ACE Cheat Sheet 2026

The 30 highest-yield ACE facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. What is the purpose of volatility analysis in digital forensics? → Recover memory-based artifacts
2. Under HIPAA, what is the maximum civil penalty per violation category when the covered entity demonstrates willful neglect and fails to correct the violation? → $1,900,000
3. Which file system metadata attribute records the last time a file's content was modified on NTFS? → Last Written time ($STANDARD_INFORMATION)
4. International digital investigations are complicated primarily because: → Data privacy laws and mutual legal assistance treaty (MLAT) requirements vary by country
5. What is 'sparse acquisition' in the context of mobile device forensics? → Imaging only non-empty, allocated regions of storage to reduce image size
6. What does the Windows 'UserAssist' registry key track, and how is its data encoded? → GUI-based program execution history with run counts and timestamps, encoded in ROT13
7. Which FTK feature allows an examiner to index and search the full text content of files across an entire forensic image? → Full Text Index (FTI)
8. An examiner is asked by media to comment on an ongoing investigation. The appropriate response is to: → Decline and direct inquiries to the agency or attorney handling the case
9. Which file system artifact is MOST useful for proving a USB drive was connected to a Windows system even if the drive has been removed? → USBSTOR registry keys and Windows Event Log entries on the host
10. What is 'file carving' in digital forensics? → Recovering files based on file signatures without relying on file system metadata
11. When writing a forensic report, which section should describe the investigator's methodology and tools used during examination? → Examination Methodology
12. In risk management, the term 'residual risk' refers to: → The risk that remains after all controls have been applied
13. What should be the first action when a new regulation is enacted that affects your practice? → Review the regulation, assess its impact, and develop an implementation plan
14. Which of the following correctly describes the order of volatility from MOST to LEAST volatile? → CPU registers → RAM → network state → hard disk
15. Which hashing algorithm is currently recommended for verifying forensic image integrity due to its collision resistance? → SHA-256
16. In AccessData FTK, what is a 'bookmark' used for? → Marking and annotating items of interest for inclusion in reports
17. What is the role of documentation in regulatory compliance? → It provides verifiable evidence that standards are being met
18. What type of password attack attempts every possible combination of characters up to a specified length? → Brute force attack
19. During NTFS forensics in FTK, what critical information is stored in the Master File Table (MFT) that aids an investigation? → File metadata including timestamps, permissions, file names, and attribute data
20. What is the primary goal of digital forensics? → Preserve and analyze digital evidence
21. Which of the following best describes 'slack space' in digital forensics? → Space between the end of a file and the end of its last cluster
22. When analyzing Windows Event Logs in FTK, which Event ID is most significant for proving interactive user logon to a system? → Event ID 4624 with Logon Type 2 or 10
23. Which of the following best describes 'volatile data' in a forensic investigation? → Data that is lost when power is removed from a system
24. When performing a forensic acquisition, why is it important to document the hash value both before and after imaging? → To prove the forensic copy is an exact, unaltered duplicate of the original
25. Which practice best ensures consistency in forensic documentation across multiple examiners within an organization? → Adopting standardized report templates and documentation procedures
26. Which of the following best describes the 'Daubert standard' as it applies to forensic examiners? → A federal standard for admissibility of expert testimony based on scientific validity
27. In AccessData's Password Recovery Toolkit (PRTK), what is a 'dictionary attack with rules' primarily designed to do? → Apply transformations like capitalization and number substitution to dictionary words
28. What is the purpose of a forensic report? → Document findings accurately and impartially
29. What is the purpose of documenting the 'chain of custody' for digital evidence? → To track who had possession of evidence and when, ensuring its integrity
30. What is the purpose of using a Faraday bag during mobile device acquisition? → Block wireless signals to prevent remote wipe commands