Guidance Software GD0-100 dumps - 100% Pass Guarantee!

You are an investigator and have encountered a computer that is running at the home of a suspect. The computer does not appear to be a part of a network. The operating system is Windows XP Home. No programs are visibly running. You should:

A. Pull the plug from the back of the computer.

B. Turn it off with the power button.

C. Pull the plug from the wall.

D. Shut it down with the start menu.

The EnCase methodology dictates that ________ be created prior to acquiring evidence.

A. a unique directory on the lab drive for case management

B. a text file for notes

C. All of the above

D. an .E01 file on the lab drive

When a non-compressed evidence file is reacquired with compression, the acquisition and verification hash values for the evidence will remain the same for both files.

A. True

B. False

Will EnCase allow a user to write data into an acquired evidence file

A. Yes, but only bookmarks.

B. Yes, but only to resize the partitions.

C. No. Data cannot be added to the evidence file after the acquisition is made.

D. Yes, but only case information.

E. No, unless the user established a writing privilege when the evidence was acquired.

You are conducting an investigation and have encountered a computer that is running in the field. The operating system is Windows XP. A software program is currently running and is visible on the screen. You should:

A. Navigate through the program and see what the program is all about, then pull the plug.

B. Pull the plug from the back of the computer.

C. Photograph the screen and pull the plug from the back of the computer.

D. Pull the plug from the wall.