11.11 Sale - Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: 65percent

Welcome To DumpsPedia

GD0-100 Sample Questions Answers

Questions 4

EnCase uses the _________________ to conduct a signature analysis.

Options:

A.

Both a and b

B.

file signature table

C.

hash library

D.

file Viewers

Buy Now
Questions 5

The Windows 98 Start Menu has a selection called documents which displays a list of recently used files. Which of the following The Windows 98 Start Menu has a selection called documents which displays a list of recently used files. Which of the following folders contain those files?

Options:

A.

C:\Windows\History

B.

C:\Windows\Start menu\Documents

C.

C:\Windows\Documents

D.

C:\Windows\Recent

Buy Now
Questions 6

When an EnCase user double-clicks on a valid .jpg file, that file is:

Options:

A.

Copied to the default export folder and opened by an associated program.

B.

Renamed to JPG_0001.jpg and copied to the default export folder.

C.

Copied to the EnCase specified temp folder and opened by an associated program.

D.

Opened by EnCase.

Buy Now
Questions 7

The MD5 hash algorithm produces a _____ number.

Options:

A.

32 bit

B.

256 bit

C.

64 bit

D.

128 bit

Buy Now
Questions 8

The acronym ASCII stands for:

Options:

A.

American Standard Communication Information Index

B.

American Standard Code for Information Interchange

C.

Accepted Standard Code for Information Interchange

D.

Accepted Standard Communication Information Index

Buy Now
Questions 9

The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. 800[) \-]+555-1212

Options:

A.

(800) 555-1212

B.

800-555 1212

C.

8005551212

D.

800.555.1212

Buy Now
Questions 10

The EnCase case file can be best described as:

Options:

A.

The file that runs EnCase for Windows.

B.

A filecontain configuration settings for cases.

C.

None of the above.

D.

A file that contains information specific to one case.

Buy Now
Questions 11

EnCase can build a hash set of a selected group of files.

Options:

A.

True

B.

False

Buy Now
Questions 12

If cases are worked on a lab drive in a secure room, without any cleaning of the contents of the drive, which of the following areas would be of most concern?

Options:

A.

There is no concern

B.

Cross-contamination

C.

Chain-of-custody

D.

Storage

Buy Now
Questions 13

Which statement would most accurately describe a motherboard?

Options:

A.

An add-in card that handles allRAM.

B.

Any circuit board, regardless of its function.

C.

The main circuit board that has slots for the microprocessor, RAM, ROM, and add-in cards.

D.

An add-in card that controls all hard drive activity.

Buy Now
Questions 14

Two allocated files can occupy one cluster, as long as they can both fit within the allotted number of bytes.

Options:

A.

True

B.

False

Buy Now
Questions 15

The FAT in the File Allocation Table file system keeps track of:

Options:

A.

File fragmentation

B.

Clusters marked as bad

C.

Every addressable cluster on the partition

D.

All of the above.

Buy Now
Questions 16

In the FAT file system, the size of a deleted file can be found:

Options:

A.

In the FAT

B.

In the directory entry

C.

In the file footer

D.

In the file header

Buy Now
Questions 17

Assume that MyNote.txt was allocated to clusters 5, 9, and 11. Cluster 6, 7, and 8 belong to MyResume.doc. Both files have been deleted and the directory entry in the FAT file system for MyResume.doc has been overwritten. What clusters would EnCase use to undelete MyNote.txt?

Options:

A.

5,9,11

B.

5,6,7

C.

7,8,9

D.

6,7,8

Buy Now
Questions 18

If cluster #3552 entry in the FAT table contains a value of ?? this would mean:

Options:

A.

The cluster is unallocated

B.

The cluster is the end of a file

C.

The cluster is allocated

D.

The cluster is marked bad

Buy Now
Questions 19

Search terms are case sensitive by default.

Options:

A.

False

B.

True

Buy Now
Questions 20

Creating an image of a hard drive that was seized as evidence:

Options:

A.

May be done by anyone because it is a relatively simple procedure.

B.

May only be done by trained personnel because the process has the potential to alter the original evidence.

C.

May only be done by computer scientists.

D.

Should be done by the user, as they are most familiar with the hard drive.

Buy Now
Questions 21

A personal data assistant was placed in a evidence locker until an examiner has time to examine it. Which of the following areas would require special attention?

Options:

A.

Chain-of-custody

B.

Storage

C.

There is no concern

D.

Cross-contamination

Buy Now
Questions 22

To undelete a file in the FAT file system, EnCase obtains the starting extent from the:

Options:

A.

