Guidance_Software
GD0-110 · Question #24
GD0-110 Question #24: Real Exam Question with Answer & Explanation
Sign in or unlock GD0-110 to reveal the answer and full explanation for question #24. The question stem and answer options stay visible for context.
Question
A hard drive has been formatted as NTFS and Windows XP was installed. The user used fdisk to remove all partitions from that drive. Nothing else was done. You have imaged the drive and have opened the evidence file with EnCase. What would be the best way to examine this hard drive?
Options
- AConduct a physical search of the hard drive and bookmark any evidence.
- BUse the add Partition feature to rebuild the partition and then examine the system.
- CUse the recovered Deleted Partitions feature and then examine the system.
- DEnCase will not see a drive that has been fdisked.
Unlock GD0-110 to see the answer
You've previewed enough free GD0-110 questions. Unlock GD0-110 for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.