GUIDANCE SOFTWARE-GD0-110 - Certification for EnCE Outside North America Set 4

Creating an image of a hard drive that was seized as evidence:

If a floppy diskette is in the a drive, the computer will always boot to that drive before any other device.

Calls to the C:\ volume of the hard drive are not made by DOS when a computer is booted with a standard DOS 6.22 boot disk.

EnCase marks a file as overwritten when _____________ has been allocated to another file.

How many clusters can a FAT 16 system address?

The FAT in the File Allocation Table file system keeps track of:

The first sector on a volume is called the:

Within EnCase, you highlight a range of data within a file. The length indicator displays the value 30. How many bytes have you actually selected?

How many partitions can be found in the boot partition table found at the beginning of the drive?

Changing the filename of a file will change the hash value of the file.