Guidance Software GD0-100 Exam (page: 6)
Guidance Software Certification Exam For ENCE North America
Updated on: 25-Dec-2025

Viewing Page 6 of 37

By default, EnCase will display the data from the end of a logical file, to the end of the cluster, in what color:

  1. Red
  2. Red on black
  3. Black on red
  4. Black

Answer(s): A



A SCSI drive is pinned as a master when it is:

  1. The only drive on the computer.
  2. The primary of two drives connected to one cable.
  3. Whenever another drive is on the same cable and is pinned as a slave.
  4. A SCSI drive is not pinned as a master.

Answer(s): D



The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. [^a-z] Tom[^a-z]

  1. Tomato
  2. om? ? RP
  3. Toms
  4. Stomp

Answer(s): B



This question addresses the EnCase for Windows search process. If a target word is within a logical file, and it begins in cluster 10 and ends in cluster 15 (the word is fragmented), the search:

  1. Will not find it unlessile slack is checked on the search dialog box.
  2. Will find it because EnCase performs a logical search.
  3. Will not find it because EnCase performs a physical search only.
  4. Will not find it because the letters of the keyword are not contiguous.

Answer(s): B



An evidence file was archived onto five CD-Rom disks with the third file segment on disk number three. Can the contents of the third file segment be verified by itself while still on the CD?

  1. No. Archived files are compressed and cannot be verified until un-archived.
  2. No. All file segments must be put back together.
  3. Yes. Any segment of an evidence file can be verified through re-computing and comparing the CRCs, even if it is on a CD.
  4. No. EnCase cannot verify files on CDs.

Answer(s): C



Viewing Page 6 of 37



Share your comments for Guidance Software GD0-100 exam with other users:

Malik 9/28/2023 1:09:00 PM

nice tip and well documented
Anonymous