A30-327 Free Practice Test

In FTK, a user may alter the alert or ignore status of individual hash sets within the active KFF. Which utility is used to accomplish this?

1. A. KFF Alert Editor
2. B. ADKFF Library Selector
3. C. Hash Database File Selector
4. D. Hash Database Recovery Engine

Correct Answer: A

What is the most effective method to facilitate successful password recovery?
Solution:


Does this meet the goal?

1. A. Yes
2. B. No

Correct Answer: A

When using Registry Viewer to view a key with 20 values, what option can be used to display only 5 of the 20 values in a report?

1. A. Report
2. B. Special Reports
3. C. Summary Report
4. D. Add to Report With Children

Correct Answer: AB
Which two options are available in the FTK Report Wizard? (Choose two.)
A. List by File Path
B. List File Properties
C. Include HTML File Listing
D. Include PRTK Output List

While analyzing unallocated space, you locate what appears to be a 64-bit Windows date and
time. Which FTK Imager feature allows you display the information as a date and time?

1. A. INFO2 Filter
2. B. Base Converter
3. C. Metadata Parser
4. D. Hex Value Interpreter

Correct Answer: D

In FTK, which two formats can be used to export an E-mail message? (Choose two.)

1. A. raw format
2. B. XML format
3. C. PDF format
4. D. HTML format
5. E. binary format

Correct Answer: AD