AccessData A30-327 Exam Made Easy: Step-by-Step Preparation Guide

You successfully export and create a file hash list while using FTK Imager. Which three

pieces of information are included in this file? (Choose three.)

While analyzing unallocated space, you locate what appears to be a 64-bit Windows date and

time. Which FTK Imager feature allows you display the information as a date and time?

You examine evidence and flag several graphic images found in different folders. You now want to bookmark these items into a single bookmark. Which tab in FTK do you use to view only the flagged thumbnails?

In FTK, which tab provides specific information on the evidence items, file items, file status and file category?

Into which two categories can an imported hash set be assigned? (Choose two.)

Which two image formats contain an embedded hash value for file verification? (Choose two.)

When using FTK Imager to preview a physical drive, which number is assigned to the first logical volume of an extended partition?

In FTK, you navigate to the Graphics tab at the Case level and you do not see any graphics. What should you do to see all graphics in the case?

Which data in the Registry can the Registry Viewer translate for the user? (Choose three.)

When adding data to FTK, which statement about DriveFreeSpace is true?