Virtual A30-327 Samples 2021

NEW QUESTION 1
Using the FTK Report Wizard, which two options are available in the List by File Path window? (Choose two.)

• A. List File Properties
• B. Export to the Report
• C. Apply a Filter to the List
• D. Include Registry Viewer Reports

Answer: BC

NEW QUESTION 2
You are using FTK to process e-mail files. In which two areas can E-mail attachments be located? (Choose two.)

• A. the E-mail tab
• B. the From E-mail container in the Overview tab
• C. the Evidence Items container in the Overview tab
• D. the E-mail Messages container in the Overview tab

Answer: AB

NEW QUESTION 3
While analyzing unallocated space, you locate what appears to be a 64-bit Windows date and
time. Which FTK Imager feature allows you display the information as a date and time?

• A. INFO2 Filter
• B. Base Converter
• C. Metadata Parser
• D. Hex Value Interpreter

Answer: D

NEW QUESTION 4
In FTK, which two formats can be used to export an E-mail message? (Choose two.)

• A. raw format
• B. XML format
• C. PDF format
• D. HTML format
• E. binary format

Answer: AD

NEW QUESTION 5
In FTK, which search broadening option allows you to find grammatical variations of the word "kill" such as "killer," "killed," and "killing"?

• A. Phonic
• B. Synonym
• C. Stemming
• D. Fuzzy Logic

Answer: C

NEW QUESTION 6
Which pattern does the following regular expression recover?
(d{4}[- ]){3}d{4}

• A. 000-000-0000
• B. ddd-4-3-dddd-4-3
• C. 000-00000-000-ABC
• D. 0000-0000-0000-0000

Answer: D

NEW QUESTION 7
Which statement is true about using FTK Imager to export a folder and its subfolders?

• A. Exporting a folder will copy all its subfolders.
• B. Each subfolder must be exported individually.
• C. Exporting a folder copies only the folder without any files.
• D. Exporting a folder will copy all subfolders without the system attribute.

Answer: A

NEW QUESTION 8
When previewing a physical drive on a local machine with FTK Imager, which statement is true?

• A. FTK Imager can block calls to interrupt 13h and prevent writes to suspect media.
• B. FTK Imager can operate from a USB drive, thus preventing writes to suspect media.
• C. FTK Imager can operate via a DOS boot disk, thus preventing writes to suspect media.
• D. FTK Imager should always be used in conjunction with a hardware write protect device toprevent writes to suspect media.

Answer: D

NEW QUESTION 9
Which two image formats contain an embedded hash value for file verification? (Choose two.)

• A. E01
• B. S01
• C. ISO
• D. CUE
• E. 001 (dd)

Answer: AB

NEW QUESTION 10
During the execution of a search warrant, you image a suspect drive using FTK Imager and store the Raw(dd) image files on a portable drive. Later, these files are transferred to a server for storage. How do you verify that the information stored on the server is unaltered?

• A. open and view the Summary file
• B. load the image into FTK and it automatically performs file verification
• C. in FTK Imager, use the Verify Drive/Image function to automatically compare a calculatedhash with a stored hash
• D. use FTK Imager to create a verification hash and manually compare that value to the valuestored in the Summary file

Answer: D

NEW QUESTION 11
Which two Registry Viewer operations can be conducted from FTK? (Choose two.)

• A. list SAM file account names in FTK
• B. view all registry files from within FTK
• C. create subitems of individual keys for FTK
• D. export a registry report to the FTK case report

Answer: BD

NEW QUESTION 12
Click the Exhibit button.
What change do you make to the file filter shown in the exhibit in order to show only graphics with a logical size between 500 kilobytes and 10 megabytes?

• A. You change all file status items to a red circle.
• B. You change all file status items to a yellow triangle.
• C. You make no chang
• D. The filter is correct as shown.
• E. You change Graphics in the File Type column to a yellow triangle.

Answer: D

NEW QUESTION 13
When using Registry Viewer to view a key with 20 values, what option can be used to display only 5 of the 20 values in a report?

• A. Report
• B. Special Reports
• C. Summary Report
• D. Add to Report With Children

Answer: AB

Explanation:
Which two options are available in the FTK Report Wizard? (Choose two.)
A. List by File Path
B. List File Properties
C. Include HTML File Listing
D. Include PRTK Output List

NEW QUESTION 14
You examine evidence and flag several graphic images found in different folders. You now want to bookmark these items into a single bookmark. Which tab in FTK do you use to view only the flagged thumbnails?

• A. Explore tab
• B. Graphics tab
• C. Overview tab
• D. Bookmark tab

Answer: C

NEW QUESTION 15
Which type of evidence can be added to FTK Imager?

• A. individual files
• B. all checked items
• C. contents of a folder
• D. all currently listed items

Answer: C

NEW QUESTION 16
When adding data to FTK, which statement about DriveFreeSpace is true?

• A. Mastered
• B. Not Mastered

Answer: A

NEW QUESTION 17
Into which two categories can an imported hash set be assigned? (Choose two.)

• A. alert
• B. ignore
• C. contraband
• D. system files

Answer: AB

NEW QUESTION 18
In which Overview tab container are HTML files classified?

• A. Archive container
• B. Java Code container
• C. Documents container
• D. Internet Files container

Answer: C

NEW QUESTION 19
What is the most effective method to facilitate successful password recovery?

• A. Mastered
• B. Not Mastered

Answer: A

NEW QUESTION 20
When using PRTK to attack encrypted files exported from a case, which statement is true?

• A. PRTK will request the user access control list from FTK.
• B. PRTK will generate temporary copies of decrypted files for printing.
• C. FTK will stop all active jobs to allow PRTK to decrypt the exported files.
• D. File hash values will change when they are saved in their decrypted format.
• E. Additional interoperability between PRTK and NTAccess becomes available when files begin decrypting.

Answer: D

NEW QUESTION 21
Which three items are contained in an Image Summary File using FTK Imager? (Choose three.)

• A. MD5
• B. CRC
• C. SHA1
• D. Sector Count
• E. Cluster Count

Answer: ACD

NEW QUESTION 22
Which three items are displayed in FTK Imager for an individual file in the Properties
window? (Choose three.)

• A. flags
• B. filename
• C. hash set
• D. timestamps
• E. item number

Answer: ABD

NEW QUESTION 23
You are converting one image file format to another using FTK Imager. Why are the hash values of the original image and the resulting new image the same?

• A. because FTK Imager's progress bar tracks the conversion
• B. because FTK Imager verifies the amount of data converted
• C. because FTK Imager compares the elapsed time of conversion
• D. because FTK Imager hashes only the data during the conversion

Answer: D

NEW QUESTION 24
......