Certification Exam for EnCE Outside North America (GD0-110) Practice Test

Questions # 21:

The boot partition table found at the beginning of a hard drive is located in what sector?

Options:

Volume boot record

Master boot record

Master file table

Volume boot sector

Questions # 22:

The Unicode system can address ____ characters?

Options:

256

1024

16,384

65,536

Questions # 23:

Select the appropriate name for the highlighted area of the binary numbers.

Questions # 24:

How does EnCase verify that the case information (Case Number, Evidence Number, Investigator Name, etc) in an evidence file has not been damaged or changed, after the evidence file has been written?

Options:

The .case file writes a CRC value for the case information and verifies it when the case is opened.

EnCase does not verify the case information and case information can be changed by the user as it becomes necessary.

EnCase writes a CRC value of the case information and verifies the CRC value when the evidence is added to a case.

EnCase writes an MD5 hash value for the entire evidence file, which includes the case information, and verifies the MD5 hash when the evidence is added to a case.

Questions # 25:

The case file should be archived with the evidence files at the termination of a case.

Options:

True

False

Questions # 26:

A FAT directory has as a logical size of:

Options:

0 bytes

64 bytes

128 bytes

One cluster

Questions # 27:

The maximum file segment size for an EnCase evidence file is:

Options:

500 MB

1000 MB

1500 MB

2000 MB

There is no limit.

Questions # 28:

Assume that MyNote.txt was allocated to clusters 5, 9, and 11. Cluster 6, 7, and 8 belong to MyResume.doc. Both files have been deleted and the directory entry in the FAT file system for MyResume.doc has been overwritten. What clusters would EnCase use to undelete MyNote.txt?

Options:

5,9,11

6,7,8

5,6,7

7,8,9

Questions # 29:

How are the results of a signature analysis examined?

Options:

By sorting on the signature column in the table view.

By sorting on the hash library column in the table view.

By sorting on the hash sets column in the table view

By sorting on the category column in the table view.

Questions # 30:

You are examining a hard drive that has Windows XP installed as the operating system. You see a file that has a date and time in the deleted column. Where does that date and time come from?

Options:

Inode Table

Info2 file

Directory Entry

Master File Table

Viewing page 3 out of 6 pages

Viewing questions 21-30 out of questions

Summer Certification Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = getmirror

Pass the Guidance Software EnCE GD0-110 Questions and answers with ExamsMirror

Exam GD0-110 Premium Access

Options:

Options:

Options:

Options:

Options:

Options:

Options:

Options:

Options:

Options:

TOP CODES