Guidance Software Certification Exam for EnCE Outside North America - GD0-110무료 덤프문제 풀어보기
An EnCase evidence file of a hard drive ________ be restored to another hard drive of equal or greater size.
정답: A
When a file is deleted in the FAT file system, what happens to the FAT?
정답: D
Before utilizing an analysis technique on computer evidence, the investigator should:
정답: B
The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. Jan 1 st , 2?0?00
정답: C
In Windows 2000 and XP, which of the following directories contain user personal folders? In Windows 2000 and XP, which of the following directories contain user? personal folders?
정답: A
Within EnCase, you highlight a range of data within a file. The length indicator displays the value
30. How many bytes have you actually selected?
30. How many bytes have you actually selected?
정답: B
Using good forensic practices, when seizing a computer at a business running Windows 2000 Server you should:
정답: C
The EnCase methodology dictates that the lab drive for evidence have a __________ prior to making an image.
정답: C
When an EnCase user double-clicks on a valid .jpg file, that file is:
정답: A
The MD5 hash algorithm produces a _____ number.
정답: B
A SCSI drive is pinned as a master when it is:
정답: D
If an evidence file has been added to a case and completely verified, what happens if the data area within the evidence file is later changed?
정답: C
How does EnCase verify that the case information (Case Number, Evidence Number, Investigator Name, etc) in an evidence file has not been damaged or changed, after the evidence file has been written?
정답: D
How are the results of a signature analysis examined?
정답: C
During the power-up sequence, which of the following happens first?
정답: A