Free A30-327: AccessData Certified Examiner Exam Questions and Answers

Last updated: September 19, 2026

Exam code

A30-327

Provider

AccessData

Questions in our bank

1000+

Free to read

First 10, with answers

Our test mode duration & pass mark

130 mins · 70%

Verified answers

Reviewed weekly

Recommended: Switch to Test Mode to start a practice test that simulates the real exam experience.

1. Question #1

   You successfully export and create a file hash list while using FTK Imager. Which three pieces of information are included in this file? (Choose three.)

   Select 3 answers.

   • A. MD5
   • B. SHA1
   • C. filename
   • D. record date
   • E. date modified
   Reveal Answer

2. Question #2

   Which statement is true about using FTK Imager to export a folder and its subfolders?

   • A. Exporting a folder will copy all its subfolders.
   • B. Each subfolder must be exported individually.
   • C. Exporting a folder copies only the folder without any files.
   • D. Exporting a folder will copy all subfolders without the system attribute.
   Reveal Answer

3. Question #3

   During the execution of a search warrant, you image a suspect drive using FTK Imager and store the Raw(dd) image files on a portable drive. Later, these files are transferred to a server for storage. How do you verify that the information stored on the server is unaltered?

   • A. open and view the Summary file
   • B. load the image into FTK and it automatically performs file verification
   • C. in FTK Imager, use the Verify Drive/Image function to automatically compare a calculated hash with a stored hash
   • D. use FTK Imager to create a verification hash and manually compare that value to the value stored in the Summary file
   Reveal Answer

4. Question #4

   When using PRTK to attack encrypted files exported from a case, which statement is true?

   • A. PRTK will request the user access control list from FTK.
   • B. PRTK will generate temporary copies of decrypted files for printing.
   • C. FTK will stop all active jobs to allow PRTK to decrypt the exported files.
   • D. File hash values will change when they are saved in their decrypted format.
   • E. Additional interoperability between PRTK and NTAccess becomes available when files begin decrypting.
   Reveal Answer

5. Question #5

   Which two Registry Viewer operations can be conducted from FTK? (Choose two.)

   Select 2 answers.

   • A. list SAM file account names in FTK
   • B. view all registry files from within FTK
   • C. create subitems of individual keys for FTK
   • D. export a registry report to the FTK case report
   Reveal Answer

6. Question #6

   Which three items are displayed in FTK Imager for an individual file in the Properties window? (Choose three.)

   Select 3 answers.

   • A. flags
   • B. filename
   • C. hash set
   • D. timestamps
   • E. item number
   Reveal Answer

7. Question #7

   FTK Imager allows a user to convert a Raw (dd) image into which two formats? (Choose two.)

   Select 2 answers.

   • A. E01
   • B. Ghost
   • C. SMART
   • D. SafeBack
   Reveal Answer

8. Question #8

   When previewing a physical drive on a local machine with FTK Imager, which statement is true?

   • A. FTK Imager can block calls to interrupt 13h and prevent writes to suspect media.
   • B. FTK Imager can operate from a USB drive, thus preventing writes to suspect media.
   • C. FTK Imager can operate via a DOS boot disk, thus preventing writes to suspect media.
   • D. FTK Imager should always be used in conjunction with a hardware write protect device to prevent writes to suspect media.
   Reveal Answer

9. Question #9

   In FTK, when you view the Total File Items container (rather than the Actual Files container), why are there more items than files?

   • A. Total File Items includes files that are in archive files, while Actual Files does not.
   • B. Total File Items includes all unfiltered files while Actual Files includes only checked files.
   • C. Total File Items includes all KFF Ignorables while Actual Files includes only the KFF Alerts.
   • D. Total File Items includes files that are in the Graphics and E-Mail tabs, while Actual Files only includes files in the Graphics tab while excluding attachments in the E-mail tab.
   Reveal Answer

10. Question #10

    In which Overview tab container are HTML files classified?

    • A. Archive container
    • B. Java Code container
    • C. Documents container
    • D. Internet Files container
    Reveal Answer