GD0-110 Online Practice Questions and Answers

How many copies of the FAT are located on a FAT 32, Windows 98-formatted partition?

A. 3

B. 1

C. 4

D. 2

The signature table data is found in which of the following files?

A. The case file

B. All of the above

C. The configuration FileSignatures.ini file

D. The evidence file

ROM is an acronym for:

A. Random Open Memory

B. Read Open Memory

C. Relative Open Memory

D. Read Only Memory

A suspect typed a file on his computer and saved it to a floppy diskette. The filename was MyNote.txt. You receive the floppy and the suspect computer. The suspect denies that the floppy disk belongs to him. You search the suspect computer and locate only the suspect computer. The suspect denies that the floppy disk belongs to him. You search the suspect computer and locate only the filename within a .LNK file. The .LNK file is located in the folder C:\Windows\Recent. How you would use the .LNK file to establish a connection between the file on the floppy diskette and the suspect computer connection between the file on the floppy diskette and the suspect computer?

A. The file signature found in the .LNK file

B. The dates and time of the file found in the .LNK file, at file offset 28

C. Both a and b

D. The full path of the file, found in the .LNK file

The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. 800[) \-]+555-1212

A. 800-555 1212

B. 800.555.1212

C. 8005551212

D. (800) 555-1212

When can an evidence file containing a NTFS partition be logically restored to a FAT 32 partition?

A. Never

B. Both a and b

C. When the FAT 32 has the same number of sectors / clusters.

D. When the FAT 32 is the same size or bigger.

Search results are found in which of the following files?

A. All of the above

B. The evidence file

C. The configuration Searches.ini file

D. The case file

Save on the toolbar affects what file(s). Within EnCase, clicking on Within EnCase, clicking on saveon the toolbar affects what file(s)?

A. All of the above

B. The open case file

C. The configuration .ini files

D. The evidence files

Using good forensic practices, when seizing a computer at a business running Windows 2000 Server you should:

A. Shut it down normally.

B. Press the power button and hold it in.

C. Pull the plug from the back of the computer.

D. Pull the plug from the wall.

When a file is deleted in the FAT file system, what happens to the filename?

A. The first character of the directory entry is marked with a hex E5.

B. It is wiped from the directory.

C. It is zeroed out.

D. The first character of the directory entry is marked with a hex 00.