AccessData A30-327 - AccessData Certified Examiner Exam
Page: 2 / 12
Total 60 questions
Question #6 (Topic: )
To obtain protected files on a live machine with FTK Imager, which evidence item should
be added?
be added?
A. image file
B. currently booted drive
C. server object settings
D. profile access control list
Answer: B
Question #7 (Topic: )
What are three image file formats that can be read by FTK Imager? (Choose three.)
A. E01 files
B. raw (dd) image files
C. SafeBack version 2.2 image files
D. SafeBack version 3.0 image files
E. Symantec Ghost compressed image files
Answer: A,B,C
Question #8 (Topic: )
Which statement is true about using FTK Imager to simultaneously create multiple images
of a single source?
of a single source?
A. In the Image Creation Wizard, you should select the Add Additional Drives option.
B. You should use the Create Multiple Images option to create server image objects.
C. You should note the evidence item source signature and add it to the Image View pane.
D. In the Image Creation Wizard, you should add multiple destination jobs from the same source prior To beginning image creation.
Answer: D
Question #9 (Topic: )
FTK Imager allows a user to convert a Raw (dd) image into which two formats? (Choose
two.)
two.)
A. E01
B. Ghost
C. SMART
D. SafeBack
Answer: A,C
Question #10 (Topic: )
You are converting one image file format to another using FTK Imager. Why are the hash
values of the original image and the resulting new image the same?
values of the original image and the resulting new image the same?
A. because FTK Imager's progress bar tracks the conversion
B. because FTK Imager verifies the amount of data converted
C. because FTK Imager compares the elapsed time of conversion
D. because FTK Imager hashes only the data during the conversion
Answer: D
