Foundational Concepts & Principles Flashcards
7 cards from real ACE practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Foundational Concepts & Principles flashcards as text
In FTK Imager, what format stores a forensic image along with case metadata and supports compression and encryption?
Answer: EnCase Evidence File (E01)
The E01 (Expert Witness Format) stores metadata, supports segmentation, compression, and internal hash verification alongside the image data.
What does 'file carving' mean in digital forensics?
Answer: Recovering files from unallocated space based on file signatures without relying on file system metadata
File carving identifies and extracts files from raw data streams or unallocated space by recognizing file headers and footers, bypassing the file system.
Which Windows artifact records recently accessed files and folders and is stored in the user's AppData directory?
Answer: Jump Lists and Recent Items (LNK files)
Jump Lists and LNK (shortcut) files in the user's Recent folder record recently accessed documents and applications with timestamps.
What is the 'best evidence rule' as it applies to digital forensics?
Answer: When introducing evidence, a verified forensic copy is acceptable when the original cannot be produced
The best evidence rule requires originals but allows forensic copies when a bit-for-bit duplicate with matching hashes is authenticated, making the original unnecessary.
What does the acronym 'MFT' stand for in NTFS forensics?
Answer: Master File Table
The Master File Table (MFT) is the core NTFS structure that stores metadata records for every file and directory on the volume.
Which type of analysis involves examining the logical structure and content of files rather than the physical disk sectors?
Answer: Logical analysis
Logical analysis examines files and folders as presented by the file system, focusing on content and metadata rather than raw disk sectors.
In AccessData FTK, what is a 'bookmark' used for?
Answer: Marking and annotating items of interest for inclusion in reports
Bookmarks in FTK allow investigators to flag, annotate, and organize relevant evidence items that will be referenced in the final report.