Ace the Guidance Software GD0-110 Exam: Ultimate Preparation Guide

The following keyword was typed in exactly as shown. Choose the answer(s) that would be found. All search criteria have default settings. Tom

The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. Jan 1 st , 2?0?00

Two allocated files can occupy one cluster, as long as they can both fit within the allotted number of bytes.

A suspect typed a file on his computer and saved it to a floppy diskette. The filename was MyNote.txt. You receive the floppy and the suspect's computer. The suspect denies that the floppy disk belongs to him. You search the suspect's computer and locate only the filename within a .LNK file. The .LNK file is located in the folder C:\Windows\Recent. How you would use the .LNK file to establish a connection between the file on the floppy diskette and the suspect computer?

You are conducting an investigation and have encountered a computer that is running in the field. The operating system is Windows XP. A software program is currently running and is visible on the screen. You should:

When an EnCase user double-clicks on a file within EnCase what determines the action that will result?

In Windows, the file MyNote.txt is deleted from C Drive and is automatically sent to the recycle Bin. The long filename was MyNote.txt and the short filename was MYNOTE.TXT. When viewing the recycle Bin with EnCase, how will the long filename and short filename appear?

Searches and bookmarks are stored in the evidence file.

Which of the following selections would be used to keep track of a fragmented file in the FAT file system?

All investigators using EnCase should run tests on the evidence file acquisition and verification process to: