A30-327 Exam Questions
58 real A30-327 exam questions with expert-verified answers and explanations. Page 2 of 2.
- Question #51Data Acquisition and Preservation
FTK Imager can be invoked from within which program?
FTK ImagerData AcquisitionForensic ToolsTool Integration - Question #52Artifact Analysis (e.g., Internet history, email, registry)
Into which two categories can an imported hash set be assigned? (Choose two.)
hash setsfile categorizationforensic filteringknown file identification - Question #53Data Acquisition and Preservation
What happens when a duplicate hash value is imported into a KFF database?
KFF databaseHash filteringDuplicate detectionData validation - Question #54Forensic Process and Best Practices
You currently store alternate hash libraries on a remote server. Where do you configure FTK to access these files rather than the default library, ADKFFLibrary.hdb?
FTK ConfigurationHash Libraries/KFFRemote File AccessPreferences Management - Question #55File System Analysis
Which three items are displayed in FTK Imager for an individual file in the Properties window? (Choose three.)
FTK ImagerFile PropertiesMetadataFile Analysis - Question #56Keyword Searching and Filtering
In FTK, which search broadening option allows you to find grammatical variations of the word "kill" such as "killer," "killed," and "killing"?
stemmingkeyword searchingFTKsearch broadening - Question #57Data Acquisition and Preservation
When using FTK Imager to preview a physical drive, which number is assigned to the first logical volume of an extended partition?
FTK ImagerPartition NumberingExtended PartitionsLogical Volumes - Question #58Forensic Process and Best Practices
When previewing a physical drive on a local machine with FTK Imager, which statement is true?
hardware write blockersevidence integrityFTK Imagerwrite protection