Guidance Software GD0-110 - Certification Exam for EnCE Outside North America Exam
Page: 2 / 35
Total 174 questions
Question #6 (Topic: Topic 0)
To undelete a file in the FAT file system, EnCase obtains the starting extent from the:
A. FAT
B. File header
C. Operating system
D. Directory entry
Answer: D
Question #7 (Topic: Topic 0)
The results of a hash analysis on an evidence file that has been added to a case will be
stored in which of the following files?
stored in which of the following files?
A. The case file
B. The configuration HashAnalysis.ini file
C. The evidence file
D. All of the above
Answer: A
Question #8 (Topic: Topic 0)
In DOS acquisition mode, if a physical drive is detected, but no partition information is
displayed, what would be the cause:
displayed, what would be the cause:
A. There are no partitions present.
B. The partition scheme is not recognized by DOS.
C. Both a and b
D. Neither a or b
Answer: C
Question #9 (Topic: Topic 0)
How many clusters can a FAT 16 system address?
A. 4,096
B. 65,536
C. 268,435,456
D. 4,294,967,296
Answer: B
Question #10 (Topic: Topic 0)
ROM is an acronym for:
A. Read Only Memory
B. Random Open Memory
C. Relative Open Memory
D. Read Open Memory
Answer: A
