AccessData ADC A30-327 Questions & Answers

• Question 1:

  Which file should be selected to open an existing case in FTK?

  A. ftk.exe

  B. case.ini

  C. case.dat

  D. isobuster.dll

  Correct Answer: C

• Question 2:

  What happens when a duplicate hash value is imported into a KFF database?

  A. It will not be accepted.

  B. It will be marked as a duplicate.

  C. The database will be corrupted.

  D. The database will hide the duplicate.

  Correct Answer: A

• Question 3:

  You currently store alternate hash libraries on a remote server.

  Where do you configure FTK to access these files rather than the default library, ADKFFLibrary.hdb?

  A. Preferences

  B. User Options

  C. Analysis Tools

  D. Import KFF Hashes

  Correct Answer: A

• Question 4:

  FTK Imager can be invoked from within which program?

  A. FTK

  B. DNA

  C. PRTK

  D. Registry Viewer

  Correct Answer: A

• Question 5:

  Into which two categories can an imported hash set be assigned? (Choose two.)

  A. alert

  B. ignore

  C. contraband

  D. system files

  Correct Answer: AB

• Question 6:

  Which two Registry Viewer operations can be conducted from FTK? (Choose two.)

  A. list SAM file account names in FTK

  B. view all registry files from within FTK

  C. createsubitems of individual keys for FTK

  D. export a registry report to the FTK case report

  Correct Answer: BD

• Question 7:

  Click the Exhibit button.

  

  When decrypting EFS files in a case, you receive the result shown in the exhibit.

  What is the most plausible explanation for this result?

  A. The encrypted file was corrupt.

  B. A different user encrypted the remaining encrypted file.

  C. The hash value of the remaining encrypted file did not match.

  D. The remaining encrypted file had previously been bookmarked.

  E. An incorrect CRC value for the $EFS certificate was applied by the user.

  Correct Answer: B

• Question 8:

  Which two statements are true? (Choose two.)

  A. PRTK can recover Windows logon passwords.

  B. PRTK must run in conjunction with DNA workers to decrypt EFS files.

  C. PRTK and FTK must be installed on the same machine to decrypt EFS files.

  D. EFS files must be exported from a case and provided to PRTK for decryption.

  Correct Answer: AC

• Question 9:

  In FTK, a user may alter the alert or ignore status of individual hash sets within the active KFF. Which utility is used to accomplish this?

  A. KFF Alert Editor

  B. ADKFF Library Selector

  C. Hash Database File Selector

  D. Hash Database Recovery Engine

  Correct Answer: A

• Question 10:

  After creating a case, the Encrypted Files container lists EFS files. However, no decrypted sub- items are present. All other necessary components for EFS decryption are present in the case. Which two files must be used to recover the EFS password for use in FTK? (Choose two.)

  A. SAM

  B. system

  C. SECURITY

  D. Master Key

  E. FEK Certificate

  Correct Answer: AB