ACE Advanced Techniques & Methods 3 — Questions and Answers
Question 1: When analyzing Windows Registry hives in FTK, which hive contains recently accessed files and user-specific application settings?
- SYSTEM
- SAM
- NTUSER.DAT (Correct answer)
- SECURITY
Correct answer: NTUSER.DAT
NTUSER.DAT is the per-user registry hive stored in each user's profile directory and contains MRU lists, recently accessed documents, and user-specific settings.
Question 2: In FTK Imager, what is the significance of creating both an E01 image and a separate hash log file?
- The hash log replaces the need for chain of custody documentation
- The hash log provides an independent record to verify image integrity at any time (Correct answer)
- E01 images cannot store hash values internally
- Hash logs are required only for NTFS volumes
Correct answer: The hash log provides an independent record to verify image integrity at any time
A separate hash log provides an auditable, independent record of the source and image hashes, allowing verification of evidence integrity throughout the case lifecycle.
Question 3: What is 'prefetch' analysis used for in a Windows forensic investigation?
- Recovering deleted emails from PST files
- Determining which applications were executed and when on a Windows system (Correct answer)
- Identifying encrypted volumes on a drive
- Mapping network shares accessed by the suspect
Correct answer: Determining which applications were executed and when on a Windows system
Windows Prefetch files (.pf) record application execution data including run count and last run time, proving program execution even after the executable is deleted.
Question 4: A forensic examiner needs to analyze SQLite databases found on a mobile device backup. Which FTK capability supports this?
- The email threading module
- FTK's built-in SQLite viewer and data extraction tools (Correct answer)
- The KFF library comparison
- The file carving engine
Correct answer: FTK's built-in SQLite viewer and data extraction tools
FTK includes a SQLite viewer that can parse and display database contents from mobile app databases such as SMS, contacts, and browser history stores.
Question 5: When examining LNK (shortcut) files during a Windows investigation, what type of evidence can they provide?
- Proof of network packet capture
- Evidence of file access including original file path, MAC times, and volume serial number (Correct answer)
- Encrypted key material for BitLocker volumes
- A record of deleted user accounts
Correct answer: Evidence of file access including original file path, MAC times, and volume serial number
LNK files retain metadata about the target file including original path, timestamps, volume serial number, and MAC address, even if the target file is deleted.
Question 6: What does 'slack space' analysis reveal in a forensic examination?
- The amount of free disk space available
- Remnants of previously stored data between the end of a file and the end of its allocated cluster (Correct answer)
- The swap file contents from RAM
- The volume shadow copy history
Correct answer: Remnants of previously stored data between the end of a file and the end of its allocated cluster
Slack space is the unused area between a file's logical end and the end of its last allocated cluster, which may contain fragments of previously deleted data.
Question 7: During analysis of a suspect's web browser history in FTK, which artifact would best prove a specific URL was visited at a precise time?
- The browser's downloaded fonts cache
- Timestamped entries in the browser's history SQLite database (Correct answer)
- Temporary Internet Files folder size
- The browser's certificate store
Correct answer: Timestamped entries in the browser's history SQLite database
Modern browsers store visit history in SQLite databases with precise timestamps, providing direct evidence of URL visits with date and time.
ACE Advanced Techniques & Methods 3
When analyzing Windows Registry hives in FTK, which hive contains recently accessed files and user-specific application settings?