GD0-110 Online Practice Questions and Answers

In DOS and Windows, how many bytes are in one FAT directory entry?

A. 16

B. 8

C. 32

D. Variable

E. 64

Which of the following selections would be used to keep track of a fragmented file in the FAT file system?

A. All of the above

B. The partition table of extents

C. The File Allocation Table

D. The directory entry for the fragmented file

A case file can contain hard drive images?

A. 1

B. 5

C. 10

D. any number of

What does the acronym BIOS stand for?

A. Basic Integrated Operating System

B. Basic Input/Output System

C. Binary Input/Output System

D. Binary Integrated Operating System

What information in a FAT file system directory entry refers to the location of a file on the hard drive?

A. The starting cluster

B. The fragmentation settings

C. The file attributes

D. The file size

You are conducting an investigation and have encountered a computer that is running in the field. The operating system is Windows XP. A software program is currently running and is visible on the screen. You should:

A. Pull the plug from the wall.

B. Photograph the screen and pull the plug from the back of the computer.

C. Pull the plug from the back of the computer.

D. Navigate through the program and see what the program is all about, then pull the plug.

The default export folder remains the same for all cases.

A. True

B. False

How are the results of a signature analysis examined?

A. By sorting on the signature column in the table view.

B. By sorting on the hash library column in the table view.

C. By sorting on the hash sets column in the table view

D. By sorting on the category column in the table view.

Search terms are stored in what .ini configuration file?

A. FileTypes.ini

B. FileSignatures.ini

C. TextStyle.ini

D. Keywords.ini

EnCase uses the to conduct a signature analysis.

A. file signature table

B. hash library

C. Both a and b

D. file Viewers