Directory entry

B.

FAT

C.

Operating system

D.

File header

Buy Now
Questions 23

In Windows, the file MyNote.txt is deleted from C Drive and is automatically sent to the Recycle Bin. The long filename was MyNote.txt and the short filename was MYNOTE.TXT. When viewing the Recycle Bin with EnCase, how will the long filename and MyNote.txt and the short filename was MYNOTE.TXT?

Options:

A.

MyNote.txt, CD0.txt

B.

MyNote.txt, DC0.txt

C.

MyNote.del, DC1.del

D.

MyNote.del, DC0.del

Buy Now
Questions 24

If a hash analysis is run on a case, EnCase:

Options:

A.

Will compute a hash value of the evidence file and begin a verification process.

B.

Will generate a hash set for every file in the case.

C.

Will compare the hash value of the files in the case to the hash library.

D.

Will create a hash set to the user specifications. Will create a hash set to the user?specifications.

Buy Now
Questions 25

In Windows 98 and ME, Internet based e-mail, such as Hotmail, will most likely be recovered in the _____________________ folder.

Options:

A.

C:\Windows\Online\Applications\email

B.

C:\Windows\Temporary Internet files

C.

C:\Windows\History\Email

D.

C:\Windows\Temp

Buy Now
Questions 26

Using good forensic practices, when seizing a computer at a business running Windows 2000 Server you should:

Options:

A.

Pull the plug from the back of the computer.

B.

Press the power button and hold it in.

C.

Shut it down normally.

D.

Pull the plug from the wall.

Buy Now
Questions 27

A logical file would be best described as:

Options:

A.

The data taken from the starting cluster to the end of the last cluster that is occupied by the file.

B.

A file including any RAM and disk slack.

C.

A file including only RAM slack.

D.

The data from the beginning of the starting cluster to the length of the file.

Buy Now
Questions 28

Select the appropriate name for the highlighted area of the binary numbers.

Options:

A.

Word

B.

Dword

C.

Byte

D.

Nibble

E.

Bit

Buy Now
Questions 29

Temp files created by EnCase are deleted when EnCase is properly closed.

Options:

A.

True

B.

False

Buy Now
Questions 30

If an evidence file has been added to a case and completely verified, what happens if the data area within the evidence file is later changed?

Options:

A.

EnCase will allow the examiner to continue to access the rest of the evidence file that has not been changed.

B.

EnCase detect the error if the evidence file is manually re-verified.

C.

EnCase will detect the error when that area of the evidence file is accessed by the user.

D.

All of the above.

Buy Now
Questions 31

How many clusters can a FAT 16 system address?

Options:

A.

65,536

B.

4,096

C.

268,435,456

D.

4,294,967,296

Buy Now
Questions 32

When an EnCase user double-clicks on a file within EnCase what determines the action that will result? Select all that apply

Options:

A.

The settings in the case file.

B.

The settings in the FileTypes.ini file.

C.

The setting in the evidence file.

Buy Now
Questions 33

The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result.[\x00-\x05]\x00\x00?>[?[@?[?[?[

Options:

A.

FF 0000 00 00 FF BA

B.

0000 00 01 FF FF BA

C.

04 06 0000 00 FF FF BA

D.

04 0000 00 FF FF BA

Buy Now
Questions 34

To generate an MD5 hash value for a file, EnCase:

Options:

A.

Computes the hash value including the logical file and filename.

B.

Computes the hash value including the physical file and filename.

C.

Computes the hash value based on the logical file.

D.

Computes the hash value based on the physical file.

Buy Now
Questions 35

The spool files that are created during a print job are __________ after the print job is completed.

Options:

A.

moved

B.

wiped

C.

deleted and wiped

D.

deleted

Buy Now
Questions 36

Hash libraries are commonly used to:

Options:

A.

Compare a file header to a file extension.

B.

Identify files that are already known to the user.

C.

Compare one hash set with another hash set.

D.

Verify the evidence file.

Buy Now
Questions 37

When Unicode is selected for a search keyword, EnCase:

Options:

A.

Will find the keyword if it is either Unicode or ASCII.

B.

Unicode is not a search option for EnCase.

C.

Will only find the keyword if it is Unicode.

D.

None of the above.

Buy Now
Questions 38

The EnCase signature analysis is used to perform which of the following actions?

Options:

A.

Analyzing the relationship of a file signature to its file extension.Analyzing the relationship of a file signature to its file extension.

B.

Analyzing the relationship of a file signature to its file header.Analyzing the relationship of a file signature to its file header.

