GD0-110

GD0-110 practice questions, page 7 of 7, with answer review and explanations.

Question 31

In the EnCase environment, the term external viewers is best described as?

  1. Programs that are exported out of an evidence file.
  2. Programs that are associated with EnCase to open specific file types.
  3. Any program that will work with EnCase.
  4. Any program that is loaded on the lab hard drive.

Question 32

A restored floppy diskette will have the same hash value as the original diskette.

  1. True
  2. False

Question 33

This question addresses the EnCase for Windows search process. If a target word is within a logical file, and it begins in cluster 10 and ends in cluster 15 (the word is fragmented), the search:

  1. Will find it because EnCase performs a logical search.
  2. Will not find it unless slack is checked on the search dialog box.
  3. Will not find it because EnCase performs a physical search only.
  4. Will not find it because the letters of the keyword are not contiguous.

Question 34

By default, EnCase will display the data from the end of a logical file, to the end of the cluster, in what color:

  1. Red
  2. Black
  3. Red on black
  4. Black on red