GD0-110 Online Practice Questions and Answers

EnCase is able to read and examine which of the following file systems?

A. HFS

B. FAT

C. NTFS

D. EXT3

In hexadecimal notation, one byte is represented by character(s).

A. 8

B. 4

C. 2

D. 1

Consider the following path in a FAT file system:

A. From the root directory c:\

B. From itself

C. From the My Pictures directory

D. From the My Documents directory

Select the appropriate name for the highlighted area of the binary numbers.

A. Bit

B. Nibble

C. Word

D. Byte

E. Dword

By default, what color does EnCase use for slack?

A. Red

B. Black

C. Black on red

D. Red on black

A sector on a hard drive contains how many bytes?

A. 2048

B. 1024

C. 4096

D. 512

When a file is deleted in the FAT or NTFS file systems, what happens to the data on the hard drive?

A. The file header is marked with a Sigma so the file is not recognized by the operating system.

B. It is moved to a special area.

C. It is overwritten with zeroes.

D. Nothing.

Pressing the power button on a computer that is running could have which of the following results?

A. The operating system will shut down normally.

B. The computer will instantly shut off.

C. Nothing will happen.

D. All of the above could happen.

E. The computer will go into stand-by mode.

Select the appropriate name for the highlighted area of the binary numbers.

A. Nibble

B. Dword

C. Word

D. Byte

E. Bit

How does EnCase verify that the case information (Case Number, Evidence Number, Investigator Name, etc) in an evidence file has not been damaged or changed, after the evidence file has been written?

A. The .case file writes a CRC value for the case information and verifies it when the case is opened.

B. EnCase does not verify the case information and case information can be changed by the user as it becomes necessary.

C. EnCase writes a CRC value of the case information and verifies the CRC value when the evidence is added to a case.

D. EnCase writes an MD5 hash value for the entire evidence file, which includes the case information, and verifies the MD5 hash when the evidence is added to a case.