C.

Analyzing the relationship of a file signature to a list of hash sets.Analyzing the relationship of a file signature to a list of hash sets.

D.

Analyzing the relationship of a file signature to its computed MD5 hash value.Analyzing the relationship of a file signature to its computed MD5 hash value.

Buy Now
Questions 39

A standard DOS 6.22 boot disk is acceptable for booting a suspect drive.

Options:

A.

True

B.

False

Buy Now
Questions 40

By default, EnCase will display the data from the end of a logical file, to the end of the cluster, in what color:

Options:

A.

Red

B.

Red on black

C.

Black on red

D.

Black

Buy Now
Questions 41

How many copies of the FAT are located on a FAT 32, Windows 98-formatted partition?

Options:

A.

2

B.

3

C.

1

D.

4

Buy Now
Questions 42

If cluster number 10 in the FAT contains the number 55, this means:

Options:

A.

That cluster 10 is used and the file continues in cluster number 55.

B.

That the file starts in cluster number 55 and continues to cluster number 10.

C.

That there is a cross-linked file.

D.

The cluster number 55 is the end of an allocated file.

Buy Now
Questions 43

Which of the following directories contain the information that is found on a Windows 98 Desktop?

Options:

A.

C:\Program files\Programs\Desktop

B.

C:\Desktop

C.

C:\Startup\Desktop\Items

D.

C:\Windows\Desktop

Buy Now
Questions 44

To later verify the contents of an evidence file 7RODWHUYHULI\WKHFRQWHQWVRIDQHYLGHQFHILOH

Options:

A.

EnCase writes a CRC value for every 64 sectors copied.

B.

EnCase writes a CRC value for every 128 sectors copied.

C.

EnCase writes an MD5 hash value every 64 sectors copied.

D.

EnCase writes an MD5 hash value for every 32 sectors copied.

Buy Now
Questions 45

The temporary folder of a case cannot be changed once it has been set.

Options:

A.

False

B.

True

Buy Now
Questions 46

How does EnCase verify that the case information (Case Number, Evidence Number, Investigator Name, etc) in an evidence file has not been damaged or changed, after the evidence file has been written?

Options:

A.

EnCase writes a CRC value of the case information and verifies the CRC value when the evidence is added to a case.

B.

EnCase does not verify the case information and case information can be changed by the user as it becomes necessary.

C.

The .case file writes a CRC value for the case information and verifies it when the case is opened.

D.

EnCase writes an MD5 hash value for the entire evidence file, which includes the case information, and verifies the MD5 hash when the evidence is added to a case.

Buy Now
Questions 47

The EnCase evidence file is best described as:

Options:

A.

A clone of the source hard drive.

B.

A sector-by-sector copy of the source hard drive written to the corresponding sectors of the target hard drive.

C.

A bit stream image of the source hard drive written to a file, or several file segments.

D.

A bit stream image of the source hard drive written to the corresponding sectors of the target hard drive.

Buy Now
Questions 48

Select the appropriate name for the highlighted area of the binary numbers.

Options:

A.

Byte

B.

Dword

C.

Word

D.

Bit

E.

Nibble

Buy Now
Questions 49

You are conducting an investigation and have encountered a computer that is running in the field. The operating system is Windows XP. A software program is currently running and is visible on the screen. You should:

Options:

A.

Navigate through the program and see what the program is all about, then pull the plug.

B.

Pull the plug from the back of the computer.

C.

Photograph the screen and pull the plug from the back of the computer.

D.

Pull the plug from the wall.

Buy Now
Questions 50

When a file is deleted in the FAT file system, what happens to the filename?

Options:

A.

It is zeroed out.

B.

The first character of the directory entry is marked with a hex 00.

C.

It is wiped from the directory.

D.

The first character of the directory entry is marked with a hex E5.

Buy Now
Questions 51

How does EnCase verify that the case information (Case Number, Evidence Number, Investigator Name, etc) in an evidence file has not been damaged or changed, after the evidence file has been written?

Options:

A.

a search of the physical disk in unallocated clusters and other unused disk areas

B.

a search of the logical files

C.

both a and b

D.

None of the above

Buy Now
Questions 52

A standard Windows 98 boot disk is acceptable for booting a suspect drive.

Options:

A.

True

B.

False

Buy Now
Exam Code: GD0-100
Exam Name: Certification Exam For ENCE North America
Last Update: Nov 2, 2024
Questions: 176
$56  $159.99
$42  $119.99
$35  $99.99
buy now GD0-100