GD0-110 무료 덤프문제 온라인 액세스

CORRECT TEXT
The EnCase evidence file logical filename can be changed without affecting the verification of the acquired evidence.

• A.False
• B.True

When undeleting a file in the FAT file system, EnCase will check the _____________ to see if it has already been overwritten.

• A.data on the hard drive
• B.FAT
• C.directory entry
• D.deletion table

The EnCase case file can be best described as:

• A.None of the above.
• B.A file that contains information specific to one case.
• C.A file contain configuration settings for cases.
• D.The file that runs EnCase for Windows.

If a hash analysis is run on a case, EnCase:

• A.Will create a hash set to the user specifications. Will create a hash set to the user? specifications.
• B.Will compare the hash value of the files in the case to the hash library.
• C.Will generate a hash set for every file in the case.
• D.Will compute a hash value of the evidence file and begin a verification process.

Creating an image of a hard drive that was seized as evidence:

• A.Should be done by the user, as they are most familiar with the hard drive.
• B.May only be done by computer scientists.
• C.May only be done by trained personnel because the process has the potential to alter the original evidence.
• D.May be done by anyone because it is a relatively simple procedure.