QUESTION: 53

Assume that MyNote.txt was allocated to clusters 5, 9, and 11. Cluster 6, 7, and 8 belong to MyResume.doc. Both files have been deleted and the directory entry in the FAT file system for MyResume.doc has been overwritten. What clusters would EnCase use to undelete MyNote.txt?

7, 8, 9
5, 9, 11
6, 7, 8
5, 6, 7

Answer(s): D

Reveal Solution Next Question

QUESTION: 54

When Unicode is selected for a search keyword, EnCase:

Will only find the keyword if it is Unicode.
None of the above.
Unicode is not a search option for EnCase.
Will find the keyword if it is either Unicode or ASCII.

Answer(s): D

Reveal Solution Next Question

QUESTION: 55

The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. 800[) \-]+555-1212

800-555 1212
800.555.1212
8005551212
(800) 555-1212

Answer(s): D

Reveal Solution Next Question

QUESTION: 56

CORRECT TEXT
When a non-compressed evidence file is reacquired with compression, the acquisition and verification hash values for the evidence will remain the same for both files.

True
False
The answer is Pending

Answer(s): C

Reveal Solution Next Question

Free GD0-110 Exam Braindumps (page: 15)

QUESTION: 53

QUESTION: 54

QUESTION: 55

QUESTION: 56

Exam Discussions & Posts