Guidance_Software

GD0-110 · Question #106

The EnCase evidence file is best described as:

The correct answer is D. A bit stream image of the source hard drive written to a file, or several file segments. See the full explanation below for the reasoning.

Question

The EnCase evidence file is best described as:

Options

AA clone of the source hard drive.
BA sector-by-sector copy of the source hard drive written to the corresponding sectors of the target
CA bit stream image of the source hard drive written to the corresponding sectors of the target hard
DA bit stream image of the source hard drive written to a file, or several file segments.

How the community answered

(26 responses)

A
12% (3)
B
4% (1)
D
85% (22)

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion

Full GD0-110 Practice