AccessData A30-327 Exam Made Easy: Step-by-Step Preparation Guide

.txt = ASCII Text File

.dif = Data Interchange Format

.prn = Formatted Text Delimited

.csv = Comma Separated Values

Total File Items includes files that are in archive files, while Actual Files does not.

Total File Items includes all unfiltered files while Actual Files includes only checked files.

Total File Items includes all KFF Ignorables while Actual Files includes only the KFF

Alerts.

Total File Items includes files that are in the Graphics and E-Mail tabs, while Actual Files

only includes files in the Graphics tab while excluding attachments in the E-mail tab.

list SAM file account names in FTK

view all registry files from within FTK

create subitems of individual keys for FTK

export a registry report to the FTK case report

Processing options can be chosen only when adding evidence.

Processing options can be chosen during or after adding evidence.

Processing options can be chosen only after evidence has been added.

If processing is not performed while adding evidence, the case must be started again.

You change all file status items to a red circle.

You change all file status items to a yellow triangle.

You make no change. The filter is correct as shown.

You change Graphics in the File Type column to a yellow triangle.

individual files

all checked items

contents of a folder

all currently listed items

image file

currently booted drive

server object settings

profile access control list

highlight the data and select the Hex Value Interpreter tab

highlight the data, right-click on the highlighted data and select the Show Hex Interpreter

Window

select the Hex Value Interpreter tab, highlight the data, right-click on the data to initiate the

Hex Interpreter

right-click on the data area and select the Show Hex Interpreter Window and highlight the

data you want to interpret