AccessData A30-327 - AccessData Certified Examiner Exam
Page: 3 / 12
Total 60 questions
Question #11 (Topic: )
How can you use FTK Imager to obtain registry files from a live system?
A. You use the Export Files option.
B. You use the Advanced Recovery option.
C. Registry files cannot be exported from a live system.
D. You use the Protected Storage System Provider option.
Answer: A
Question #12 (Topic: )
Which statement is true about using FTK Imager to export a folder and its subfolders?
A. Exporting a folder will copy all its subfolders.
B. Each subfolder must be exported individually.
C. Exporting a folder copies only the folder without any files.
D. Exporting a folder will copy all subfolders without the system attribute.
Answer: A
Question #13 (Topic: )
You used FTK Imager to create several hash list files. You view the location where the files
were exported. What is the file extension type for these files?
were exported. What is the file extension type for these files?
A. .txt = ASCII Text File
B. .dif = Data Interchange Format
C. .prn = Formatted Text Delimited
D. .csv = Comma Separated Values
Answer: D
Question #14 (Topic: )
You create two evidence images from the suspect's drive: suspect.E01 and suspect.001.
You want to be able to verify that the image hash values are the same for suspect.E01 and
suspect.001 image files. Which file has the hash value for the Raw (dd) image?
You want to be able to verify that the image hash values are the same for suspect.E01 and
suspect.001 image files. Which file has the hash value for the Raw (dd) image?
A. suspect.001.txt
B. suspect.E01.txt
C. suspect.001.csv
D. suspect.E01.csv
Answer: A
Question #15 (Topic: )
You successfully export and create a file hash list while using FTK Imager. Which three
pieces of information are included in this file? (Choose three.)
pieces of information are included in this file? (Choose three.)
A. MD5
B. SHA1
C. filename
D. record date
E. date modified
Answer: A,B,C
