Rebirth A30-327 Keys 2021

NEW QUESTION 1
After creating a case, the Encrypted Files container lists EFS files. However, no decrypted
sub- items are present. All other necessary components for EFS decryption are present in the case. Which two files must be used to recover the EFS password for use in FTK? (Choose two.)

• A. SAM
• B. system
• C. SECURITY
• D. Master Key
• E. FEK Certificate

Answer: AB

NEW QUESTION 2
Which statement is true about Processes to Perform in FTK?

• A. Processing options can be chosen only when adding evidence.
• B. Processing options can be chosen during or after adding evidence.
• C. Processing options can be chosen only after evidence has been added.
• D. If processing is not performed while adding evidence, the case must be started again.

Answer: B

NEW QUESTION 3
Click the Exhibit button.
When decrypting EFS files in a case, you receive the result shown in the exhibit. What is the most plausible explanation for this result?

• A. The encrypted file was corrupt.
• B. A different user encrypted the remaining encrypted file.
• C. The hash value of the remaining encrypted file did not match.
• D. The remaining encrypted file had previously been bookmarked.
• E. An incorrect CRC value for the $EFS certificate was applied by the user.

Answer: B

NEW QUESTION 4
You view a registry file in Registry Viewer. You want to create a report, which includes items that you have marked "Add to Report." Which Registry Viewer option accomplishes
this task?

• A. Common Areas
• B. Generate Report
• C. Define Summary Report
• D. Manage Summary Reports

Answer: B

NEW QUESTION 5
In FTK, you navigate to the Graphics tab at the Case level and you do not see any graphics. What should you do to see all graphics in the case?

• A. list all descendants
• B. run the graphic files filter
• C. check all items in the current list
• D. select the Graphics container button

Answer: A

NEW QUESTION 6
Which three items are displayed in FTK Imager for an individual file in the Properties
window? (Choose three.)

• A. flags
• B. filename
• C. hash set
• D. timestamps
• E. item number

Answer: ABD

NEW QUESTION 7
A. highlight the data and select the Hex Value Interpreter tab

• A. highlight the data, right-click on the highlighted data and select the Show Hex Interpreter Window
• B. select the Hex Value Interpreter tab, highlight the data, right-click on the data to initiate theHex Interpreter
• C. right-click on the data area and select the Show Hex Interpreter Window and highlight thedata you want to interpret

Answer: B

NEW QUESTION 8
When using PRTK to attack encrypted files exported from a case, which statement is true?

• A. PRTK will request the user access control list from FTK.
• B. PRTK will generate temporary copies of decrypted files for printing.
• C. FTK will stop all active jobs to allow PRTK to decrypt the exported files.
• D. File hash values will change when they are saved in their decrypted format.
• E. Additional interoperability between PRTK and NTAccess becomes available when files begin decrypting.

Answer: D

NEW QUESTION 9
Into which two categories can an imported hash set be assigned? (Choose two.)

• A. alert
• B. ignore
• C. contraband
• D. system files

Answer: AB

NEW QUESTION 10
Click the Exhibit button.
What change do you make to the file filter shown in the exhibit in order to show only graphics with a logical size between 500 kilobytes and 10 megabytes?

• A. You change all file status items to a red circle.
• B. You change all file status items to a yellow triangle.
• C. You make no chang
• D. The filter is correct as shown.
• E. You change Graphics in the File Type column to a yellow triangle.

Answer: D

NEW QUESTION 11
Which statement is true about using FTK Imager to export a folder and its subfolders?

• A. Exporting a folder will copy all its subfolders.
• B. Each subfolder must be exported individually.
• C. Exporting a folder copies only the folder without any files.
• D. Exporting a folder will copy all subfolders without the system attribute.

Answer: A

NEW QUESTION 12
A. E01 files

• A. raw (dd) image files
• B. SafeBack version 2.2 image files
• C. SafeBack version 3.0 image files
• D. Symantec Ghost compressed image files

Answer: ABC

NEW QUESTION 13
When using Registry Viewer to view a key with 20 values, what option can be used to display only 5 of the 20 values in a report?

