2020 Updated AccessData A30-327 Exam Dumps 
                      
 
Acces sData
Exam A30-327
 
AccessData Certified Examiner
 
Verson: Demo
 
[ Total Questions:   10 ]
https://www.realexamcollection.com/accessdata/a30-327-dumps.html
Question No : 1
Which statement is true about Processes to Perform in FTK?
 
A. Processing options can be chosen only when adding evidence. 
B. Processing options can be chosen during or after adding evidence. 
C. Processing options can be chosen only after evidence has been added. 
D. If processing is not performed while adding evidence, the case must be started again. 
 
Answer: B
 
 
Question No : 2
In FTK, when you view the Total File Items container (rather than the Actual Files
container), why are there more items than files?
 
A. Total File Items includes files that are in archive files, while Actual Files does not. 
B. Total File Items includes all unfiltered files while Actual Files includes only checked files. 
C. Total File Items includes all KFF Ignorables while Actual Files includes only the KFF 
Alerts. 
D. Total File Items includes files that are in the Graphics and E-Mail tabs, while Actual Files 
only includes files in the Graphics tab while excluding attachments in the E-mail tab. 
 
Answer: A
 
 
Question No : 3
When using PRTK to attack encrypted files exported from a case, which statement is true?
 
A. PRTK will request the user access control list from FTK. 
B. PRTK will generate temporary copies of decrypted files for printing. 
C. FTK will stop all active jobs to allow PRTK to decrypt the exported files. 
D. File hash values will change when they are saved in their decrypted format. 
E. Additional interoperability between PRTK and NTAccess becomes available when files 
begin decrypting. 
 
Answer: D
 
 
Question No : 4
2
What are two functions of the Summary Report in Registry Viewer? (Choose two.)
 
A. adds individual key values 
B. is a template for other registry files 
C. displays investigator keyword search results 
D. permits searching of registry values based on key headers 
 
Answer: A,B
 
 
Question No : 5
In FTK, you navigate to the Graphics tab at the Case level and you do not see any
graphics. What should you do to see all graphics in the case?
 
A. list all descendants 
B. run the graphic files filter 
C. check all items in the current list 
D. select the Graphics container button 
 
Answer: A
 
 
Question No : 6
Which file should be selected to open an existing case in FTK?
 
A. ftk.exe 
B. case.ini 
C. case.dat 
D. isobuster.dll 
 
Answer: C
 
 
Question No : 7
During the execution of a search warrant, you image a suspect drive using FTK Imager and
 store the Raw(dd) image files on a portable drive. Later, these files are transferred to a
server for storage. How do you verify that the information stored on the server is unaltered?
 
 
A. open and view the Summary file 
3
B. load the image into FTK and it automatically performs file verification 
C. in FTK Imager, use the Verify Drive/Image function to automatically compare a
calculatedhash with a stored hash 
D. use FTK Imager to create a verification hash and manually compare that value to the
valuestored in the Summary file 
 
Answer: D
 
 
Question No : 8
You create two evidence images from the suspect's drive: suspect.E01 and suspect.001.
You want to be able to verify that the image hash values are the same for suspect.E01 and
 
suspect.001 image files. Which file has the hash value for the Raw (dd) image?
 
A. suspect.001.txt 
B. suspect.E01.txt 
C. suspect.001.csv 
D. suspect.E01.csv 
 
Answer: A
 
 
Question No : 9
You have processed a case in FTK using all the default options. The investigator supplies
you with a list of 400 names in an electronic format. What is the quickest way to search
 
unallocated space for all of these names?
 
A. build a dtSearch string with all 400 names 
B. create a Regular Expression with all the names 
C. make an imported text file of the names in Live Search 
D. use an imported text file containing the names in Indexed Search 
 
Answer: D
 
 
Question No : 10
You want to search for two words within five words of each other. Which search request
 
4
would accomplish this function?
 
A. apple by pear w/5 
B. June near July w/5 
C. supernova w/5 cassiopeia 
D. supernova by cassiopeia w/5 
 
Answer: C
 
 
https://www.realexamcollection.com/accessdata/a30-327-dumps.html
5