Tool Proficiency & Analysis Techniques Flashcards
7 cards from real ACE practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Tool Proficiency & Analysis Techniques flashcards as text
In FTK, what does the 'Explicit Images' filter rely on to categorize photos without manual review?
Answer: Skin-tone pixel percentage analysis via integrated AI scoring
FTK's explicit image detection uses skin-tone pixel analysis combined with AI scoring to flag potentially explicit images for examiner review.
When using FTK Imager to create a logical image of a live Windows system, which artifact is MOST likely to be captured that a physical image of the powered-off drive would miss?
Answer: Currently running process memory
A logical image of a live system can capture currently running process memory, which only exists while the system is powered on.
An ACE examiner uses Registry Viewer to analyze the NTUSER.DAT hive. Which key reveals the most recently typed URLs in Internet Explorer?
Answer: HKCU\Software\Microsoft\Internet Explorer\TypedURLs
The TypedURLs key under HKCU\Software\Microsoft\Internet Explorer stores URLs manually typed into the IE address bar.
Which FTK feature allows an examiner to compare hash values of evidence files against a known set of system files to quickly exclude irrelevant data?
Answer: KFF (Known File Filter)
The Known File Filter (KFF) compares evidence file hashes against known good and known bad hash sets to flag or exclude files.
When examining a RAID-5 array in FTK, which information is CRITICAL for the examiner to obtain before reconstruction?
Answer: Strip size, disk order, and parity rotation scheme
Accurate RAID-5 reconstruction requires knowing the strip size, the correct disk order, and how parity is rotated across the array.
In AccessData's Password Recovery Toolkit (PRTK), what is a 'dictionary attack with rules' primarily designed to do?
Answer: Apply transformations like capitalization and number substitution to dictionary words
Dictionary attacks with rules apply mutation rules (capitalization, leet-speak, appended numbers) to base dictionary words to crack common password patterns.
An examiner identifies a file with a .jpg extension but FTK flags it as a 'bad extension' mismatch. What does this most likely indicate?
Answer: The file's true type based on its header does not match the .jpg extension
FTK's file signature analysis compares file headers (magic bytes) to the extension, and a mismatch suggests the extension was changed to disguise the true file type.