Technology & Tools Flashcards
7 cards from real ACE practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Technology & Tools flashcards as text
In FTK, what does the 'Explicit Image Detection' (EID) processing feature do?
Answer: Uses algorithms to identify and flag potentially explicit or pornographic images for review
EID analyzes image content algorithmically to categorize images by likelihood of containing explicit material, helping examiners triage large image collections.
When FTK processes email evidence from an Outlook PST file, which artifact is most important to verify during review?
Answer: Email headers, including routing information and Message-ID fields
Email headers contain routing data, originating IP addresses, and Message-IDs that authenticate sender identity and message path.
Which concept describes using a known hash value to quickly verify a file's identity without examining its content?
Answer: Hash matching or hash verification
Hash matching compares a computed hash (MD5, SHA-1, SHA-256) against a known reference value to confirm identity or detect modification without reading the file content.
An examiner needs to search across multiple evidence images simultaneously in FTK. Which feature best supports this?
Answer: Multi-case search using FTK Enterprise or indexed search across all loaded evidence
FTK's indexed search engine processes all loaded evidence images together, enabling simultaneous keyword and criteria searches across the entire evidence set.
What is 'timeline analysis' used for in forensic examinations within FTK?
Answer: Correlating file system timestamps across evidence to reconstruct the sequence of events
Timeline analysis correlates MAC times (Modified, Accessed, Created) from the file system to build a chronological picture of activity on the suspect system.
In digital forensics, what does 'chain of custody' documentation ensure?
Answer: A verifiable, chronological record of who handled evidence, when, and under what conditions
Chain of custody logs every transfer, access, and storage condition of evidence, making it admissible in court by demonstrating it was not tampered with.
Which hashing algorithm is considered stronger and more collision-resistant for forensic purposes compared to MD5?
Answer: SHA-256
SHA-256 produces a 256-bit hash with a vastly larger output space than MD5's 128 bits, making collisions computationally infeasible with current technology.