A30-327 AccessData Certified Examiner Question and Answers

FTK Imager can block calls to interrupt 13h and prevent writes to suspect media.

FTK Imager can operate from a USB drive, thus preventing writes to suspect media.

FTK Imager can operate via a DOS boot disk, thus preventing writes to suspect media.

FTK Imager should always be used in conjunction with a hardware write protect device to

prevent writes to suspect media.

the E-mail tab

the From E-mail container in the Overview tab

the Evidence Items container in the Overview tab

the E-mail Messages container in the Overview tab

open and view the Summary file

load the image into FTK and it automatically performs file verification

in FTK Imager, use the Verify Drive/Image function to automatically compare a calculated hash with a stored hash

use FTK Imager to create a verification hash and manually compare that value to the value stored in the Summary file

because FTK Imager's progress bar tracks the conversion

because FTK Imager verifies the amount of data converted

because FTK Imager compares the elapsed time of conversion

because FTK Imager hashes only the data during the conversion

image file

currently booted drive

server object settings

profile access control list

You drop the SAM file onto the PRTK interface.

You drop the NTUSER.dat file onto the PRTK interface.

You use the PSSP Attack Marshal from Registry Viewer.

This area can not be accessed with PRTK as it is a registry file.