ACE Foundational Concepts & Principles 2

Question 1

In digital forensics, what does the term 'chain of custody' primarily ensure?

Accepted Answer

A documented trail of who handled evidence and when

Answer

Chain of custody documents every person who handled the evidence and when, ensuring its integrity and admissibility in court.

Question 2

What is the primary purpose of write-blocking hardware in digital forensics?

Accepted Answer

To prevent any data from being written to the original evidence drive

Answer

Write blockers prevent any modifications to the original evidence drive during the imaging or examination process.

Question 3

Which file system metadata attribute records the last time a file's content was modified on NTFS?

Accepted Answer

Last Written time ($STANDARD_INFORMATION)

Answer

The Last Written timestamp in $STANDARD_INFORMATION records when the file's data content was last changed.

Question 4

What forensic principle states that 'every contact leaves a trace'?

Accepted Answer

Locard's Exchange Principle

Answer

Locard's Exchange Principle, developed by Edmond Locard, states that any contact between two objects results in an exchange of material.

Question 5

In FTK, what is a 'case' most accurately described as?

Accepted Answer

A container that organizes evidence, bookmarks, and analysis data for an investigation

Answer

In FTK, a case is the organizational unit that holds all evidence items, bookmarks, labels, and analysis results for a specific investigation.

(ACE) AccessData Certified Examiner Practice Test