A30-327 AccessData Certified Examiner Questions and Answers

List by File Path

List File Properties

Include HTML File Listing

Include PRTK Output List

list all descendants

run the graphic files filter

check all items in the current list

select the Graphics container button

PRTK can recover Windows logon passwords.

PRTK must run in conjunction with DNA workers to decrypt EFS files.

PRTK and FTK must be installed on the same machine to decrypt EFS files.

EFS files must be exported from a case and provided to PRTK for decryption.

.txt = ASCII Text File

.dif = Data Interchange Format

.prn = Formatted Text Delimited

.csv = Comma Separated Values

adds individual key values

is a template for other registry files

displays investigator keyword search results

permits searching of registry values based on key headers

You drop the SAM file onto the PRTK interface.

You drop the NTUSER.dat file onto the PRTK interface.

You use the PSSP Attack Marshal from Registry Viewer.

This area can not be accessed with PRTK as it is a registry file.