Guidance_Software
GD0-110 · Question #101
GD0-110 Question #101: Real Exam Question with Answer & Explanation
The correct answer is D. Use FastBloc or a network/parallel port cable to preview the hard drives. Conduct a hash analysis. See the full explanation below for the reasoning.
Question
You are assigned to assist with the search and seizure of several computers. The magistrate ordered that the computers cannot be seized unless they are found to contain any one of ten previously identified images. You currently have the ten images in JPG format. Using the EnCase methodology, how would you best handle this situation?
Options
- AUse an EnCase DOS boot disk to conduct a text search for child porn
- BUse FastBloc or a network/parallel port cable to acquire forensic images of the hard drives, then
- CUse FastBloc or a network/parallel port cable to preview the hard drives. Go to the Gallery view
- DUse FastBloc or a network/parallel port cable to preview the hard drives. Conduct a hash analysis
Community Discussion
No community discussion yet for this question.