ACE Digital Forensic Principles & Methodologies 3

Question 1

When acquiring a forensic image of a hard drive, the investigator calculates an MD5 hash before and after the process. The hashes match. What does this confirm?

Accepted Answer

The acquisition was completed without altering the original data

Answer

Matching pre- and post-acquisition hashes confirm that the original evidence was not modified during the imaging process.

Question 2

Which file system artifact stores the last eight files deleted from the Windows desktop or Windows Explorer?

Accepted Answer

The Recycle Bin ($I and $R files)

Answer

The Windows Recycle Bin stores deleted files as $R (content) and $I (metadata) pairs until they are permanently deleted.

Question 3

In AccessData FTK, what does the 'Known File Filter' (KFF) feature help an examiner do?

Accepted Answer

Identify and filter known good and known bad files by hash values

Answer

The KFF compares file hashes against databases of known good (OS/application) and known bad (contraband) files to quickly prioritize evidence.

Question 4

What is the purpose of documenting the 'chain of custody' for digital evidence?

Accepted Answer

To track who had possession of evidence and when, ensuring its integrity

Answer

Chain of custody documentation ensures evidence integrity by recording every person who handled the evidence and when, defending against tampering allegations.

Question 5

During examination, an investigator finds a file in unallocated disk space. What technique was most likely used to recover it?

Accepted Answer

Data carving

Answer

Data carving recovers files from unallocated space by searching for known file headers and footers without relying on file system structures.

(ACE) AccessData Certified Examiner Practice Test

(ACE) AccessData Certified Examiner Practice Test

ACE Digital Forensic Principles & Methodologies 3