GD0-100 Online Practice Questions and Answers

How are the results of a signature analysis examined?

A. By sorting on the category column in the Table view. By sorting on the category column in the Table view.

B. By sorting on the signature column in the Table view. By sorting on the signature column in the Table view.

C. By sorting on the hash sets column in the Table view. By sorting on the hash sets column in the Table view.

D. By sorting on the hash library column in the Table view. By sorting on the hash library column in the Table view.

EnCase uses the _________________ to conduct a signature analysis.

A. Both a and b

B. file signature table

C. hash library

D. file Viewers

By default, EnCase will display the data from the end of a logical file, to the end of the cluster, in what color:

A. Red

B. Red on black

C. Black on red

D. Black

This question addresses the EnCase for Windows search process. If a target word is within a logical file, and it begins in cluster 10 and ends in cluster 15 (the word is fragmented), the search:

A. Will not find it unlessile slack is checked on the search dialog box.

B. Will find it because EnCase performs a logical search.

C. Will not find it because EnCase performs a physical search only.

D. Will not find it because the letters of the keyword are not contiguous.

When a file is deleted in the FAT file system, what happens to the FAT?

A. The FAT entries for that file are marked as allocated.

B. Nothing.

C. It is deleted as well.

D. The FAT entries for that file are marked as available.

Select the appropriate name for the highlighted area of the binary numbers.

A. Word

B. Byte

C. Bit

D. Nibble

E. Dword

All investigators using EnCase should run tests on the evidence file acquisition and verification process to:

A. Insure that the investigator is using the proper method of acquisition.

B. All of the above.

C. Further the investigator understanding of the evidence file. Further the investigator?understanding of the evidence file.

D. Give more weight to the investigator testimony in court. Give more weight to the investigator?testimony in court.

To undelete a file in the FAT file system, EnCase obtains the starting extent from the:

A. Directory entry

B. FAT

C. Operating system

D. File header

If a hard drive is left in a room while acquiring, and several persons have access to that room, which of the following areas would be of most concern?

A. Storage

B. There is no concern

C. Cross-contamination

D. Chain-of-custody

The first sector on a hard drive is called the:

A. Master file table

B. Master boot record

C. Volume boot record

D. Volume boot sector