All GD0-100 Test Inside Guidance Software Questions

Page: 5 / 6

Question 20

What files are reconfigured or deleted by EnCase during the creation of an EnCase boot disk?

Options:

command.com

autoexec.bat

drvspace.bin

io.sys

Question 21

How are the results of a signature analysis examined?

Options:

By sorting on the category column in the Table view. By sorting on the category column in the Table view.

By sorting on the signature column in the Table view. By sorting on the signature column in the Table view.

By sorting on the hash sets column in the Table view. By sorting on the hash sets column in the Table view.

By sorting on the hash library column in the Table view. By sorting on the hash library column in the Table view.

Question 22

How does EnCase verify that the evidence file contains an exact copy of the suspect hard drive? How does

EnCase verify that the evidence file contains an exact copy of the suspect's hard drive?

Options:

By means of a CRC value of the suspect hard drive compared to a CRC value of the data stored in the evidence file.By means of a CRC value of the suspect? hard drive compared to a CRC value of the data stored in the evidence file.

By means of an MD5 hash of the suspect hard drive compared to an MD5 hash of the data stored in the evidence file.By means of an MD5 hash of the suspect? hard drive compared to an MD5 hash of the data stored in the evidence file.

By means of a CRC value of the evidence file itself.

By means of an MD5 hash value of the evidence file itself.

Question 23

Hash libraries are commonly used to: