AccessData ADC A30-327 Questions & Answers

• Question 41:

  In which Overview tab container are HTML files classified?

  A. Archive container

  B. Java Code container

  C. Documents container

  D. Internet Files container

  Correct Answer: C

• Question 42:

  Which two image formats contain an embedded hash value for file verification? (Choose two.)

  A. E01

  B. S01

  C. ISO

  D. CUE

  E. 001 (dd)

  Correct Answer: AB

• Question 43:

  While analyzing unallocated space, you locate what appears to be a 64-bit Windows date and time. Which FTK Imager feature allows you display the information as a date and time?

  A. INFO2 Filter

  B. Base Converter

  C. Metadata Parser

  D. Hex Value Interpreter

  Correct Answer: D

• Question 44:

  Which three items are contained in an Image Summary File using FTK Imager? (Choose three.)

  A. MD5

  B. CRC

  C. SHA1

  D. Sector Count

  E. Cluster Count

  Correct Answer: ACD

• Question 45:

  During the execution of a search warrant, you image a suspect drive using FTK Imager and store the Raw(dd) image files on a portable drive. Later, these files are transferred to a server for storage. How do you verify that the information stored on the server is unaltered?

  A. open and view the Summary file

  B. load the image into FTK and it automatically performs file verification

  C. in FTK Imager, use the Verify Drive/Image function to automatically compare a calculated hash with a stored hash

  D. use FTK Imager to create a verification hash and manually compare that value to the value stored in the Summary file

  Correct Answer: D

• Question 46:

  You successfully export and create a file hash list while using FTK Imager. Which three pieces of information are included in this file? (Choose three.)

  A. MD5

  B. SHA1

  C. filename

  D. record date

  E. date modified

  Correct Answer: ABC

• Question 47:

  You used FTK Imager to create several hash list files. You view the location where the files were exported. What is the file extension type for these files?

  A. .txt = ASCII Text File

  B. .dif = Data Interchange Format

  C. .prn = Formatted Text Delimited

  D. .csv = Comma Separated Values

  Correct Answer: D

• Question 48:

  You create two evidence images from the suspect's drive: suspect.E01 and suspect.001.

  You want to be able to verify that the image hash values are the same for suspect.E01 and suspect.001 image files. Which file has the hash value for the Raw (dd) image?

  A. suspect.001.txt

  B. suspect.E01.txt

  C. suspect.001.csv

  D. suspect.E01.csv

  Correct Answer: A

• Question 49:

  Which statement is true about using FTK Imager to export a folder and its subfolders?

  A. Exporting a folder will copy all its subfolders.

  B. Each subfolder must be exported individually.

  C. Exporting a folder copies only the folder without any files.

  D. Exporting a folder will copy all subfolders without the system attribute.

  Correct Answer: A

• Question 50:

  How can you use FTK Imager to obtain registry files from a live system?

  A. You use the Export Files option.

  B. You use the Advanced Recovery option.

  C. Registry files cannot be exported from a live system.

  D. You use the Protected Storage System Provider option.

  Correct Answer: A