Guidance Software GD0-100 Exam (page: 5)
Guidance Software Certification Exam For ENCE North America
Updated on: 25-Dec-2025

Viewing Page 5 of 37

Search terms are case sensitive by default.

  1. False
  2. True
  3. Answer not available.

Answer(s): C



The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. Jan 1st, 2?0?00

  1. Jan 1st , 1900
  2. Jan 1st , 2100
  3. Jan 1st , 2001
  4. Jan 1st , 2000

Answer(s): D



An evidence file can be moved to another directory without changing the file verification.

  1. False
  2. True

Answer(s): B



Pressing the power button on a computer that is running could have which of the following results?

  1. The computer will instantly shut off.
  2. The computer will go into stand-by mode.
  3. Nothing will happen.
  4. All of the above could happen.
  5. The operating system will shut down normally.

Answer(s): D



How does EnCase verify that the evidence file contains an exact copy of the suspect hard drive? How does
EnCase verify that the evidence file contains an exact copy of the suspect's hard drive?

  1. By means of a CRC value of the suspect hard drive compared to a CRC value of the data stored in the evidence file.By means of a CRC value of the suspect? hard drive compared to a CRC value of the data stored in the evidence file.
  2. By means of an MD5 hash of the suspect hard drive compared to an MD5 hash of the data stored in the evidence file.By means of an MD5 hash of the suspect? hard drive compared to an MD5 hash of the data stored in the evidence file.
  3. By means of a CRC value of the evidence file itself.
  4. By means of an MD5 hash value of the evidence file itself.

Answer(s): B



Viewing Page 5 of 37



Share your comments for Guidance Software GD0-100 exam with other users:

Malik 9/28/2023 1:09:00 PM

nice tip and well documented
Anonymous