ACE Evidence Acquisition & Preservation 3

Question 1

An examiner receives a hard drive with a damaged partition table. Which FTK Imager feature allows imaging despite this condition?

Accepted Answer

Create Disk Image with custom sector range

Answer

Specifying a custom sector range lets the examiner image readable sectors even when the partition table is corrupt or missing.

Question 2

Why should forensic images always be stored on media separate from the examiner's working copy?

Accepted Answer

To preserve the original evidence image unaltered while analysis is done on the copy

Answer

Keeping the original image untouched ensures that evidence integrity is maintained and the original can be re-examined if the working copy is corrupted.

Question 3

During a network forensics investigation, which device should be imaged FIRST to capture the most transient data?

Accepted Answer

Network switches and their ARP/MAC tables

Answer

Switch ARP and MAC address tables are stored in volatile memory and clear rapidly, making them the most time-sensitive evidence to capture.

Question 4

What is write-blocking and why is it critical during forensic acquisition?

Accepted Answer

It prevents any write commands from reaching the evidence drive, preserving its original state

Answer

Write-blockers intercept and discard write commands at the hardware or software level, ensuring no data on the evidence drive is modified during imaging.

Question 5

Which AccessData tool is specifically designed for enterprise-scale evidence collection across networked endpoints without physical access?

Accepted Answer

FTK Enterprise / AD Enterprise

Answer

AD Enterprise (FTK Enterprise) performs remote live acquisition and triage across networked endpoints without requiring physical removal of drives.

(ACE) AccessData Certified Examiner Practice Test

(ACE) AccessData Certified Examiner Practice Test

ACE Evidence Acquisition & Preservation 3