A30-327 AccessData Exam Questions and Free Practice Test

Which two statements are true? (Choose two.)

A. PRTK can recover Windows logon passwords.

B. PRTK must run in conjunction with DNA workers to decrypt EFS files.

C. PRTK and FTK must be installed on the same machine to decrypt EFS files.

D. EFS files must be exported from a case and provided to PRTK for decryption.

Correct Answer:AC

Which type of evidence can be added to FTK Imager?

A. individual files

B. all checked items

C. contents of a folder

D. all currently listed items

Correct Answer:C

What are three types of evidence that can be added to a case in FTK? (Choose three.)

A. local drive

B. registry MRU list

C. contents of a folder

D. acquired image of a drive

E. compressed volume files (CVFs)

Correct Answer:ACD

Using the FTK Report Wizard, which two options are available in the Bookmarks - A window? (Choose two.)

A. Apply a filter to the list

B. Group all filenames at end of report

C. Yes, include all graphics in the case

D. No, do not include a bookmark section

E. Export full-size graphics and link them to the thumbnails

Correct Answer:DE

START A30-327 EXAM