ACE Evidence Acquisition & Preservation 3 — Questions and Answers
Question 1: An examiner receives a hard drive with a damaged partition table. Which FTK Imager feature allows imaging despite this condition?
- Verify Drive/Image
- Add Evidence Item → Physical Drive
- Mount Image to Drive Letter
- Create Disk Image with custom sector range (Correct answer)
Correct answer: Create Disk Image with custom sector range
Specifying a custom sector range lets the examiner image readable sectors even when the partition table is corrupt or missing.
Question 2: Why should forensic images always be stored on media separate from the examiner's working copy?
- To save storage space through deduplication
- To preserve the original evidence image unaltered while analysis is done on the copy (Correct answer)
- To comply with NTFS file size limitations
- To speed up hash verification
Correct answer: To preserve the original evidence image unaltered while analysis is done on the copy
Keeping the original image untouched ensures that evidence integrity is maintained and the original can be re-examined if the working copy is corrupted.
Question 3: During a network forensics investigation, which device should be imaged FIRST to capture the most transient data?
- File server hard drives
- Network switches and their ARP/MAC tables (Correct answer)
- Backup tape systems
- Archival NAS storage
Correct answer: Network switches and their ARP/MAC tables
Switch ARP and MAC address tables are stored in volatile memory and clear rapidly, making them the most time-sensitive evidence to capture.
Question 4: What is write-blocking and why is it critical during forensic acquisition?
- It compresses data during imaging to save space
- It prevents any write commands from reaching the evidence drive, preserving its original state (Correct answer)
- It encrypts the forensic image during transfer
- It speeds up read operations by caching sectors
Correct answer: It prevents any write commands from reaching the evidence drive, preserving its original state
Write-blockers intercept and discard write commands at the hardware or software level, ensuring no data on the evidence drive is modified during imaging.
Question 5: Which AccessData tool is specifically designed for enterprise-scale evidence collection across networked endpoints without physical access?
- FTK Imager
- PRTK (Password Recovery Toolkit)
- FTK Enterprise / AD Enterprise (Correct answer)
- Registry Viewer
Correct answer: FTK Enterprise / AD Enterprise
AD Enterprise (FTK Enterprise) performs remote live acquisition and triage across networked endpoints without requiring physical removal of drives.
Question 6: A forensic image hash taken immediately after acquisition differs from the hash taken one week later. What does this indicate?
- Normal hash drift due to time-stamping
- The image file has been modified or corrupted since acquisition (Correct answer)
- The hashing algorithm changed between calculations
- The image was stored in a compressed format
Correct answer: The image file has been modified or corrupted since acquisition
A changed hash value proves the image data is no longer identical to its state at acquisition, indicating tampering or corruption.
Question 7: When imaging an SSD with TRIM enabled, which limitation must an examiner understand?
- SSD images cannot be stored in E01 format
- TRIM may have zeroed deleted sectors, making carving of deleted files less effective (Correct answer)
- SSDs require a different hashing algorithm than HDDs
- Write-blockers do not function on SATA SSDs
Correct answer: TRIM may have zeroed deleted sectors, making carving of deleted files less effective
TRIM actively zeroes sectors marked as deleted, potentially destroying data that would be recoverable from a traditional HDD's unallocated space.
ACE Evidence Acquisition & Preservation 3
An examiner receives a hard drive with a damaged partition table.
Which FTK Imager feature allows imaging despite this condition?