AccessData ADC A30-327 Questions & Answers

• Question 21:

  In Registry Viewer, which steps initiate the Hex Interpreter?

  A. highlight the data and select the Hex Value Interpreter tab

  B. highlight the data, right-click on the highlighted data and select the Show Hex Interpreter Window

  C. select the Hex Value Interpreter tab, highlight the data, right-click on the data to initiate the Hex Interpreter

  D. right-click on the data area and select the Show Hex Interpreter Window and highlight the data you want to interpret

  Correct Answer: B

• Question 22:

  Using the FTK Report Wizard, which two options are available in the Bookmarks - A window? (Choose two.)

  A. Apply a filter to the list

  B. Group all filenames at end of report

  C. Yes, include all graphics in the case

  D. No, do not include a bookmark section

  E. Export full-size graphics and link them to the thumbnails

  Correct Answer: DE

• Question 23:

  Using the FTK Report Wizard, which two options are available in the List by File Path window? (Choose two.)

  A. List File Properties

  B. Export to the Report

  C. Apply a Filter to the List

  D. Include Registry Viewer Reports

  Correct Answer: BC

• Question 24:

  You are asked to process a case using FTK and to produce a report that only includes selected graphics. What allows you to display only flagged graphics?

  A. List by File Path

  B. List File Properties

  C. Graphic Thumbnails

  D. Supplementary Files

  Correct Answer: C

• Question 25:

  Which two options are available in the FTK Report Wizard? (Choose two.)

  A. List by File Path

  B. List File Properties

  C. Include HTML File Listing

  D. Include PRTK Output List

  Correct Answer: AB

• Question 26:

  FTK uses Data Carving to find which three file types? (Choose three.)

  A. JPEG files

  B. Yahoo! Chat Archives

  C. WPD (Word Perfect Documents)

  D. Enhanced WindowsMeta Files (EMF)

  E. OLE Archive Files (Office Documents)

  Correct Answer: ADE

• Question 27:

  Click the Exhibit button.

  

  What change do you make to the file filter shown in the exhibit in order to show only graphics with a logical size between 500 kilobytes and 10 megabytes?

  A. You change all file status items to a red circle.

  B. You change all file status items to a yellow triangle.

  C. You make no change. The filter is correct as shown.

  D. You change Graphics in the File Type column to a yellow triangle.

  Correct Answer: D

• Question 28:

  You examine evidence and flag several graphic images found in different folders. You now want to bookmark these items into a single bookmark. Which tab in FTK do you use to view only the flagged thumbnails?

  A. Explore tab

  B. Graphics tab

  C. Overview tab

  D. Bookmark tab

  Correct Answer: C

• Question 29:

  Which pattern does the following regular expression recover? (\d{4}[\- ]){3}\d{4}

  A. 000-000-0000

  B. ddd-4-3-dddd-4-3

  C. 000-00000-000-ABC

  D. 0000-0000-0000-0000

  Correct Answer: D

• Question 30:

  You have processed a case in FTK using all the default options. The investigator supplies you with a list of 400 names in an electronic format. What is the quickest way to search unallocated space for all of these names?

  A. build adtSearch string with all 400 names

  B. create a Regular Expression with all the names

  C. make an imported text file of the names in Live Search

  D. use an imported text file containing the names in Indexed Search

  Correct Answer: D