[2026] AccessData Certified Examiner - A30-327 무료 시험 문제

문제1

You have processed a case in FTK using all the default options. The investigator supplies you with a list of 400 names in an electronic format. What is the quickest way to search unallocated space for all of these names?

A. use an imported text file containing the names in Indexed Search

B. build adtSearch string with all 400 names

C. make an imported text file of the names in Live Search

D. create a Regular Expression with all the names

정답: A

문제2

What are three types of evidence that can be added to a case in FTK? (Choose three.)

A. local drive

B. registry MRU list

C. contents of a folder

D. compressed volume files (CVFs)

E. acquired image of a drive

정답: A,C,E

문제3

Which two Registry Viewer operations can be conducted from FTK? (Choose two.)

A. list SAM file account names in FTK

B. createsubitems of individual keys for FTK

C. export a registry report to the FTK case report

D. view all registry files from within FTK

정답: C,D

문제4

You are converting one image file format to another using FTK Imager. Why are the hash values of the original image and the resulting new image the same?

A. because FTK Imager hashes only the data during the conversion

B. because FTK Imager verifies the amount of data converted

C. because FTK Imager's progress bar tracks the conversion

D. because FTK Imager compares the elapsed time of conversion

정답: A

문제5

In FTK, when you view the Total File Items container (rather than the Actual Files container), why are there more items than files?

A. Total File Items includes files that are in the Graphics and E-Mail tabs, while Actual Files only includes files in the Graphics tab while excluding attachments in the E-mail tab.

B. Total File Items includes all unfiltered files while Actual Files includes only checked files.

C. Total File Items includes all KFFIgnorables while Actual Files includes only the KFF Alerts.

D. Total File Items includes files that are in archive files, while Actual Files does not.

정답: D

문제6

While analyzing unallocated space, you locate what appears to be a 64-bit Windows date and time. Which FTK Imager feature allows you display the information as a date and time?

A. INFO2 Filter

B. Metadata Parser

C. Base Converter

D. Hex Value Interpreter

정답: D

AccessData Certified Examiner - A30-327무료 덤프문제 풀어보기

우리와 연락하기

유용한 링크

최신 업데이트