Guidance Software GD0-110 Exam Questions

Question 6 of 173

4 bits allows what number of possibilities?

A.

16

B.

2

C.

4

D.

8

Question 7 of 173

A hard drive has been formatted as NTFS and Windows XP was installed. The user used fdisk to remove all partitions from that drive. Nothing else was done.
You have imaged the drive and have opened the evidence file with EnCase. What would be the best way to examine this hard drive?

A.

EnCase will not see a drive that has been fdisked.

B.

Use the recovered Deleted Partitions feature and then examine the system.

C.

Conduct a physical search of the hard drive and bookmark any evidence.

D.

Use the add Partition feature to rebuild the partition and then examine the system.

Question 8 of 173

For an EnCase evidence file acquired with a hash value to pass verification, which of the following must be true?

A.

Either the CRC or MD5 hash values must verify.

B.

The CRC values must verify.

C.

The CRC values and the MD5 hash value both must verify.

D.

The MD5 hash value must verify.

Question 9 of 173

Which of the following selections would be used to keep track of a fragmented file in the FAT file system?

A.

All of the above

B.

The partition table of extents

C.

The File Allocation Table

D.

The directory entry for the fragmented file

Question 10 of 173

Within EnCase for Windows, the search process is:

A.

a search of the logical files

B.

a search of the physical disk in unallocated clusters and other unused disk areas

C.

both a and b

D.

None of the above