Summer Special 60% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: bestdeal

Ace the Guidance Software GD0-110 Exam: Ultimate Preparation Guide

Questions 11

The following keyword was typed in exactly as shown. Choose the answer(s) that would be found. All search criteria have default settings. Tom

Options:

A.

Tomorrow

B.

Tom

C.

Stomp

D.

TomJ@hotmail.com

Buy Now
Questions 12

The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. Jan 1 st , 2?0?00

Options:

A.

Jan 1st, 1900

B.

Jan 1st, 2000

C.

Jan 1st, 2001

D.

Jan 1st, 2100

Buy Now
Questions 13

Two allocated files can occupy one cluster, as long as they can both fit within the allotted number of bytes.

Options:

A.

True

B.

False

Buy Now
Questions 14

A suspect typed a file on his computer and saved it to a floppy diskette. The filename was MyNote.txt. You receive the floppy and the suspect's computer. The suspect denies that the floppy disk belongs to him. You search the suspect's computer and locate only the filename within a .LNK file. The .LNK file is located in the folder C:\Windows\Recent. How you would use the .LNK file to establish a connection between the file on the floppy diskette and the suspect computer?

Options:

A.

The dates and time of the file found in the .LNK file, at file offset 28

B.

The full path of the file, found in the .LNK file

C.

The file signature found in the .LNK file

D.

Both a and b

Buy Now
Questions 15

You are conducting an investigation and have encountered a computer that is running in the field. The operating system is Windows XP. A software program is currently running and is visible on the screen. You should:

Options:

A.

Photograph the screen and pull the plug from the back of the computer.

B.

Navigate through the program and see what the program is all about, then pull the plug.

C.

Pull the plug from the back of the computer.

D.

Pull the plug from the wall.

Buy Now
Questions 16

When an EnCase user double-clicks on a file within EnCase what determines the action that will result?

Options:

A.

The settings in the case file.

B.

The setting in the evidence file.

C.

The settings in the FileTypes.ini file.

D.

Both a and b.

Buy Now
Questions 17

In Windows, the file MyNote.txt is deleted from C Drive and is automatically sent to the recycle Bin. The long filename was MyNote.txt and the short filename was MYNOTE.TXT. When viewing the recycle Bin with EnCase, how will the long filename and short filename appear?

Options:

A.

MyNote.del, DC0.del

B.

MyNote.txt, CD0.txt

C.

MyNote.txt, DC0.txt

D.

MyNote.del, DC1.del

Buy Now
Questions 18

Searches and bookmarks are stored in the evidence file.

Options:

A.

True

B.

False

Buy Now
Questions 19

Which of the following selections would be used to keep track of a fragmented file in the FAT file system?

Options:

A.

The File Allocation Table

B.

The directory entry for the fragmented file

C.

The partition table of extents

D.

All of the above

Buy Now
Questions 20

All investigators using EnCase should run tests on the evidence file acquisition and verification process to:

Options:

A.

Further the investigator understanding of the evidence file.

B.

Give more weight to the investigator testimony in court.

C.

Insure that the investigator is using the proper method of acquisition.

D.

All of the above.

Buy Now
Exam Code: GD0-110
Exam Name: Certification Exam for EnCE Outside North America
Last Update: Jul 19, 2024
Questions: 174

PDF + Testing Engine

$159.99
$64

Testing Engine

$119.99
$48

PDF (Q&A)

$99.99
$40