GD0-100 Practice Exam Questions with Answers Certification Exam For ENCE North America Certification

Two allocated files can occupy one cluster, as long as they can both fit within the allotted number of bytes.

The case file should be archived with the evidence files at the termination of a case.

You are at an incident scene and determine that a computer contains evidence as described in the search warrant. When you seize the computer, you should:

Search terms are case sensitive by default.

When a file is deleted in the FAT file system, what happens to the FAT?

A FAT directory has as a logical size of:

To undelete a file in the FAT file system, EnCase obtains the starting extent from the:

A case file can contain ____ hard drive images?

You are an investigator and have encountered a computer that is running at the home of a suspect. The computer does not appear to be a part of a network. The operating system is Windows XP Home. No programs are visibly running. You should:

The spool files that are created during a print job are __________ after the print job is completed.

An Enhanced Metafile would best be described as:

The EnCase methodology dictates that the lab drive for evidence have a __________ prior to making an image.

When Unicode is selected for a search keyword, EnCase:

GREP terms are automatically recognized as GREP by EnCase.

How many copies of the FAT are located on a FAT 32, Windows 98-formatted partition?

The first sector on a volume is called the:

How many partitions can be found in the boot partition table found at the beginning of the drive?

When a drive letter is assigned to a logical volume, that information is temporarily written the volume boot record on the hard drive.

The end of a logical file to the end of the cluster that the file ends in is called:

A hard drive has been formatted as NTFS and Windows XP was installed. The user used fdisk to remove all partitions from that drive. Nothing else was done. You have imaged the drive and have opened the evidence file with EnCase. What would be the best way to examine this hard drive?

Consider the following path in a FAT file system: