ACE Foundational Concepts & Principles 3 — Questions and Answers
Question 1: What is the significance of the MD5 hash value in digital forensics?
- It compresses evidence files for storage
- It provides a unique fingerprint to verify a file or image has not been altered (Correct answer)
- It encrypts evidence to prevent unauthorized access
- It identifies the operating system on the evidence drive
Correct answer: It provides a unique fingerprint to verify a file or image has not been altered
MD5 produces a fixed-length digest that acts as a fingerprint; any change to the data produces a different hash, verifying integrity.
Question 2: What is 'unallocated space' on a hard drive?
- Space used by the operating system kernel
- Clusters not currently assigned to any file by the file system (Correct answer)
- Space reserved for the Master File Table
- The area containing the partition table
Correct answer: Clusters not currently assigned to any file by the file system
Unallocated space consists of clusters that are not assigned to active files and may contain remnants of deleted files.
Question 3: In the context of the ACE exam, what does 'email header analysis' primarily help an investigator determine?
- The content of encrypted email attachments
- The routing path and originating IP address of an email (Correct answer)
- The password used to send the email
- The size of all attachments in an email
Correct answer: The routing path and originating IP address of an email
Email headers contain Received fields that trace the servers the message passed through, helping identify the origin IP and routing path.
Question 4: Which standard governs the admissibility of scientific evidence in US federal courts based on peer review and general acceptance?
- Locard Standard
- Daubert Standard (Correct answer)
- Best Evidence Rule
- Federal Rules 902
Correct answer: Daubert Standard
The Daubert Standard, established in Daubert v. Merrell Dow Pharmaceuticals (1993), requires federal courts to evaluate scientific testimony for reliability and relevance.
Question 5: What is the purpose of a 'forensic image' as opposed to a simple file copy?
- A forensic image only copies allocated files
- A forensic image captures every bit of the source drive including unallocated and slack space (Correct answer)
- A forensic image automatically decrypts encrypted files
- A forensic image is smaller than the original drive
Correct answer: A forensic image captures every bit of the source drive including unallocated and slack space
A forensic image (bit-for-bit copy) captures the entire drive including deleted data, slack space, and unallocated areas that a file copy would miss.
Question 6: What Windows Registry hive stores user-specific settings and is loaded from the NTUSER.DAT file?
- HKEY_LOCAL_MACHINE
- HKEY_CURRENT_USER (Correct answer)
- HKEY_CLASSES_ROOT
- HKEY_LOCAL_MACHINE\SAM
Correct answer: HKEY_CURRENT_USER
HKEY_CURRENT_USER is loaded from the currently logged-in user's NTUSER.DAT profile file and stores that user's personal settings.
Question 7: What is the 'order of volatility' principle used for in digital forensics?
- Ranking evidence by its legal importance
- Prioritizing collection of evidence that will disappear fastest first (Correct answer)
- Determining which files to decrypt first
- Organizing case files by file size
Correct answer: Prioritizing collection of evidence that will disappear fastest first
The order of volatility guides investigators to collect the most transient data (RAM, network state) before less volatile data (hard drive contents).
ACE Foundational Concepts & Principles 3
What is the significance of the MD5 hash value in digital forensics?