GD0-100 Practice Exam Questions with Answers Certification Exam For ENCE North America Certification

How does EnCase verify that the case information (Case Number, Evidence Number, Investigator Name, etc) in an evidence file has not been damaged or changed, after the evidence file has been written?

A signature analysis has been run on a case. The result "Bad Signature " means:

If a floppy diskette is in the ?drive, the computer will always boot to that drive before any other device. If a floppy diskette is in the ??drive, the computer will always boot to that drive before any other device.

To later verify the contents of an evidence file 7RODWHUYHULI\WKHFRQWHQWVRIDQHYLGHQFHILOH

A hard drive has been formatted as NTFS and Windows XP was installed. The user used fdisk to remove all partitions from that drive. Nothing else was done. You have imaged the drive and have opened the evidence file with EnCase. What would be the best way to examine this hard drive?

When Unicode is selected for a search keyword, EnCase:

The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. 800[) \-]+555-1212

When an EnCase user double-clicks on a file within EnCase what determines the action that will result? Select all that apply

Within EnCase, clicking on Save on the toolbar affects what file(s)?

EnCase is able to read and examine which of the following file systems?

You are working in a computer forensic lab. A law enforcement investigator brings you a computer and a valid search warrant. You have legal authority to search the computer. The investigator hands you a piece of paper that has three printed checks on it. All three checks have the same check and account number. You image the suspect computer and open the evidence file with EnCase. You checks have the same check and account number. You image the suspect's computer and open the evidence file with EnCase. You perform a text search for the account number and check number. Nothing returns on the search results. You perform a text search for all other information found on the printed checks and there is still nothing returned in the search results. You run a signature analysis and check the gallery. You cannot locate any graphical copies of the printed checks in the gallery. At this point, is it safe to say that the checks are not located on the suspect computer?

All investigators using EnCase should run tests on the evidence file acquisition and verification process to:

Select the appropriate name for the highlighted area of the binary numbers.

Temp files created by EnCase are deleted when EnCase is properly closed.

Assume that MyNote.txt was allocated to clusters 5, 9, and 11. Cluster 6, 7, and 8 belong to MyResume.doc. Both files have been deleted and the directory entry in the FAT file system for MyResume.doc has been overwritten. What clusters would EnCase use to undelete MyNote.txt?

When a file is deleted in the FAT file system, what happens to the filename?

Search results are found in which of the following files? Select all that apply.

The case number in an evidence file can be changed without causing the verification feature to report an error, if:

If a hard drive is left in a room while acquiring, and several persons have access to that room, which of the following areas would be of most concern?

EnCase can build a hash set of a selected group of files.

Searches and bookmarks are stored in the evidence file.

A personal data assistant was placed in a evidence locker until an examiner has time to examine it. Which of the following areas would require special attention?

The boot partition table found at the beginning of a hard drive is located in what sector?

A FAT directory has as a logical size of:

In Windows, the file MyNote.txt is deleted from C Drive and is automatically sent to the Recycle Bin. The long filename was MyNote.txt and the short filename was MYNOTE.TXT. When viewing the Recycle Bin with EnCase, how will the long filename and MyNote.txt and the short filename was MYNOTE.TXT?

This question addresses the EnCase for Windows search process. If a target word is within a logical file, and it begins in cluster 10 and ends in cluster 15 (the word is fragmented), the search:

The EnCase signature analysis is used to perform which of the following actions?

A restored floppy diskette will have the same hash value as the original diskette.

You are examining a hard drive that has Windows XP installed as the operating system. You see a file that has a date and time in the deleted column. Where does that date and time come from?

Within EnCase, what is purpose of the default export folder?

When a file is deleted in the FAT file system, what happens to the FAT?

Which of the following would most likely be an add-in card?

In DOS and Windows, how many bytes are in one FAT directory entry?

Changing the filename of a file will change the hash value of the file.

You are an investigator and have encountered a computer that is running at the home of a suspect. The computer does not appear to be a part of a network. The operating system is Windows XP Home. No programs are visibly running. You should:

Which of the following is commonly used to encode e-mail attachments?

Within EnCase for Windows, the search process is:

4 bits allows what number of possibilities?

A hard drive has 8 sectors per cluster. File Mystuff.doc has a logical file size of 13,000 bytes. How many clusters will be used by Mystuff.doc?

The case file should be archived with the evidence files at the termination of a case.

Which of the following aspects of the EnCase evidence file can be changed during a reacquire of the evidence file?

Which of the following selections is NOT found in the case file

How many clusters can a FAT 16 system address?

In Unicode, one printed character is composed of ____ bytes of data.

This question addresses the EnCase for Windows search process. If a target word is located in the unallocated space, and the word is fragmented between clusters 10 and 15, the search:

What files are reconfigured or deleted by EnCase during the creation of an EnCase boot disk?

A suspect typed a file on his computer and saved it to a floppy diskette. The filename was MyNote.txt. You receive the floppy and the suspect computer. The suspect denies that the floppy disk belongs to him. You search the suspect computer and locate only the suspect? computer. The suspect denies that the floppy disk belongs to him. You search the suspect? computer and locate only the filename within a .LNK file. The .LNK file is located in the folder C:\Windows\Recent. How you would use the .LNK file to establish a connection between the file on the floppy diskette and the suspect computer? connection between the file on the floppy diskette and the suspect? computer?