Certification Exam For ENCE North America (GD0-100) Practice Test

Questions # 41:

When Unicode is selected for a search keyword, EnCase:

Options:

Will find the keyword if it is either Unicode or ASCII.

Unicode is not a search option for EnCase.

Will only find the keyword if it is Unicode.

None of the above.

Questions # 42:

Calls to the C:\ volume of the hard drive are not made by DOS when a computer is booted with a standard DOS 6.22 boot disk.

Options:

False

True

Questions # 43:

How many copies of the FAT are located on a FAT 32, Windows 98-formatted partition?

Options:

Questions # 44:

The default export folder remains the same for all cases.

Options:

True

False

Questions # 45:

In hexadecimal notation, one byte is represented by _____ character(s).

Options:

Questions # 46:

The case file should be archived with the evidence files at the termination of a case.

Options:

True

False

Questions # 47:

Which of the following is commonly used to encode e-mail attachments?

Options:

GIF

EMF

JPEG

Base64

Questions # 48:

When a file is deleted in the FAT file system, what happens to the filename?

Options:

It is zeroed out.

The first character of the directory entry is marked with a hex 00.

It is wiped from the directory.

The first character of the directory entry is marked with a hex E5.

Questions # 49:

RAM is tested during which phase of the power-up sequence?

Options:

Pre-POST

After POST

During POST

None of the above.

Questions # 50:

You are assigned to assist with the search and seizure of several computers. The magistrate ordered that the computers cannot be seized unless they are found to contain any one of ten previously identified images. You currently have the ten images in JPG format. Using the EnCase methodology, how would you best handle this situation?

Options:

UseFastBloc or a network/parallel port cable to preview the hard drives. Go to the Gallery view and search for the previously identified images.

UseFastBloc or a network/parallel port cable to acquire forensic images of the hard drives, then search the evidence files for the previously identified images.

UseFastBloc or a network/parallel port cable to preview the hard drives. Conduct a hash analysis of the files on the hard drives, using a hash library containing the hash values of the previously identified images.

Use an EnCase DOS boot disk to conduct a text search for child porn. Use an EnCase DOS boot disk to conduct a text search for child porn?

Viewing page 5 out of 6 pages

Viewing questions 41-50 out of questions

Summer Certification Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = getmirror

Pass the Guidance Software EnCE GD0-100 Questions and answers with ExamsMirror

Exam GD0-100 Premium Access

Options:

Options:

Options:

Options:

Options:

Options:

Options:

Options:

Options:

Options:

TOP CODES