868 お客様のコメント
質問 1：
You are an investigator and have encountered a computer that is running at the home of a suspect. The computer does not appear to be a part of a network. The operating system is Windows XP Home. No programs are visibly running. You should:
A. Turn it off with the power button.
B. Pull the plug from the wall.
C. Shut it down with the start menu.
D. Pull the plug from the back of the computer.
正解：D
質問 2：
To later verify the contents of an evidence file? 7RODWHUYHULI\WKHFRQWHQWVRIDQHYLGHQFHILOH
A. EnCase writes a CRC value for every 128 sectors copied.
B. EnCase writes an MD5 hash value every 64 sectors copied.
C. EnCase writes an MD5 hash value for every 32 sectors copied.
D. EnCase writes a CRC value for every 64 sectors copied.
正解：D
質問 3：
Which is the proper formula for determining the size in bytes of a hard drive that uses cylinders (C), heads (H), and sectors (S) geometry?
A. C X H X S + 512
B. C X H + S
C. C X H X S X 512
D. C X H X S
正解：C
質問 4：
What files are reconfigured or deleted by EnCase during the creation of an EnCase boot disk?
A. drvspace.bin
B. command.com
C. autoexec.bat
D. io.sys
正解：A,B,D
質問 5：
How does EnCase verify that the case information (Case Number, Evidence Number, Investigator Name, etc) in an evidence file has not been damaged or changed, after the evidence file has been written?
A. EnCase writes an MD5 hash value for the entire evidence file, which includes the case information, and verifies the MD5 hash when the evidence is added to a case.
B. EnCase writes a CRC value of the case information and verifies the CRC value when the evidence is added to a case.
C. EnCase does not verify the case information and case information can be changed by the user as it becomes necessary.
D. The .case file writes a CRC value for the case information and verifies it when the case is opened.
正解：B
質問 6：
RAM is an acronym for:
A. Random Addressable Memory
B. Relative Addressable Memory
C. Relative Address Memory
D. Random Access Memory
正解：D
You are an investigator and have encountered a computer that is running at the home of a suspect. The computer does not appear to be a part of a network. The operating system is Windows XP Home. No programs are visibly running. You should:
A. Turn it off with the power button.
B. Pull the plug from the wall.
C. Shut it down with the start menu.
D. Pull the plug from the back of the computer.
正解：D
質問 2：
To later verify the contents of an evidence file? 7RODWHUYHULI\WKHFRQWHQWVRIDQHYLGHQFHILOH
A. EnCase writes a CRC value for every 128 sectors copied.
B. EnCase writes an MD5 hash value every 64 sectors copied.
C. EnCase writes an MD5 hash value for every 32 sectors copied.
D. EnCase writes a CRC value for every 64 sectors copied.
正解：D
質問 3：
Which is the proper formula for determining the size in bytes of a hard drive that uses cylinders (C), heads (H), and sectors (S) geometry?
A. C X H X S + 512
B. C X H + S
C. C X H X S X 512
D. C X H X S
正解：C
質問 4：
What files are reconfigured or deleted by EnCase during the creation of an EnCase boot disk?
A. drvspace.bin
B. command.com
C. autoexec.bat
D. io.sys
正解：A,B,D
質問 5：
How does EnCase verify that the case information (Case Number, Evidence Number, Investigator Name, etc) in an evidence file has not been damaged or changed, after the evidence file has been written?
A. EnCase writes an MD5 hash value for the entire evidence file, which includes the case information, and verifies the MD5 hash when the evidence is added to a case.
B. EnCase writes a CRC value of the case information and verifies the CRC value when the evidence is added to a case.
C. EnCase does not verify the case information and case information can be changed by the user as it becomes necessary.
D. The .case file writes a CRC value for the case information and verifies it when the case is opened.
正解：B
質問 6：
RAM is an acronym for:
A. Random Addressable Memory
B. Relative Addressable Memory
C. Relative Address Memory
D. Random Access Memory
正解：D
Hoshino -
GD0-110ソフトバージョンをダウンロードできるのも非常にありがたいです。確実にGD0-110勉強したいかたにおすすめです。