Guidance Software Certification Exam for EnCE Outside North America - GD0-110 Exam Practice Test
The EnCase methodology dictates that the lab drive for evidence have a __________ prior to making an image.
Correct Answer: B
Vote an answer
You are working in a computer forensic lab. A law enforcement investigator brings you a computer and a valid search warrant. You have legal authority to search the computer. The investigator hands you a piece of paper that has three printed checks on it. All three checks have the same check and account number. You image the suspect computer and open the evidence file with EnCase. You checks have the same check and account number. You image the suspect? computer and open the evidence file with EnCase. You perform a text search for the account number and check number. Nothing returns on the search results. You perform a text search for all other information found on the printed checks and there is still nothing returned in the search results. You run a signature analysis and check the gallery. You cannot locate any graphical copies of the printed checks in the gallery. At this point, is it safe to say that the checks are not located on the suspect computer? checks are not located on the suspect? computer?
Correct Answer: C
Vote an answer
The maximum file segment size for an EnCase evidence file is:
Correct Answer: B
Vote an answer
An evidence file was archived onto five CD-Rom disks with the third file segment on disk number three. Can the contents of the third file segment be verified by itself while still on the CD?
Correct Answer: D
Vote an answer
Pressing the power button on a computer that is running could have which of the following results?
Correct Answer: A
Vote an answer
CORRECT TEXT
When a drive letter is assigned to a logical volume, that information is temporarily written the volume boot record on the hard drive.
When a drive letter is assigned to a logical volume, that information is temporarily written the volume boot record on the hard drive.
Correct Answer: B
Vote an answer
In the EnCase environment, the term xternal viewers?is best described as: In the EnCase environment, the term ?xternal viewers?is best described as:
Correct Answer: C
Vote an answer
Which of the following is commonly used to encode e-mail attachments?
Correct Answer: B
Vote an answer
A hard drive has 8 sectors per cluster. File Mystuff.doc has a logical file size of 13,000 bytes. How many clusters will be used by Mystuff.doc?
Correct Answer: B
Vote an answer