Summer Certification Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = getmirror

Home
Guidance Software
EnCE
GD0-100
Certification Exam For ENCE North America Questions and Answers

Pass the Guidance Software EnCE GD0-100 Questions and answers with ExamsMirror

Practice at least 50% of the questions to maximize your chances of passing.

Exam GD0-100 Premium Access

View all detail and faqs for the GD0-100 exam

Go to Exam

821 Students Passed

94% Average Score

98% Same Questions

Viewing page 3 out of 6 pages

Viewing questions 21-30 out of questions

Questions # 21:

Within EnCase, what is purpose of the default export folder?

Options:

This is the folder that will be automatically selected when the copy/unerase feature is used.

This is the folder that will automatically store an evidence file when the acquisition is made in DOS.

This is the folder that temporarily stores all bookmark and search results.

This is the folder used to hold copies of files that are sent to external viewers.

Answer

Questions # 22:

You are an investigator and have encountered a computer that is running at the home of a suspect. The computer does not appear to be a part of a network. The operating system is Windows XP Home. No programs are visibly running. You should:

Options:

Pull the plug from the back of the computer.

Turn it off with the power button.

Pull the plug from the wall.

Shut it down with the start menu.

Answer

Questions # 23:

Within EnCase, what is the purpose of the temp folder?

Options:

This is the folder used to hold copies of files that are sent to external viewers.

This is the folder that will automatically store an evidence file when the acquisition is made in DOS.

This is the folder that temporarily stores all bookmark and search results.

This is the folder that will be automatically selected when the copy/unerase feature is used. This is the folder that will be automatically selected when the copy/unerase feature is used.

Answer

Questions # 24:

You are conducting an investigation and have encountered a computer that is running in the field. The operating system is Windows XP. A software program is currently running and is visible on the screen. You should:

Options:

Navigate through the program and see what the program is all about, then pull the plug.

Pull the plug from the back of the computer.

Photograph the screen and pull the plug from the back of the computer.

Pull the plug from the wall.

Answer

Questions # 25:

The boot partition table found at the beginning of a hard drive is located in what sector?

Options:

Volume boot sector

Master boot record

Master file table

Volume boot record

Answer

Questions # 26:

If cluster #3552 entry in the FAT table contains a value of ?? this would mean:

Options:

The cluster is unallocated

The cluster is the end of a file

The cluster is allocated

The cluster is marked bad

Answer

Questions # 27:

You are investigating a case of child pornography on a hard drive containing Windows XP. In the :\Documents and Settings\Bad You are investigating a case of child pornography on a hard drive containing Windows XP. In the C:\Documents and Settings\Bad Guy\Local Settings\Temporary Internet Files folder you find three images

of child pornography. You find no other copies of the images on the suspect hard drive, and you find no other copies of the filenames. What can be deduced from your findings?