GD0-110 Online Practice Questions and Answers

4 bits allows what number of possibilities?

B. 2

C. 4

D. 8

When an EnCase user double-clicks on a valid .jpg file, that file is:

A. Renamed to JPG_0001.jpg and copied to the default export folder.

B. Copied to the default export folder and opened by an associated program.

C. Opened by EnCase.

D. Copied to the EnCase specified temp folder and opened by an associated program.

A standard DOS 6.22 boot disk is acceptable for booting a suspect drive.

A. True

B. False

In DOS acquisition mode, if a physical drive is detected, but no partition information is displayed, what would be the cause:

A. Neither a or b

B. Both a and b

C. There are no partitions present.

D. The partition scheme is not recognized by DOS.

Assume that MyNote.txt was allocated to clusters 5, 9, and 11. Cluster 6, 7, and 8 belong to MyResume.doc. Both files have been deleted and the directory entry in the FAT file system for MyResume.doc has been overwritten.

What clusters would EnCase use to undelete MyNote.txt?

A. 7,8,9

B. 5,9,11

C. 6,7,8

D. 5,6,7

To undelete a file in the FAT file system, EnCase computes the number of the file will use based on the file .

A. Clusters; file size

B. Sectors; file size

C. Clusters; starting extent

D. Sectors; starting extent

EnCase can build a hash set of a selected group of files.

A. True

B. False

A signature analysis has been run on a case. The result !Bad Signature means:

A. The file signature is known and does not match a known file header.

B. The file signature is known and the file extension is known.

C. The file signature is known and does not match a known file extension.

D. The file signature is unknown and the file extension is known.

The following keyword was typed in exactly as shown. Choose the answer(s) that would be found. All search criteria have default settings.

A. [email protected]

B. Tomorrow

C. Tom

D. Stomp

Save on the toolbar affects what file(s). Within EnCase, clicking on Within EnCase, clicking on saveon the toolbar affects what file(s)?

A. All of the above

B. The open case file

C. The configuration .ini files

D. The evidence files

An EnCase evidence file of a hard drive be restored to another hard drive of equal or greater size.

A. cannot

B. can

RAM is tested during which phase of the power-up sequence?

A. None of the above.

B. During POST

C. After POST

D. Pre-POST

When a document is printed using EMF in Windows, what file(s) are generated in the spooling process?

A. The .SHD file

B. The .SPL file

C. Both a and b

D. Neither a or b

A signature analysis has been run on a case. The result *JPEG in the signature column means:

A. The file signature is unknown and the file extension is JPEG.

B. The file signature is unknown and the header is a JPEG.

C. The file signature is a JPEG signature and the file extension is incorrect.

D. None of the above.

EnCase can make an image of a USB flash drive.

A. True

B. False