ACE Advanced Techniques & Methods 2

Question 1

When examining a password-protected ZIP archive in FTK, which technique is most appropriate for recovery without a known password?

Accepted Answer

Apply dictionary attack using a custom wordlist

Answer

A dictionary attack using a custom wordlist tailored to the suspect's known terms is the most targeted and legally defensible approach for ZIP password recovery in FTK.

Question 2

In FTK, what is the purpose of the 'Known File Filter' (KFF) during evidence processing?

Accepted Answer

Flags or ignores files based on hash comparison to known good/bad libraries

Answer

KFF compares file hashes against databases of known good (OS/application) and known bad (malware/contraband) files to quickly triage evidence.

Question 3

An investigator finds a file with a .jpg extension but FTK flags it as a mismatch. What does this most likely indicate?

Accepted Answer

The file extension was changed to disguise its true file type

Answer

A header/extension mismatch typically indicates intentional obfuscation where a file's extension was manually changed to hide its true content type.

Question 4

Which of the following best describes 'live acquisition' in digital forensics?

Accepted Answer

Collecting volatile data from a running system before shutdown

Answer

Live acquisition involves capturing volatile data (RAM, network connections, running processes) from a powered-on system, which would be lost upon shutdown.

Question 5

When using FTK's bookmarking feature during an investigation, what is the primary forensic purpose?

Accepted Answer

To organize and annotate evidentiary items for reporting and court presentation

Answer

Bookmarks allow examiners to flag, categorize, and annotate specific files or artifacts for inclusion in reports and to clearly communicate findings in court.

(ACE) AccessData Certified Examiner Practice Test

(ACE) AccessData Certified Examiner Practice Test

ACE Advanced Techniques & Methods 2