Guidance Software GD0-100 Exam Overview:
| Certification Vendor: | Guidance Software (now OpenText) |
| Exam Name: | Certification Exam For ENCE North America |
| Exam Number: | GD0-100 |
| Passing Score: | 70%–75% |
| Certificate Validity Period: | 3 years |
| Exam Format: | Multiple-choice, Scenario-based, True/false |
| Real Exam Qty: | 75–170 |
| Related Certifications: | EnCE EnCEP EnCE-A |
| Available Languages: | English |
| Exam Duration: | 90–120 |
| Exam Price: | Approx. $950–$1,050 USD |
| Recommended Training: | OpenText EnCase Official Training |
| Exam Registration: | Exam Delivery Partner Official ENCE Registration |
| Sample Questions: | Guidance Software GD0-100 Sample Questions |
| Exam Way: | Proctored: Onsite at authorized test centers or online remote proctoring |
| Pre Condition: | Basic digital forensics knowledge; recommended EnCase training and hands-on experience |
| Official Syllabus URL: | https://www.opentext.com/products/encase-forensics/certification |
Guidance Software GD0-100 Exam Syllabus Topics:
| Section | Weight | Objectives |
|---|---|---|
| Data Analysis & Investigation | 20% | - Email, registry & log analysis - Deleted file & slack space recovery - Timeline reconstruction & activity mapping |
| Reporting & Documentation | 10% | - Forensic report writing - Technical documentation & testimony preparation |
| Legal & Ethical Principles | 20% | - E-discovery & forensic standards - Privacy laws & regulatory compliance - Chain of custody & evidence admissibility |
| EnCase Software Usage | 25% | - File system analysis & artifact recovery - Case creation & configuration - Data indexing & searching |
| Evidence Preservation & Acquisition | 25% | - Write-blocking & hash verification - Forensic imaging methods - Live system & removable media acquisition |
Guidance Software Certification Exam For ENCE North America Sample Questions:
1. The first sector on a hard drive is called the
A) Master boot record
B) Volume boot record
C) Master file table
D) Volume boot sector
2. Within EnCase for Windows, the search process is
A) both a and b
B) a search of the physical disk in unallocated clusters and other unused disk areas
C) a search of the logical files
D) None of the above
3. The following GREP expression was typed in exactly as shown. Choose the Answer:(s) that would result. Bob@[a-z]+.com
A) [email protected]
B) Bob@New zealand.com
C) [email protected]
D) [email protected]
4. A hash set would most accurately be described as
A) Botha and b.
B) A table of file headers and extensions.
C) A group of hash values that can be added to the hash library.
D) A group of hash libraries organized by category.
5. CORRECT TEXT
The case file should be archived with the evidence files at the termination of a case.
A) True
B) False
Solutions:
| Question # 1 Answer: A | Question # 2 Answer: A | Question # 3 Answer: C | Question # 4 Answer: C | Question # 5 Answer: A |

We're so confident of our products that we provide no hassle product exchange.


By Greg


