Amazon
Avaya
Checkpoint
Cisco®
CompTIA
CrowdStrike
EC-Council
EXIN
Fortinet
Google
ISC
ISC2
ITIL®
Juniper
Microsoft
Okta
Palo Alto Networks
Salesforce
All Vendors
  1. Home
  2. Guidance Software
  3. GD0-100

Guidance Software GD0-100 Exam (page: 7)
Guidance Software Certification Exam For ENCE North America
Updated on: 25-Dec-2025

Viewing Page 7 of 37
GD0-100 PDF 176 Questions

The case file should be archived with the evidence files at the termination of a case.

  1. True
  2. False
  3. Answer not available.

Answer(s): C



A signature analysis has been run on a case. The result "Bad Signature " means:

  1. The file signature is known and does not match a known file header.
  2. The file signature is known and the file extension is known.
  3. The file signature is known and does not match a known file extension.
  4. The file signature is unknown and the file extension is known.

Answer(s): D



A standard DOS 6.22 boot disk is acceptable for booting a suspect drive.

  1. True
  2. False
  3. Answer not available.

Answer(s): C



When can an evidence file containing a NTFS partition be logically restored to a FAT 32 partition?

  1. Never
  2. When the FAT 32 has the same number of sectors / clusters.
  3. When the FAT 32 is the same size or bigger.
  4. Both a and b

Answer(s): A



Which of the following selections would be used to keep track of a fragmented file in the FAT file system?

  1. The directory entry for the fragmented file
  2. The partition table of extents
  3. The File Allocation Table
  4. All of the above

Answer(s): C



Viewing Page 7 of 37



Share your comments for Guidance Software GD0-100 exam with other users:

Malik 9/28/2023 1:09:00 PM

nice tip and well documented
Anonymous