GD0-100

GD0-100 practice questions, page 7 of 7, with answer review and explanations.

Question 31

The case file should be archived with the evidence files at the termination of a case.

  1. True
  2. False

Question 32

A signature analysis has been run on a case. The result "Bad Signature " means:

  1. The file signature is known and does not match a known file header.
  2. The file signature is known and the file extension is known.
  3. The file signature is known and does not match a known file extension.
  4. The file signature is unknown and the file extension is known.

Question 33

A standard DOS 6.22 boot disk is acceptable for booting a suspect drive.

  1. True
  2. False

Question 34

When can an evidence file containing a NTFS partition be logically restored to a FAT 32 partition?

  1. Never
  2. When the FAT 32 has the same number of sectors / clusters.
  3. When the FAT 32 is the same size or bigger.
  4. Both B and C