Weekend Special 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: sale65best

Free Guidance Software GD0-110 Practice Exam with Questions & Answers | Set: 4

Questions 31

EnCase is able to read and examine which of the following file systems?

Options:
A.

NTFS

B.

FAT

C.

EXT3

D.

HFS

Guidance Software GD0-110 Premium Access
Questions 32

The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. [\x00-\x05]\x00\x00\x00?[\x00-\x05]\x00\x00\x00

Options:
A.

00 00 00 01 FF FF BA

B.

FF 00 00 00 00 FF BA

C.

04 00 00 00 FF FF BA

D.

04 06 00 00 00 FF FF BA

Questions 33

The results of a hash analysis on an evidence file that has been added to a case will be stored in which of the following files?

Options:
A.

The case file

B.

The configuration HashAnalysis.ini file

C.

The evidence file

D.

All of the above

Questions 34

Which of the following aspects of the EnCase evidence file can be changed during a reacquire of the evidence file?

Options:
A.

The investigator name

B.

The evidence number

C.

The acquisition notes

D.

None of the above

Questions 35

What are the EnCase configuration .ini files used for?

Options:
A.

Storing information that is specific to a particular case.

B.

Storing information that will be available to EnCase each time it is opened, regardless of the active case(s).

C.

Storing pointers to acquired evidence.

D.

Storing the results of a signature analysis.

Questions 36

The MD5 hash algorithm produces a _____ number.

Options:
A.

32 bit

B.

64 bit

C.

128 bit

D.

256 bit

Questions 37

The BIOS chip on an IBM clone computer is most commonly located on:

Options:
A.

The motherboard

B.

The controller card

C.

The microprocessor

D.

The RAM chip

Questions 38

The FAT in the File Allocation Table file system keeps track of:

Options:
A.

File fragmentation

B.

Every addressable cluster on the partition

C.

Clusters marked as bad

D.

All of the above.

Questions 39

This question addresses the EnCase for Windows search process. If a target word is within a logical file, and it begins in cluster 10 and ends in cluster 15 (the word is fragmented), the search:

Options:
A.

Will not find it because the letters of the keyword are not contiguous.

B.

Will not find it unless File slack is checked on the search dialog box.

C.

Will find it because EnCase performs a logical search.

D.

Will not find it because EnCase performs a physical search only.

Questions 40

Calls to the C:\ volume of the hard drive are not made by DOS when a computer is booted with a standard DOS 6.22 boot disk.

Options:
A.

True

B.

False

Exam Code: GD0-110
Certification Provider: Guidance Software
Exam Name: Certification Exam for EnCE Outside North America
Last Update: Feb 7, 2025
Questions: 174

Guidance Software Related Exams

How to pass Guidance Software GD0-100 - Certification Exam For ENCE North America Exam

Guidance Software Free Exams

Guidance Software Free Exams
Access free Guidance Software exam study guides and practice tests at Examstrack. Ensure your success with top-notch preparation resources at Examstrack.