AccessData A30-327 Online Practice Questions and Exam Preparation

AccessData A30-327 Online Questions & Answers

• Question 1:

  When previewing a physical drive on a local machine with FTK Imager, which statement is true?

  A. FTK Imager can block calls to interrupt 13h and prevent writes to suspect media.
  B. FTK Imager can operate from a USB drive, thus preventing writes to suspect media.
  C. FTK Imager can operate via a DOS boot disk, thus preventing writes to suspect media.
  D. FTK Imager should always be used in conjunction with a hardware write protect device to prevent writes to suspect media.
  D. FTK Imager should always be used in conjunction with a hardware write protect device to prevent writes to suspect media.

• Question 2:

  You are asked to process a case using FTK and to produce a report that only includes selected graphics.

  What allows you to display only flagged graphics?

  A. List by File Path
  B. List File Properties
  C. Graphic Thumbnails
  D. Supplementary Files
  C. Graphic Thumbnails

• Question 3:

  You are converting one image file format to another using FTK Imager. Why are the hash values of the original image and the resulting new image the same?

  A. because FTK Imager's progress bar tracks the conversion
  B. because FTK Imager verifies the amount of data converted
  C. because FTK Imager compares the elapsed time of conversion
  D. because FTK Imager hashes only the data during the conversion
  D. because FTK Imager hashes only the data during the conversion

• Question 4:

  Click the Exhibit button.

  

  When decrypting EFS files in a case, you receive the result shown in the exhibit. What is the most plausible explanation for this result?

  A. The encrypted file was corrupt.
  B. A different user encrypted the remaining encrypted file.
  C. The hash value of the remaining encrypted file did not match.
  D. The remaining encrypted file had previously been bookmarked.
  E. An incorrect CRC value for the $EFS certificate was applied by the user.
  B. A different user encrypted the remaining encrypted file.

• Question 5:

  In FTK, a user may alter the alert or ignore status of individual hash sets within the active KFF. Which utility is used to accomplish this?

  A. KFF Alert Editor
  B. ADKFF Library Selector
  C. Hash Database File Selector
  D. Hash Database Recovery Engine
  A. KFF Alert Editor

• Question 6:

  You create two evidence images from the suspect's drive: suspect.E01 and suspect.001.

  You want to be able to verify that the image hash values are the same for suspect.E01 and suspect.001 image files. Which file has the hash value for the Raw (dd) image?

  A. suspect.001.txt
  B. suspect.E01.txt
  C. suspect.001.csv
  D. suspect.E01.csv
  A. suspect.001.txt

• Question 7:

  When adding data to FTK, which statement about DriveFreeSpace is true?

  A. DriveFreeSpace is merged with deleted files.
  B. DriveFreeSpace is segmented into 10 megabyte items.
  C. DriveFreeSpace is truncated, based on the size of the case.dat file.
  D. DriveFreeSpace is classified with file slack items in the Overview tab.
  D. DriveFreeSpace is classified with file slack items in the Overview tab.

• Question 8:

  When using FTK Imager to preview a physical drive, which number is assigned to the first logical volume of an extended partition?

  A. 2
  B. 3
  C. 4
  D. 5
  D. 5

• Question 9:

  You want to search for two words within five words of each other.

  Which search request would accomplish this function?

  A. apple by pear w/5
  B. June near July w/5
  C. supernova w/5cassiopeia
  D. supernova bycassiopeia w/5
  C. supernova w/5cassiopeia

• Question 10:

  Using the FTK Report Wizard, which two options are available in the List by File Path window? (Choose two.)

  A. List File Properties
  B. Export to the Report
  C. Apply a Filter to the List
  D. Include Registry Viewer Reports
  B. Export to the Report
  C. Apply a Filter to the List