ACE ACE File System & Artifact Analysis

Question 1

What primary structure does NTFS use to track every file and directory on a volume?

Accepted Answer

Master File Table (MFT)

Answer

FAT32 allocation table

Answer

inode table

Answer

File Allocation Table

Question 2

In FTK, what does the 'Bookmarks' feature allow an examiner to do?

Accepted Answer

Tag and annotate specific evidence items for later reference

Answer

Filter evidence by file type

Answer

Run hash verification on all files

Answer

Export all evidence to a folder

Question 3

Which MAC timestamp records the last time a file's content was changed in NTFS?

Accepted Answer

Modified time

Answer

Accessed time

Answer

Created time

Answer

Entry Modified time

Question 4

What is 'file carving' in digital forensics?

Accepted Answer

Recovering files based on file signatures without relying on file system metadata

Answer

Encrypting recovered files for secure storage

Answer

Hashing all files on a drive for verification

Answer

Securely wiping files from a disk

Question 5

In FTK, what does the 'Evidence Tree' panel display?

Accepted Answer

A hierarchical view of all added evidence sources and their file system contents

Answer

Hash values of all indexed files

Answer

Only deleted and unallocated files

Answer

Email headers extracted from the image

Question 6

What is 'slack space' in digital forensics?

Accepted Answer

The unused area between the logical end of a file and the physical end of its last allocated cluster

Answer

Unpartitioned space at the end of a disk

Answer

Free space available for new file creation

Answer

Space reserved for the MFT expansion zone