A30-327 Practice Exam Questions and Answers

A.  

open and view the Summary file

B.  

load the image into FTK and it automatically performs file verification

C.  

in FTK Imager, use the Verify Drive/Image function to automatically compare a calculated hash with a stored hash

D.  

use FTK Imager to create a verification hash and manually compare that value to the value stored in the Summary file

A.  

list all descendants

B.  

run the graphic files filter

C.  

check all items in the current list

D.  

select the Graphics container button

A.  

highlight the data and select the Hex Value Interpreter tab

B.  

highlight the data, right-click on the highlighted data and select the Show Hex Interpreter

Window

C.  

select the Hex Value Interpreter tab, highlight the data, right-click on the data to initiate the

Hex Interpreter

D.  

right-click on the data area and select the Show Hex Interpreter Window and highlight the

data you want to interpret

A.  

MD5

B.  

CRC

C.  

SHA1

D.  

Sector Count

E.  

Cluster Count

A.  

E01 files

B.  

raw (dd) image files

C.  

SafeBack version 2.2 image files

D.  

SafeBack version 3.0 image files

E.  

Symantec Ghost compressed image files

A.  

Archive container

B.  

Java Code container

C.  

Documents container

D.  

Internet Files container

A.  

E01

B.  

S01

C.  

ISO

D.  

CUE

E.  

001 (dd)

A.  

.txt = ASCII Text File

B.  

.dif = Data Interchange Format

C.  

.prn = Formatted Text Delimited

D.  

.csv = Comma Separated Values

A.  

Total File Items includes files that are in archive files, while Actual Files does not.

B.  

Total File Items includes all unfiltered files while Actual Files includes only checked files.

C.  

Total File Items includes all KFF Ignorables while Actual Files includes only the KFF

Alerts.

D.  

Total File Items includes files that are in the Graphics and E-Mail tabs, while Actual Files

only includes files in the Graphics tab while excluding attachments in the E-mail tab.