A30-327 : FTK AccessData Certified Examiner - ACE - Uma ajudinha nas perguntas da certificação em FTK - Parte 5
sexta-feira, 14 de março de 2014
Quinta parte da coleção de questões para a certificação A30-327 AccessData Certified Examiner ACE, para a ferramenta FTK, FTK Imager, PRTK e Registry Viewer.
Volto a referir que é muito importante a leitura dos manuais:
Manual FTK: http://marketing.accessdata.com/acton/attachment/4390/f-0643/1/-/-/-/-/FTK_UG.pdf
Manual FTK Imager: http://marketing.accessdata.com/acton/attachment/4390/f-000d/1/-/-/-/-/file.pdf
Manual PRTK: http://marketing.accessdata.com/acton/attachment/4390/f-0653/1/-/-/-/-/PRTK_DNA%20User%20Guide.pdf
Manual Registry Viewer: http://marketing.accessdata.com/acton/attachment/4390/f-0672/1/-/-/-/-/RegistryViewer_UG.pdf
a.Add to Report with Children
b.Export User List
c.Summary Report with WildCard
d.Add to Report
b.The resulting dictionary creates permutations of input terms
c.It helps to create an overall picture of the computer user
d.The Biographical Dictionary contains locally recovered passwords
a.2768 is the FTK item number for the newly carved graphic
b.2768 is the FTK item number of the parent item
c.The carved graphic was located at offset 2,768 within the parent item
d.The carved item is the 2,768th carved item in the FTK case
b.Filters cannot be applied to bookmarks in a report
c.An email attachment not part of the original bookmarked email can still be included.
d.Bookmarks to be included in a report must be chosen before the Report function is started
a.A TR1 expression can be run from the Index Search Tab
b.A TR1 expression can be run as a processing option during case creation
c.A TR1 expression must be run from the Live Search Tab
d.A TR1 expression can be shared via the Manage menu
a.The FTK Wordlist will also be sent with the file to be decrypted.
b.A Biographical Dictionary may be added to the attack profile after the file is sent.
c.PRTK/DNA must be running before the file is sent.
d.The default attack profile will be used for the decryption job.
Parte 1: http://e-forense.blogspot.com/2014/03/a30-327-ftk-accessdata-certified.HTML
Parte 2: http://e-forense.blogspot.com/2014/03/a30-327-ftk-accessdata-certified_11.HTML
Parte 3: http://e-forense.blogspot.com/2014/03/a30-327-ftk-accessdata-certified_12.HTML
Parte 4: http://e-forense.blogspot.com/2014/03/a30-327-ftk-accessdata-certified_13.HTML
Parte 6: http://e-forense.blogspot.com/2014/03/a30-327-ftk-accessdata-certified_28.HTML
Parte 6: http://e-forense.blogspot.com/2014/03/a30-327-ftk-accessdata-certified_28.HTML
Parte 7: http://e-forense.blogspot.com/2014/03/a30-327-ftk-accessdata-certified_6649.HTML
Parte 8: http://e-forense.blogspot.com/2014/03/q.HTML
Parte 9: http://e-forense.blogspot.com/2014/03/a30-327-ftk-accessdata-certified_31.HTML
Parte 10: http://e-forense.blogspot.com/2014/04/a30-327-ftk-accessdata-certified.HTML
Parte 11: http://e-forense.blogspot.com/2014/04/a30-327-ftk-accessdata-certified_3.html
