A30-327 Exam Dumps - AccessData Certification Questions and Answers

PRTK can recover Windows logon passwords.

PRTK must run in conjunction with DNA workers to decrypt EFS files.

PRTK and FTK must be installed on the same machine to decrypt EFS files.

EFS files must be exported from a case and provided to PRTK for decryption.

DriveFreeSpace is merged with deleted files.

DriveFreeSpace is segmented into 10 megabyte items.

DriveFreeSpace is truncated, based on the size of the case.dat file.

DriveFreeSpace is classified with file slack items in the Overview tab.

Preferences

User Options

Analysis Tools

Import KFF Hashes

dictionary attack

key space attack

brute-force attack

rainbow table attack

Apply a filter to the list

Group all filenames at end of report

Yes, include all graphics in the case

No, do not include a bookmark section

Export full-size graphics and link them to the thumbnails

Processing options can be chosen only when adding evidence.

Processing options can be chosen during or after adding evidence.

Processing options can be chosen only after evidence has been added.

If processing is not performed while adding evidence, the case must be started again.

Add to Report

Export User List

Add to Report with Children

Summary Report with Wildcard

2

3

4

5

You drop the SAM file onto the PRTK interface.

You drop the NTUSER.dat file onto the PRTK interface.

You use the PSSP Attack Marshal from Registry Viewer.

This area can not be accessed with PRTK as it is a registry file.