• A. Report
• B. Special Reports
• C. Summary Report
• D. Add to Report With Children

Answer: AB

Explanation:
Which two options are available in the FTK Report Wizard? (Choose two.)
A. List by File Path
B. List File Properties
C. Include HTML File Listing
D. Include PRTK Output List

NEW QUESTION 14
You successfully export and create a file hash list while using FTK Imager. Which three pieces of information are included in this file? (Choose three.)

• A. MD5
• B. SHA1
• C. filename
• D. record date
• E. date modified

Answer: ABC

NEW QUESTION 15
FTK Imager allows a user to convert a Raw (dd) image into which two formats? (Choose two.)

• A. E01
• B. Ghost
• C. SMART
• D. SafeBack

Answer: AC

NEW QUESTION 16
In FTK, which tab provides specific information on the evidence items, file items, file status and file category?

• A. E-mail tab
• B. Explore tab
• C. Overview tab
• D. Graphics tab

Answer: C

NEW QUESTION 17
Using the FTK Report Wizard, which two options are available in the Bookmarks - A window? (Choose two.)

• A. Apply a filter to the list
• B. Group all filenames at end of report
• C. Yes, include all graphics in the case
• D. No, do not include a bookmark section
• E. Export full-size graphics and link them to the thumbnails

Answer: DE

NEW QUESTION 18
In which Overview tab container are HTML files classified?

• A. Archive container
• B. Java Code container
• C. Documents container
• D. Internet Files container

Answer: C

NEW QUESTION 19
When adding data to FTK, which statement about DriveFreeSpace is true?

• A. Mastered
• B. Not Mastered

Answer: A

NEW QUESTION 20
Which file should be selected to open an existing case in FTK?

• A. ftk.exe
• B. case.ini
• C. case.dat
• D. isobuster.dll

Answer: C

NEW QUESTION 21
You create two evidence images from the suspect's drive: suspect.E01 and suspect.001. You want to be able to verify that the image hash values are the same for suspect.E01 and
suspect.001 image files. Which file has the hash value for the Raw (dd) image?

• A. suspect.001.txt
• B. suspect.E01.txt
• C. suspect.001.csv
• D. suspect.E01.csv

Answer: A

NEW QUESTION 22
You are using FTK to process e-mail files. In which two areas can E-mail attachments be located? (Choose two.)

• A. the E-mail tab
• B. the From E-mail container in the Overview tab
• C. the Evidence Items container in the Overview tab
• D. the E-mail Messages container in the Overview tab

Answer: AB

NEW QUESTION 23
You used FTK Imager to create several hash list files. You view the location where the files were exported. What is the file extension type for these files?

• A. .txt = ASCII Text File
• B. .dif = Data Interchange Format
• C. .prn = Formatted Text Delimited
• D. .csv = Comma Separated Values

Answer: D

NEW QUESTION 24
You are asked to process a case using FTK and to produce a report that only includes selected graphics. What allows you to display only flagged graphics?

• A. List by File Path
• B. List File Properties
• C. Graphic Thumbnails
• D. Supplementary Files

Answer: C

NEW QUESTION 25
Click the Exhibit button.
You need to search for specific data that are located in a Microsoft Word document. You do not know the exact spelling of this datA. Using the Index Search Options as displayed in the exhibit, which changes do you make in the Broadening Options and Search Limiting Options containers?

• A. check the Fuzzy box;check the File Name Pattern box; type *.doc in the pattern container
• B. check the Stemming box; check the File Name Pattern box; type *.doc in the pattern container
• C. check the Synonym box; check the File Name Pattern box; type *.doc in the pattern container
• D. check the Stemming box; check the File Name Pattern box;type %.doc in the pattern container

Answer: A

NEW QUESTION 26
......