GD0-100 Online Practice Questions and Answers

EnCase marks a file as overwritten when _____________ has been allocated to another file.

A. all of the file

B. the starting cluster of the file

C. the directory entry for the file

D. any part of the file

To later verify the contents of an evidence file 7RODWHUYHULI\WKHFRQWHQWVRIDQHYLGHQFHILOH

A. EnCase writes a CRC value for every 64 sectors copied.

B. EnCase writes a CRC value for every 128 sectors copied.

C. EnCase writes an MD5 hash value every 64 sectors copied.

D. EnCase writes an MD5 hash value for every 32 sectors copied.

A SCSI host adapter would most likely perform which of the following tasks?

A. Configure the motherboard settings to the BIOS.

B. None of the above.

C. Set up the connection of IDE hard drives.

D. Make SCSI hard drives and other SCSI devices accessible to the operating system.

By default, what color does EnCase use for the contents of a logical file

A. Red

B. Red on black

C. Black

D. Black on red

In the EnCase environment, the term xternal viewers?is best described as: In the EnCase environment, the term ?xternal viewers?is best described as:

A. Programs that are exported out of an evidence file.

B. Any program that will work with EnCase.

C. Any program that is loaded on the lab hard drive.

D. Programsthat are associated with EnCase to open specific file types.

EnCase can build a hash set of a selected group of files.

A. True

B. False

Assume that MyNote.txt was allocated to clusters 5, 9, and 11. Cluster 6, 7, and 8 belong to MyResume.doc. Both files have been deleted and the directory entry in the FAT file system for MyResume.doc has been overwritten. What clusters would EnCase use to undelete MyNote.txt?

A. 5,9,11

B. 5,6,7

C. 7,8,9

D. 6,7,8

When a file is deleted in the FAT or NTFS file systems, what happens to the data on the hard drive?

A. Nothing.

B. It is moved to a special area.

C. It is overwritten with zeroes.

D. The file header is marked with a Sigma so the file is not recognized by the operating system.

The BIOS chip on an IBM clone computer is most commonly located on:

A. The RAM chip

B. The controller card

C. The motherboard

D. The microprocessor

The boot partition table found at the beginning of a hard drive is located in what sector?

A. Volume boot sector

B. Master boot record

C. Master file table

D. Volume boot record