Certification Exam for EnCE Outside North America (GD0-110) Practice Test

Questions # 41:

In Windows 98 and ME, Internet based e-mail, such as Hotmail, will most likely be recovered in the _____________________ folder.

Options:

C:\Windows\Temp

C:\Windows\Temporary Internet files

C:\Windows\History\Email

C:\Windows\Online\Applications\email

Questions # 42:

A hard drive has 8 sectors per cluster. File Mystuff.doc has a logical file size of 13,000 bytes. How many clusters will be used by Mystuff.doc?

Options:

Questions # 43:

When a non-compressed evidence file is reacquired with compression, the acquisition and verification hash values for the evidence will remain the same for both files.

Options:

True

False

Questions # 44:

In hexadecimal notation, one byte is represented by _____ character(s).

Options:

Questions # 45:

RAM is an acronym for:

Options:

Random Access Memory

Relative Address Memory

Random Addressable Memory

Relative Addressable Memory

Questions # 46:

A hard drive has been formatted as NTFS and Windows XP was installed. The user used fdisk to remove all partitions from that drive. Nothing else was done. You have imaged the drive and have opened the evidence file with EnCase. What would be the best way to examine this hard drive?

Options:

Conduct a physical search of the hard drive and bookmark any evidence.

Use the add Partition feature to rebuild the partition and then examine the system.

Use the recovered Deleted Partitions feature and then examine the system.

EnCase will not see a drive that has been fdisked.

Questions # 47:

Search terms are case sensitive by default.

Options:

True

False

Questions # 48:

Within EnCase, clicking on save on the toolbar affects what file(s)?

Options:

The open case file

The configuration .ini files

The evidence files

All of the above

Questions # 49:

When a file is deleted in the FAT or NTFS file systems, what happens to the data on the hard drive?

Options:

It is overwritten with zeroes.

It is moved to a special area.

Nothing.

The file header is marked with a Sigma so the file is not recognized by the operating system.

Questions # 50:

The case number in an evidence file can be changed without causing the verification feature to report an error, if:

Options:

The user utilizes the case information editor within EnCase.

The evidence file is reacquired.

The user utilizes a text editor.

The case information cannot be changed in an evidence file, without causing the verification feature to report an error.

Viewing page 5 out of 6 pages

Viewing questions 41-50 out of questions

Summer Certification Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = getmirror

Pass the Guidance Software EnCE GD0-110 Questions and answers with ExamsMirror

Exam GD0-110 Premium Access

Options:

Options:

Options:

Options:

Options:

Options:

Options:

Options:

Options:

Options:

TOP CODES