QUESTION: 61

The EnCase evidence file logical filename can be changed without affecting the verification of the acquired evidence.

True
False
Answer not available.

Answer(s): C

Reveal Solution Next Question

QUESTION: 62

In the FAT file system, the size of a deleted file can be found:

In the FAT
In the directory entry
In the file footer
In the file header

Answer(s): B

Reveal Solution Next Question

QUESTION: 63

A sector on a floppy disk is the same size as a sector on a NTFS formatted hard drive.

False
True
Answer not available.

Answer(s): C

Reveal Solution Next Question

A suspect typed a file on his computer and saved it to a floppy diskette. The filename was MyNote.txt. You receive the floppy and the suspect computer. The suspect denies that the floppy disk belongs to him. You search the suspect computer and locate only the suspect? computer. The suspect denies that the floppy disk belongs to him. You search the suspect? computer and locate only the filename within a .LNK file. The .LNK file is located in the folder C:\Windows\Recent. How you would use the .LNK file to establish a connection between the file on the floppy diskette and the suspect computer? connection between the file on the floppy diskette and the suspect? computer?

Both a and b
The dates and time of the file found in the .LNK file, at file offset 28
The full path of the file, found in the .LNK file
The file signature found in the .LNK file

Answer(s): A

Reveal Solution Next Question

Free GD0-100 Exam Braindumps (page: 16)

QUESTION: 61

QUESTION: 62

QUESTION: 63

QUESTION: 64