ACE File System & Artifact Analysis Flashcards

What primary structure does NTFS use to track every file and directory on a volume?

Answer: Master File Table (MFT)

NTFS uses the Master File Table (MFT) as the primary structure for recording metadata about every file and directory on the volume.

In FTK, what does the 'Bookmarks' feature allow an examiner to do?

Answer: Tag and annotate specific evidence items for later reference

FTK's Bookmarks feature lets examiners flag and annotate items of interest for organized review and inclusion in reports.

Which MAC timestamp records the last time a file's content was changed in NTFS?

Answer: Modified time

The Modified timestamp in NTFS records the last time the file's data content was written or changed.

What is 'file carving' in digital forensics?

Answer: Recovering files based on file signatures without relying on file system metadata

File carving recovers files by identifying known file headers and footers in raw data when file system metadata is missing or overwritten.

In FTK, what does the 'Evidence Tree' panel display?

Answer: A hierarchical view of all added evidence sources and their file system contents

FTK's Evidence Tree provides a hierarchical navigation view of all added evidence items, mirroring the folder structure found within each source.

What is 'slack space' in digital forensics?

Answer: The unused area between the logical end of a file and the physical end of its last allocated cluster

Slack space is the residual area from where a file's data ends to the physical boundary of the last allocated storage cluster, which can contain remnants of previous data.