Practice Free A30-327 AccessData Certified Examiner Exam Questions Answers With Explanation

List by File Path

List File Properties

Graphic Thumbnails

Supplementary Files

You drop the SAM file onto the PRTK interface.

You drop the NTUSER.dat file onto the PRTK interface.

You use the PSSP Attack Marshal from Registry Viewer.

This area can not be accessed with PRTK as it is a registry file.

E01

Ghost

SMART

SafeBack

In the Image Creation Wizard, you should select the Add Additional Drives option.

You should use the Create Multiple Images option to create server image objects.

You should note the evidence item source signature and add it to the Image View pane.

In the Image Creation Wizard, you should add multiple destination jobs from the same

source prior To beginning image creation.

ftk.exe

case.ini

case.dat

isobuster.dll

local drive

registry MRU list

contents of a folder

acquired image of a drive

compressed volume files (CVFs)

Exporting a folder will copy all its subfolders.

Each subfolder must be exported individually.

Exporting a folder copies only the folder without any files.

Exporting a folder will copy all subfolders without the system attribute.

.txt = ASCII Text File

.dif = Data Interchange Format

.prn = Formatted Text Delimited

.csv = Comma Separated Values

SAM

system

SECURITY

Master Key

FEK Certificate

Apply a filter to the list

Group all filenames at end of report

Yes, include all graphics in the case

No, do not include a bookmark section

Export full-size graphics and link them to the thumbnails

PRTK can recover Windows logon passwords.

PRTK must run in conjunction with DNA workers to decrypt EFS files.

PRTK and FTK must be installed on the same machine to decrypt EFS files.

EFS files must be exported from a case and provided to PRTK for decryption.

flags

filename

hash set

timestamps

item number

list all descendants

run the graphic files filter

check all items in the current list

select the Graphics container button