ACE Password Recovery & Decryption 2

Question 1

What is a rule-based (or hybrid) attack in PRTK?

Accepted Answer

Applying transformation rules (e.g., capitalize, append numbers) to dictionary words to generate candidates

Answer

Combining two dictionary files into a single wordlist

Answer

Using known plaintext to derive the encryption key

Answer

Splitting a brute force attack across multiple processors

Question 2

Windows EFS (Encrypting File System) stores decryption key material in which location?

Accepted Answer

The user's certificate store tied to their Windows account credentials

Answer

A hidden system file at the root of the volume

Answer

The BIOS firmware chip

Answer

A dedicated hardware security module

Question 3

When examining a BitLocker-encrypted drive, which of the following is the most examiner-friendly recovery method if the recovery key is unavailable?

Accepted Answer

Searching the Microsoft account or Active Directory for the stored BitLocker Recovery Key

Answer

Running a GPU-accelerated brute force attack against the volume header

Answer

Imaging the encrypted volume and processing it directly in FTK

Answer

Disabling BitLocker through the Windows RE environment

Question 4

GPU acceleration in password cracking provides a significant advantage primarily because GPUs:

Accepted Answer

Contain thousands of cores optimized for parallel mathematical operations

Answer

Have faster memory access than CPUs

Answer

Can store more dictionary entries in cache

Answer

Operate at higher clock speeds than modern CPUs

Question 5

What does FTK's 'Known File Filter' (KFF) contribute to a password recovery workflow?

Accepted Answer

It excludes known benign files from processing, allowing the examiner to focus on unknown or suspect encrypted files

Answer

It automatically decrypts files that match known encryption signatures

Answer

It identifies files that have been renamed to hide their extension

Answer

It flags files whose hash matches known malware databases

Question 6

A suspect's password-protected ZIP archive uses PKZIP 2.0 (ZipCrypto) encryption. Why is this considered weak from a forensic perspective?

Accepted Answer

ZipCrypto is vulnerable to known-plaintext attacks that can recover the key with as little as 12 bytes of known plaintext

Answer

ZipCrypto uses only 40-bit keys that brute force attacks can break instantly

Answer

PKZIP 2.0 stores the password hash in the ZIP header in plaintext

Answer

ZipCrypto archives can be decompressed without a password using standard tools

Question 7

In FTK, when a file is flagged as 'encrypted' after processing, what does this determination typically rely on?

Accepted Answer

File header signatures, entropy analysis, and known encryption format identification

Answer

The file extension matching a known encrypted format list

Answer

The file owner's account being marked as restricted

Answer

The file being located in a system-protected directory