GD0-100 Online Practice Questions and Answers
Search results are found in which of the following files? Select all that apply.
A. The evidence file
B. The configuration Searches.ini file
C. The case file
EnCase is able to read and examine which of the following file systems?
A. NTFS
B. EXT3
C. FAT
D. HFS
This question addresses the EnCase for Windows search process. If a target word is within a logical file, and it begins in cluster 10 and ends in cluster 15 (the word is fragmented), the search:
A. Will not find it unlessile slack is checked on the search dialog box.
B. Will find it because EnCase performs a logical search.
C. Will not find it because EnCase performs a physical search only.
D. Will not find it because the letters of the keyword are not contiguous.
Consider the following path in a FAT file system:
A. From the My Pictures directory
B. From the My Documents directory
C. From the root directory c:\
D. From itself
Assume that MyNote.txt has been deleted. The FAT file system directory entry for that file has been overwritten. The data for MyNote.txt is now:
A. Overwritten
B. Allocated
C. Cross-linked
D. Unallocated
When an EnCase user double-clicks on a valid .jpg file, that file is:
A. Copied to the default export folder and opened by an associated program.
B. Renamed to JPG_0001.jpg and copied to the default export folder.
C. Copied to the EnCase specified temp folder and opened by an associated program.
D. Opened by EnCase.
A hash set would most accurately be described as:
A. A group of hash libraries organized by category.
B. A group of hash values that can be added to the hash library.
C. A table of file headers and extensions.
D. Botha and b.
Two allocated files can occupy one cluster, as long as they can both fit within the allotted number of bytes.
A. True
B. False
If cluster #3552 entry in the FAT table contains a value of ?? this would mean:
A. The cluster is unallocated
B. The cluster is the end of a file
C. The cluster is allocated
D. The cluster is marked bad