GD0-110 Online Practice Questions and Answers

This question addresses the EnCase for Windows search process. If a target word is within a logical file, and it begins in cluster 10 and ends in cluster 15 (the word is fragmented), the search:

A. Will find it because EnCase performs a logical search.

B. Will not find it unless file slack is checked on the search dialog box. Will not find it unless file slack is checked on the search dialog box.

C. Will not find it because EnCase performs a physical search only.

D. Will not find it because the letters of the keyword are not contiguous.

You are investigating a case of child pornography on a hard drive containing Windows XP. In the : \Documents and Settings\Bad You are investigating a case of child pornography on a hard drive containing Windows XP. In the :\Documents and Settings\Bad Guy\Local Settings\Temporary Internet Files folder you find three images of child pornography. You find no other copies of the images on the suspect hard drive, and you find no other copies of the filenames. What can be deduced from your findings images on the suspect hard drive, and you find no other copies of the filenames. What can be deduced from your findings?

A. The presence and location of the images is strong evidence of possession.

B. The presence and location of the images proves the images were intentionally downloaded.

C. Both a and c

D. The presence and location of the images is not strong evidence of possession.

How does EnCase verify that the evidence file contains an exact copy of the suspect hard drive?

A. By means of a CRC value of the suspect hard drive compared to a CRC value of the data stored in the evidence file. By means of a CRC value of the suspect hard drive compared to a CRC value of the data stored in the evidence file.

B. By means of a CRC value of the evidence file itself.

C. By means of an MD5 hash of the suspect hard drive compared to an MD5 hash of the data stored in the evidence file. By means of an MD5 hash of the suspect hard drive compared to an MD5 hash of the data stored in the evidence file.

D. By means of an MD5 hash value of the evidence file itself.

Creating an image of a hard drive that was seized as evidence:

A. Should be done by the user, as they are most familiar with the hard drive.

B. May only be done by trained personnel because the process has the potential to alter the original evidence.

C. May be done by anyone because it is a relatively simple procedure.

D. May only be done by computer scientists.

Within EnCase, you highlight a range of data within a file. The length indicator displays the value 30. How many bytes have you actually selected?

A. 15

B. 30

C. 3

D. 60

A hard drive has 8 sectors per cluster. File Mystuff.doc has a logical file size of 13,000 bytes. How many clusters will be used by Mystuff.doc?

A. 4

B. 1

C. 3

D. 2

A sector on a floppy disk is the same size as a sector on a NTFS formatted hard drive.

A. True

B. False

When a document is printed using EMF in Windows, what file(s) are generated in the spooling process?

A. The .SHD file

B. The .SPL file

C. Both a and b

D. Neither a or b

In the FAT file system, the size of a deleted file can be found:

A. In the FAT

B. In the file header

C. In the file footer

D. In the directory entry

Select the appropriate name for the highlighted area of the binary numbers.

A. Nibble

B. Dword

C. Word

D. Byte

E. Bit