A30-327 Free Practice Test

Which Registry Viewer function would allow you to automatically document multiple unknown user names?

1. A. Add to Report
2. B. Export User List
3. C. Add to Report with Children
4. D. Summary Report with Wildcard

Correct Answer: D

Which statement is true about using FTK Imager to simultaneously create multiple images of a single source?

1. A. In the Image Creation Wizard, you should select the Add Additional Drives option.
2. B. You should use the Create Multiple Images option to create server image objects.
3. C. You should note the evidence item source signature and add it to the Image View pane.
4. D. In the Image Creation Wizard, you should add multiple destination jobs from the same source prior To beginning image creation.

Correct Answer: D

In FTK, which tab provides specific information on the evidence items, file items, file status and file category?

1. A. E-mail tab
2. B. Explore tab
3. C. Overview tab
4. D. Graphics tab

Correct Answer: C

Which two statements are true? (Choose two.)

1. A. PRTK can recover Windows logon passwords.
2. B. PRTK must run in conjunction with DNA workers to decrypt EFS files.
3. C. PRTK and FTK must be installed on the same machine to decrypt EFS files.
4. D. EFS files must be exported from a case and provided to PRTK for decryption.

Correct Answer: AC

You are asked to process a case using FTK and to produce a report that only includes selected graphics. What allows you to display only flagged graphics?

1. A. List by File Path
2. B. List File Properties
3. C. Graphic Thumbnails
4. D. Supplementary Files

Correct Answer: C