Free A30-327: AccessData Certified Examiner Exam Questions and Answers

An examiner must deliver a copy of a suspect's 250 GB drive to a colleague whose legacy analysis tool accepts only an uncompressed, bit-for-bit image with no added container header or case metadata. Which image type should the examiner select when creating the image in FTK Imager?

• AA. Raw (dd) image
• BB. AD1 custom content image
• CC. E01 image
• DD. SMART image

Which registry hive file contains local user account information, including the hashed passwords?

• AA. SOFTWARE
• BB. SYSTEM
• CC. DEFAULT
• DD. SAM

An examiner has connected a suspect's hard drive through a hardware write blocker and wants to add it to an FTK case without creating an image first. Which evidence type should be selected in the Add Evidence dialog?

• AA. Local Drive
• BB. Contents of a Folder
• CC. Individual File
• DD. Acquired Image of Drive

Which file extension does FTK Imager give to a custom content image?

• AA. .001
• BB. .E01
• CC. .S01
• DD. .AD1

A suspect reformatted a USB drive, and the examiner needs FTK to recover deleted JPEG files from unallocated space even though no file system entries remain. Which processing option should be selected?

• AA. File Signature Analysis
• BB. Data Carve
• CC. Flag Bad Extensions
• DD. Expand Compound Files

While examining an NTUSER.DAT file in Registry Viewer, an examiner opens the UserAssist key and sees a value named HRZR_EHACNGU:P:\Jvaqbjf\abgrcnq.rkr. What does this entry indicate?

• AA. Notepad was set as the default text editor for every account on the system
• BB. Notepad was installed on the system while the profile was being created
• CC. The user who owns the profile launched notepad.exe from the C:\Windows folder
• DD. A file named notepad.exe was deleted from the C:\Windows folder by the user

In PRTK, what is an attack profile?

• AA. A copy of the encrypted files that is stored with the case for later review
• BB. A list of known user names that PRTK compares with the evidence owner
• CC. A report listing every password that PRTK recovered during a session
• DD. A saved set of attacks and settings that PRTK runs in a defined order

In FTK Imager, what does the Verify Drive/Image function do with an E01 image?

• AA. Compares the image hash with a hash list loaded from the Known File Filter
• BB. Replaces the stored hash with a newly calculated hash value for the image
• CC. Recalculates the image hash and compares it with the hash stored in the image
• DD. Recalculates the hash of the original source drive and writes it to a new file

When FTK carves data, what does it use to identify files in unallocated space?

• AA. File header signatures for the selected file types
• BB. Directory entries retained by the file system
• CC. Hash values from the Known File Filter library
• DD. File extensions stored in the master file table

An examiner needs the computer name of a seized Windows machine and wants to load the correct hive file in Registry Viewer. Which file should be opened?

• AA. SYSTEM
• BB. SOFTWARE
• CC. NTUSER.DAT
• DD. SAM