GD0-110 Certification Exam for EnCE Outside North America Questions and Answers

Select the appropriate name for the highlighted area of the binary numbers.

The default export folder remains the same for all cases.

The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. [\x00-\x05]\x00\x00\x00?[\x00-\x05]\x00\x00\x00

Before utilizing an analysis technique on computer evidence, the investigator should:

Which of the following statements is more accurate?

Calls to the C:\ volume of the hard drive are not made by DOS when a computer is booted with a standard DOS 6.22 boot disk.

The EnCase methodology dictates that the lab drive for evidence have a __________ prior to making an image.

A FAT directory has as a logical size of:

Assume that MyNote.txt was allocated to clusters 5, 9, and 11. Cluster 6, 7, and 8 belong to MyResume.doc. Both files have been deleted and the directory entry in the FAT file system for MyResume.doc has been overwritten. What clusters would EnCase use to undelete MyNote.txt?

A suspect typed a file on his computer and saved it to a floppy diskette. The filename was MyNote.txt. You receive the floppy and the suspect's computer. The suspect denies that the floppy disk belongs to him. You search the suspect's computer and locate only the filename within a .LNK file. The .LNK file is located in the folder C:\Windows\Recent. How you would use the .LNK file to establish a connection between the file on the floppy diskette and the suspect computer?

The BIOS chip on an IBM clone computer is most commonly located on:

The following keyword was typed in exactly as shown. Choose the answer(s) that would result. All search criteria have default settings. Speed and Meth

Within EnCase, clicking on save on the toolbar affects what file(s)?

Which of the following would be a true statement about the function of the BIOS?

The EnCase signature analysis is used to perform which of the following actions?

The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. Bob@[a-z]+.com

The EnCase methodology dictates that ________ be created prior to acquiring evidence.

An Enhanced Metafile would best be described as:

You are investigating a case involving fraud. You seized a computer from a suspect who stated that the computer is not used by anyone other than himself. The computer has Windows 98 installed on the hard drive. You find the filename C:\downloads\check01.jpg that EnCase shows as being moved. The starting extent is 0C4057. You find another filename :\downloads\chk1.dll with the starting extent 0C4057, which EnCase also shows as being moved. In the C:\Windows\System folder you find an allocated file named chk1.dll with the starting extent 0C4057. The chk1.dll file is a JPEG image of a counterfeit check. What can be deduced from your findings?

During the power-up sequence, which of the following happens first?

Search terms are stored in what .ini configuration file?

The MD5 hash algorithm produces a _____ number.

The EnCase evidence file is best described as: