A30-327 Online Practice Questions and Answers

You are converting one image file format to another using FTK Imager. Why are the hash values of the original image and the resulting new image the same?

A. because FTK Imager's progress bar tracks the conversion

B. because FTK Imager verifies the amount of data converted

C. because FTK Imager compares the elapsed time of conversion

D. because FTK Imager hashes only the data during the conversion

How can you use FTK Imager to obtain registry files from a live system?

A. You use the Export Files option.

B. You use the Advanced Recovery option.

C. Registry files cannot be exported from a live system.

D. You use the Protected Storage System Provider option.

Which statement is true about using FTK Imager to export a folder and its subfolders?

A. Exporting a folder will copy all its subfolders.

B. Each subfolder must be exported individually.

C. Exporting a folder copies only the folder without any files.

D. Exporting a folder will copy all subfolders without the system attribute.

While analyzing unallocated space, you locate what appears to be a 64-bit Windows date and time. Which FTK Imager feature allows you display the information as a date and time?

A. INFO2 Filter

B. Base Converter

C. Metadata Parser

D. Hex Value Interpreter

When adding data to FTK, which statement about DriveFreeSpace is true?

A. DriveFreeSpace is merged with deleted files.

B. DriveFreeSpace is segmented into 10 megabyte items.

C. DriveFreeSpace is truncated, based on the size of the case.dat file.

D. DriveFreeSpace is classified with file slack items in the Overview tab.

You want to search for two words within five words of each other.

Which search request would accomplish this function?

A. apple by pear w/5

B. June near July w/5

C. supernova w/5cassiopeia

D. supernova bycassiopeia w/5

Using the FTK Report Wizard, which two options are available in the List by File Path window? (Choose two.)

A. List File Properties

B. Export to the Report

C. Apply a Filter to the List

D. Include Registry Viewer Reports

In FTK, a user may alter the alert or ignore status of individual hash sets within the active KFF. Which utility is used to accomplish this?

A. KFF Alert Editor

B. ADKFF Library Selector

C. Hash Database File Selector

D. Hash Database Recovery Engine

Into which two categories can an imported hash set be assigned? (Choose two.)

A. alert

B. ignore

C. contraband

D. system files

What happens when a duplicate hash value is imported into a KFF database?

A. It will not be accepted.

B. It will be marked as a duplicate.

C. The database will be corrupted.

D. The database will hide the duplicate.