GD0-100 Exam Dumps - Certification Exam For ENCE North America

Go to page:

Question # 9

Search terms are stored in what .ini configuration file

FileSignatures.ini

Keywords.ini

TextStyle.ini

FileTypes.ini

Full Access

Question # 10

The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result.[\x00-\x05]\x00\x00?>[?[@?[?[?[

FF 0000 00 00 FF BA

0000 00 01 FF FF BA

04 06 0000 00 FF FF BA

04 0000 00 FF FF BA

Full Access

Question # 11

This question addresses the EnCase for Windows search process. If a target word is located in the unallocated space, and the word is fragmented between clusters 10 and 15, the search:

Will not find it because the letters of the keyword are not contiguous.

Will not find it because EnCase performs a physical search only.

Will find it because EnCase performs a logical search.

Will not find it unlessile slack?is checked on the search dialog box. Will not find it unless ?ile slack?is checked on the search dialog box.

Full Access

Question # 12

Before utilizing an analysis technique on computer evidence, the investigator should:

Test the technique on simulated evidence in a controlled environment to confirm that the results are consistent.

Be trained in the employment of the technique.

Botha and b.

Neithera or b.

Full Access

Question # 13

The following keyword was typed in exactly as shown. Choose the answer(s) that would be found. All search criteria have default settings. Tom

Tomorrow

TomJ@hotmail.com

Tom

Stomp

Full Access

Question # 14

By default, what color does EnCase use for the contents of a logical file

Red

Red on black

Black

Black on red

Full Access

Question # 15

This question addresses the EnCase for Windows search process. If a target word is within a logical file, and it begins in cluster 10 and ends in cluster 15 (the word is fragmented), the search:

Will not find it unlessile slack is checked on the search dialog box.

Will find it because EnCase performs a logical search.

Will not find it because EnCase performs a physical search only.

Will not find it because the letters of the keyword are not contiguous.

Full Access

Question # 16

When can an evidence file containing a NTFS partition be logically restored to a FAT 32 partition?

Never

When the FAT 32 has the same number of sectors / clusters.

When the FAT 32 is the same size or bigger.

Both a and b

Full Access