Exit demo GD0-110 Certification for EnCE Outside North America PDF format · free preview

Guidance Software GD0-110 - Questions & Answers

Free preview · every answer includes a full explanation

Product page: https://prepkeys.com/gd0-110.html

Question 1
Single choice

A FAT directory has as a logical size of:

A.

One cluster

B.

0 bytes

C.

128 bytes

D.

64 bytes

Question 2
Single choice

In DOS and Windows, how many bytes are in one FAT directory entry?

A.

16

B.

8

C.

32

D.

Variable

E.

64

Question 3
Multiple choice

EnCase is able to read and examine which of the following file systems?

A.

HFS

B.

FAT

C.

NTFS

D.

EXT3

Question 4
Single choice

The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result.
[\x00-\x05]\x00\x00\x00? >?[?[@?[?[?[

A.

00 00 00 01 FF FF BA

B.

FF 00 00 00 00 FF BA

C.

04 00 00 00 FF FF BA

D.

04 06 00 00 00 FF FF BA

Question 5
Single choice

By default, what color does EnCase use for the contents of a logical file?

A.

Red

B.

Red on black

C.

Black

D.

Black on red

Question 6
Single choice

4 bits allows what number of possibilities?

A.

16

B.

2

C.

4

D.

8

Question 7
Single choice

A hard drive has been formatted as NTFS and Windows XP was installed. The user used fdisk to remove all partitions from that drive. Nothing else was done. You have imaged the drive and have opened the evidence file with EnCase.

What would be the best way to examine this hard drive?

A.

EnCase will not see a drive that has been fdisked.

B.

Use the ecovered Deleted Partitionsfeature and then examine the system. Use the recovered Deleted Partitions feature and then examine the system.

C.

Conduct a physical search of the hard drive and bookmark any evidence.

D.

Use the dd Partitionfeature to rebuild the partition and then examine the system. Use the add Partitionfeature to rebuild the partition and then examine the system.

Question 8
Single choice

For an EnCase evidence file acquired with a hash value to pass verification, which of the following must be true?

A.

Either the CRC or MD5 hash values must verify.

B.

The CRC values must verify.

C.

The CRC values and the MD5 hash value both must verify.

D.

The MD5 hash value must verify.

Question 9
Single choice

Which of the following selections would be used to keep track of a fragmented file in the FAT file system?

A.

All of the above

B.

The partition table of extents

C.

The File Allocation Table

D.

The directory entry for the fragmented file

Question 10
Single choice

Within EnCase for Windows, the search process is:

A.

a search of the logical files

B.

a search of the physical disk in unallocated clusters and other unused disk areas

C.

both a and b

D.

None of the above

Showing 10 of 174 questions · Unlock the full set