ACE Advanced Techniques & Methods 2 — Questions and Answers
Question 1: When examining a password-protected ZIP archive in FTK, which technique is most appropriate for recovery without a known password?
- Apply dictionary attack using a custom wordlist (Correct answer)
- Skip the archive and document it as unexaminable
- Convert the ZIP to a different archive format
- Delete the archive header and re-index
Correct answer: Apply dictionary attack using a custom wordlist
A dictionary attack using a custom wordlist tailored to the suspect's known terms is the most targeted and legally defensible approach for ZIP password recovery in FTK.
Question 2: In FTK, what is the purpose of the 'Known File Filter' (KFF) during evidence processing?
- Identifies files by extension only
- Flags or ignores files based on hash comparison to known good/bad libraries (Correct answer)
- Compresses evidence files for storage
- Converts proprietary formats to open formats
Correct answer: Flags or ignores files based on hash comparison to known good/bad libraries
KFF compares file hashes against databases of known good (OS/application) and known bad (malware/contraband) files to quickly triage evidence.
Question 3: An investigator finds a file with a .jpg extension but FTK flags it as a mismatch. What does this most likely indicate?
- The file was compressed during imaging
- The file extension was changed to disguise its true file type (Correct answer)
- The file was encrypted with AES-256
- The file system is corrupted
Correct answer: The file extension was changed to disguise its true file type
A header/extension mismatch typically indicates intentional obfuscation where a file's extension was manually changed to hide its true content type.
Question 4: Which of the following best describes 'live acquisition' in digital forensics?
- Imaging a powered-off device using a write blocker
- Collecting volatile data from a running system before shutdown (Correct answer)
- Restoring data from a cloud backup
- Cloning a hard drive in the lab
Correct answer: Collecting volatile data from a running system before shutdown
Live acquisition involves capturing volatile data (RAM, network connections, running processes) from a powered-on system, which would be lost upon shutdown.
Question 5: When using FTK's bookmarking feature during an investigation, what is the primary forensic purpose?
- To permanently delete irrelevant files from evidence
- To organize and annotate evidentiary items for reporting and court presentation (Correct answer)
- To speed up the hashing process
- To decrypt password-protected files
Correct answer: To organize and annotate evidentiary items for reporting and court presentation
Bookmarks allow examiners to flag, categorize, and annotate specific files or artifacts for inclusion in reports and to clearly communicate findings in court.
Question 6: A forensic examiner discovers 'unallocated space' containing file fragments. Which FTK feature best helps recover these fragments?
- File carving using header/footer signatures (Correct answer)
- The keyword search index
- The email threading engine
- The registry viewer
Correct answer: File carving using header/footer signatures
File carving scans raw binary data for known file headers and footers to reconstruct files from unallocated space without relying on file system metadata.
Question 7: During NTFS forensics in FTK, what critical information is stored in the Master File Table (MFT) that aids an investigation?
- Only file content data
- File metadata including timestamps, permissions, file names, and attribute data (Correct answer)
- Encryption keys for EFS-protected files
- User account password hashes
Correct answer: File metadata including timestamps, permissions, file names, and attribute data
The MFT contains comprehensive metadata for every file and directory, including MAC timestamps, file size, permissions, and data run locations on disk.
ACE Advanced Techniques & Methods 2
When examining a password-protected ZIP archive in FTK, which technique is most appropriate for recovery without a known password?