Spring Sale Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: buysanta

Exact2Pass Menu

AccessData Certified Examiner

Last Update 9 hours ago Total Questions : 60

The AccessData Certified Examiner content is now fully updated, with all current exam questions added 9 hours ago. Deciding to include A30-327 practice exam questions in your study plan goes far beyond basic test preparation.

You'll find that our A30-327 exam questions frequently feature detailed scenarios and practical problem-solving exercises that directly mirror industry challenges. Engaging with these A30-327 sample sets allows you to effectively manage your time and pace yourself, giving you the ability to finish any AccessData Certified Examiner practice test comfortably within the allotted time.

Question # 1

When adding data to FTK, which statement about DriveFreeSpace is true?

A.

DriveFreeSpace is merged with deleted files.

B.

DriveFreeSpace is segmented into 10 megabyte items.

C.

DriveFreeSpace is truncated, based on the size of the case.dat file.

D.

DriveFreeSpace is classified with file slack items in the Overview tab.

Question # 2

What are two functions of the Summary Report in Registry Viewer? (Choose two.)

A.

adds individual key values

B.

is a template for other registry files

C.

displays investigator keyword search results

D.

permits searching of registry values based on key headers

Question # 3

To obtain protected files on a live machine with FTK Imager, which evidence item should be added?

A.

image file

B.

currently booted drive

C.

server object settings

D.

profile access control list

Question # 4

While analyzing unallocated space, you locate what appears to be a 64-bit Windows date and

time. Which FTK Imager feature allows you display the information as a date and time?

A.

INFO2 Filter

B.

Base Converter

C.

Metadata Parser

D.

Hex Value Interpreter

Question # 5

In FTK, which two formats can be used to export an E-mail message? (Choose two.)

A.

raw format

B.

XML format

C.

PDF format

D.

HTML format

E.

binary format

Question # 6

You are attempting to access data from the Protected Storage System Provider (PSSP) area of a registry. How do you accomplish this using PRTK?

A.

You drop the SAM file onto the PRTK interface.

B.

You drop the NTUSER.dat file onto the PRTK interface.

C.

You use the PSSP Attack Marshal from Registry Viewer.

D.

This area can not be accessed with PRTK as it is a registry file.

Question # 7

Which three items are displayed in FTK Imager for an individual file in the Properties

window? (Choose three.)

A.

flags

B.

filename

C.

hash set

D.

timestamps

E.

item number

Question # 8

Which three items are contained in an Image Summary File using FTK Imager? (Choose

three.)

A.

MD5

B.

CRC

C.

SHA1

D.

Sector Count

E.

Cluster Count

Question # 9

How can you use FTK Imager to obtain registry files from a live system?

A.

You use the Export Files option.

B.

You use the Advanced Recovery option.

C.

Registry files cannot be exported from a live system.

D.

You use the Protected Storage System Provider option.

Question # 10

When using Registry Viewer to view a key with 20 values, what option can be used to display only 5 of the 20 values in a report?

A.

Report

B.

Special Reports

C.

Summary Report

D.

Add to Report With Children

Go to page: