GD0-100 Practice Exam Questions and Answers

You are examining a hard drive that has Windows XP installed as the operating system. You see a file that has a date and time in the deleted column. Where does that date and time come from?

Hash libraries are commonly used to:

By default, EnCase will display the data from the end of a logical file, to the end of the cluster, in what color:

The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result.[\x00-\x05]\x00\x00?>[?[@?[?[?[

To undelete a file in the FAT file system, EnCase computes the number of _______ the file will use based on the file ______.

Search terms are case sensitive by default.

A SCSI drive is pinned as a master when it is:

If cluster #3552 entry in the FAT table contains a value of ?? this would mean:

When does the POST operation occur?

You are assigned to assist with the search and seizure of several computers. The magistrate ordered that the computers cannot be seized unless they are found to contain any one of ten previously identified images. You currently have the ten images in JPG format. Using the EnCase methodology, how would you best handle this situation?

When an EnCase user double-clicks on a valid .jpg file, that file is:

A restored floppy diskette will have the same hash value as the original diskette.

A case file can contain ____ hard drive images?

Within EnCase, clicking on Save on the toolbar affects what file(s)?

You are working in a computer forensic lab. A law enforcement investigator brings you a computer and a valid search warrant. You have legal authority to search the computer. The investigator hands you a piece of paper that has three printed checks on it. All three checks have the same check and account number. You image the suspect computer and open the evidence file with EnCase. You checks have the same check and account number. You image the suspect's computer and open the evidence file with EnCase. You perform a text search for the account number and check number. Nothing returns on the search results. You perform a text search for all other information found on the printed checks and there is still nothing returned in the search results. You run a signature analysis and check the gallery. You cannot locate any graphical copies of the printed checks in the gallery. At this point, is it safe to say that the checks are not located on the suspect computer?

A sector on a floppy disk is the same size as a sector on a NTFS formatted hard drive.

When a file is deleted in the FAT file system, what happens to the FAT?

The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. 800[) \-]+555-1212

An evidence file can be moved to another directory without changing the file verification.

When Unicode is selected for a search keyword, EnCase:

By default, what color does EnCase use for slack?

The following keyword was typed in exactly as shown. Choose the answer(s) that would result. All search criteria have default settings. credit card

Select the appropriate name for the highlighted area of the binary numbers.

When an EnCase user double-clicks on a file within EnCase what determines the action that will result? Select all that apply

Search terms are stored in what .ini configuration file

When a drive letter is assigned to a logical volume, that information is temporarily written the volume boot record on the hard drive.