A30-327 Exam Dumps - AccessData Certified Examiner

Question # 4

In FTK, when you view the Total File Items container (rather than the Actual Files container), why are there more items than files?

Total File Items includes files that are in archive files, while Actual Files does not.

Total File Items includes all unfiltered files while Actual Files includes only checked files.

Total File Items includes all KFF Ignorables while Actual Files includes only the KFF

Alerts.

Total File Items includes files that are in the Graphics and E-Mail tabs, while Actual Files

only includes files in the Graphics tab while excluding attachments in the E-mail tab.

Full Access

Question # 5

When using Registry Viewer to view a key with 20 values, what option can be used to display only 5 of the 20 values in a report?

Report

Special Reports

Summary Report

Add to Report With Children

Full Access

Question # 6

Which pattern does the following regular expression recover?

(\d{4}[\- ]){3}\d{4}

000-000-0000

ddd-4-3-dddd-4-3

000-00000-000-ABC

0000-0000-0000-0000

Full Access

Question # 7

Which two options are available in the FTK Report Wizard? (Choose two.)

List by File Path

List File Properties

Include HTML File Listing

Include PRTK Output List

Full Access

Question # 8

You have processed a case in FTK using all the default options. The investigator supplies you with a list of 400 names in an electronic format. What is the quickest way to search

unallocated space for all of these names?

build a dtSearch string with all 400 names

create a Regular Expression with all the names

make an imported text file of the names in Live Search

use an imported text file containing the names in Indexed Search

Full Access

Question # 9

You examine evidence and flag several graphic images found in different folders. You now want to bookmark these items into a single bookmark. Which tab in FTK do you use to view only the flagged thumbnails?

Explore tab

Graphics tab

Overview tab

Bookmark tab

Full Access