ACE Password Recovery & Decryption 2

Question 1

What is a rule-based (or hybrid) attack in PRTK?

Accepted Answer

Applying transformation rules (e.g., capitalize, append numbers) to dictionary words to generate candidates

Answer

A rule-based attack applies mutations — such as capitalization, substitution, or appending digits — to dictionary entries to cover predictable password patterns.

Question 2

Windows EFS (Encrypting File System) stores decryption key material in which location?

Accepted Answer

The user's certificate store tied to their Windows account credentials

Answer

EFS uses the user's private key stored in their certificate store; if the examiner can log in as the user or export the certificate, EFS-protected files can be decrypted.

Question 3

When examining a BitLocker-encrypted drive, which of the following is the most examiner-friendly recovery method if the recovery key is unavailable?

Accepted Answer

Searching the Microsoft account or Active Directory for the stored BitLocker Recovery Key

Answer

BitLocker recovery keys are automatically backed up to Microsoft accounts or Active Directory, making this the fastest and most reliable recovery path for examiners.

Question 4

GPU acceleration in password cracking provides a significant advantage primarily because GPUs:

Accepted Answer

Contain thousands of cores optimized for parallel mathematical operations

Answer

GPUs contain thousands of small cores designed for parallel processing, allowing them to compute millions of hash comparisons simultaneously — far exceeding CPU performance for cracking tasks.

Question 5

What does FTK's 'Known File Filter' (KFF) contribute to a password recovery workflow?

Accepted Answer

It excludes known benign files from processing, allowing the examiner to focus on unknown or suspect encrypted files

Answer

KFF filters out known-good files (e.g., OS and application files), reducing the dataset so examiners concentrate password recovery efforts on genuinely unknown, potentially relevant encrypted files.

(ACE) AccessData Certified Examiner Practice Test

(ACE) AccessData Certified Examiner Practice Test

ACE Password Recovery & Decryption 2