ACE Advanced Techniques & Methods 3

Question 1

When analyzing Windows Registry hives in FTK, which hive contains recently accessed files and user-specific application settings?

Accepted Answer

NTUSER.DAT

Answer

NTUSER.DAT is the per-user registry hive stored in each user's profile directory and contains MRU lists, recently accessed documents, and user-specific settings.

Question 2

In FTK Imager, what is the significance of creating both an E01 image and a separate hash log file?

Accepted Answer

The hash log provides an independent record to verify image integrity at any time

Answer

A separate hash log provides an auditable, independent record of the source and image hashes, allowing verification of evidence integrity throughout the case lifecycle.

Question 3

What is 'prefetch' analysis used for in a Windows forensic investigation?

Accepted Answer

Determining which applications were executed and when on a Windows system

Answer

Windows Prefetch files (.pf) record application execution data including run count and last run time, proving program execution even after the executable is deleted.

Question 4

A forensic examiner needs to analyze SQLite databases found on a mobile device backup. Which FTK capability supports this?

Accepted Answer

FTK's built-in SQLite viewer and data extraction tools

Answer

FTK includes a SQLite viewer that can parse and display database contents from mobile app databases such as SMS, contacts, and browser history stores.

Question 5

When examining LNK (shortcut) files during a Windows investigation, what type of evidence can they provide?

Accepted Answer

Evidence of file access including original file path, MAC times, and volume serial number

Answer

LNK files retain metadata about the target file including original path, timestamps, volume serial number, and MAC address, even if the target file is deleted.

(ACE) AccessData Certified Examiner Practice Test

(ACE) AccessData Certified Examiner Practice Test

ACE Advanced Techniques & Methods 3