

The term signature and header as they relate to a signature analysis are:

Which of the following selections is NOT found in the case file?

The maximum file segment size for an EnCase evidence file is: