GD0-110 by Guidance Software Valid Free Exam Practice Test

Question 1

To undelete a file in the FAT file system, EnCase obtains the starting extent from the:

A. FAT B. Operating system C. Directory entry D. File header

Correct Answer: C

Question 2

Which is the proper formula for determining the size in bytes of a hard drive that uses cylinders (C), heads (H), and sectors (S) geometry?

A. C X H + S B. C X H X S C. C X H X S + 512 D. C X H X S X 512

Correct Answer: D

Question 3

You are examining a hard drive that has Windows XP installed as the operating system. You see a file that has a date and time in the eleted?column. Where does that date and time come from? ?eleted?column. Where does that date and time come from?

A. Info2 file B. Inode Table C. Master File Table D. Directory Entry

Correct Answer: A

Question 4

Within EnCase for Windows, the search process is:

A. both a and b B. None of the above C. a search of the physical disk in unallocated clusters and other unused disk areas D. a search of the logical files

Correct Answer: A

Question 5

The following keyword was typed in exactly as shown. Choose the answer(s) that would result. All search criteria have default settings. credit card

A. Credit B. Card C. credit card D. Credit Card

Correct Answer: C,D

Question 6

The first sector on a hard drive is called the:

A. Master boot record B. Volume boot record C. Master file table D. Volume boot sector

Correct Answer: A

Question 7

All investigators using EnCase should run tests on the evidence file acquisition and verification process to:

A. Insure that the investigator is using the proper method of acquisition. B. Further the investigator understanding of the evidence file. Further the investigator? understanding of the evidence file. C. All of the above. D. Give more weight to the investigator testimony in court. Give more weight to the investigator? testimony in court.

Correct Answer: C

Question 8

CORRECT TEXT
When a drive letter is assigned to a logical volume, that information is temporarily written the volume boot record on the hard drive.

A. False B. True

Correct Answer: B

Question 9

RAM is tested during which phase of the power-up sequence?

A. After POST B. None of the above. C. During POST D. Pre-POST

Correct Answer: C

Question 10

By default, what color does EnCase use for slack?

A. Red B. Black on red C. Red on black D. Black

Correct Answer: A

Question 11

A case file can contain ____ hard drive images?

A. any number of B. 5 C. 10 D. 1

Correct Answer: A

Question 12

When an EnCase user double-clicks on a valid .jpg file, that file is:

A. Opened by EnCase. B. Renamed to JPG_0001.jpg and copied to the default export folder. C. Copied to the EnCase specified temp folder and opened by an associated program. D. Copied to the default export folder and opened by an associated program.

Correct Answer: C

Question 13

When Unicode is selected for a search keyword, EnCase:

A. Unicode is not a search option for EnCase. B. None of the above. C. Will only find the keyword if it is Unicode. D. Will find the keyword if it is either Unicode or ASCII.

Correct Answer: D

Question 14

If cases are worked on a lab drive in a secure room, without any cleaning of the contents of the drive, which of the following areas would be of most concern?

A. There is no concern B. Chain-of-custody C. Storage D. Cross-contamination

Correct Answer: D

Guidance Software Certification Exam for EnCE Outside North America - GD0-110 Exam Practice Test