ACE ACE File System & Artifact Analysis 2

Question 1

What information does the $I file in the Windows Recycle Bin contain?

Accepted Answer

Metadata including the original file path, deletion date, and file size

Answer

The $I file stores metadata such as the original full path, deletion timestamp, and file size of its corresponding deleted item.

Question 2

What does the Windows Prefetch directory reveal in a forensic investigation?

Accepted Answer

Applications that were executed on the system along with run counts and last run times

Answer

Windows Prefetch files record application execution history, including the program name, execution count, and the last time it was run.

Question 3

What forensic information does a Windows LNK (shortcut) file provide?

Accepted Answer

Details about the target file including original path, volume serial number, and timestamps

Answer

LNK files record metadata about the target file including its original path, host volume information, and MAC timestamps, revealing user file access history.

Question 4

What is the purpose of FTK's Known File Filter (KFF)?

Accepted Answer

Identify files by known hash values to flag or exclude them, reducing manual review workload

Answer

FTK's KFF uses hash libraries such as NSRL to automatically identify known-good or known-bad files, letting examiners focus on unknown or suspicious items.

Question 5

Which Windows registry key records USB storage device connection history including device serial numbers?

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR

Answer

The USBSTOR registry key records each USB storage device that has connected to the system, including unique device serial numbers and connection timestamps.

(ACE) AccessData Certified Examiner Practice Test

(ACE) AccessData Certified Examiner Practice Test

ACE ACE File System & Artifact Analysis 2