A30-327 Online Practice Questions and Answers

What are three image file formats that can be read by FTK Imager? (Choose three.)

A. E01 files

B. raw (dd) image files

C. SafeBack version 2.2 image files

D. SafeBack version 3.0 image files

E. Symantec Ghost compressed image files

How can you use FTK Imager to obtain registry files from a live system?

A. You use the Export Files option.

B. You use the Advanced Recovery option.

C. Registry files cannot be exported from a live system.

D. You use the Protected Storage System Provider option.

While analyzing unallocated space, you locate what appears to be a 64-bit Windows date and time. Which FTK Imager feature allows you display the information as a date and time?

A. INFO2 Filter

B. Base Converter

C. Metadata Parser

D. Hex Value Interpreter

In FTK, which tab provides specific information on the evidence items, file items, file status and file category?

A. E-mail tab

B. Explore tab

C. Overview tab

D. Graphics tab

In FTK, which two formats can be used to export an E-mail message? (Choose two.)

A. raw format

B. XML format

C. PDF format

D. HTML format

E. binary format

What are three types of evidence that can be added to a case in FTK? (Choose three.)

A. local drive

B. registry MRU list

C. contents of a folder

D. acquired image of a drive

E. compressed volume files (CVFs)

FTK uses Data Carving to find which three file types? (Choose three.)

A. JPEG files

B. Yahoo! Chat Archives

C. WPD (Word Perfect Documents)

D. Enhanced WindowsMeta Files (EMF)

E. OLE Archive Files (Office Documents)

Which two Registry Viewer operations can be conducted from FTK? (Choose two.)

A. list SAM file account names in FTK

B. view all registry files from within FTK

C. createsubitems of individual keys for FTK

D. export a registry report to the FTK case report