ACE Password Recovery & Decryption 3

Question 1

Which AccessData product is used to manage and coordinate distributed password recovery jobs across multiple machines?

Accepted Answer

PRTK with the DNA (Distributed Network Attack) module

Answer

FTK Lab with cluster processing enabled

Answer

AD Enterprise with remote agent deployment

Answer

Cerberus malware analysis engine

Question 2

An examiner finds a VeraCrypt-encrypted container on a suspect's drive. What is the most practical forensic approach when no password is known?

Accepted Answer

Search the system for passwords in plaintext artifacts (browser saved passwords, text files, registry) before attempting cracking

Answer

Immediately image the container and submit it for brute force cracking

Answer

Declare the evidence unrecoverable and document the encrypted container

Answer

Use FTK's built-in VeraCrypt decryption module

Question 3

What is key escrow, and how is it relevant to digital forensic investigations?

Accepted Answer

A system where encryption keys are held by a trusted third party, potentially allowing lawful access without breaking encryption

Answer

A technique for hiding encryption keys inside other files (steganography)

Answer

A legal process for compelling suspects to provide their encryption passwords

Answer

A hardware device that stores cryptographic keys securely

Question 4

When recovering passwords for Microsoft Office documents (.docx, .xlsx) protected with AES-256 encryption (Office 2016+), what approach is most realistic for an examiner?

Accepted Answer

Dictionary or rule-based attacks combined with GPU acceleration, since AES-256 itself is not feasibly broken

Answer

Directly decrypting the file using FTK's Office decryption engine

Answer

Extracting the password from the document's XML metadata

Answer

Using a known-plaintext attack against the Office encryption format

Question 5

What is the forensic significance of a password found in the Windows Credential Manager or DPAPI-protected storage?

Accepted Answer

It may provide the actual password used for encrypted files, websites, or network shares without requiring cracking

Answer

It must be decrypted separately using a different DPAPI key before it can be used

Answer

It is stored in an irreversible hash format and cannot be recovered in plaintext

Answer

It only applies to domain accounts and is irrelevant for local account investigations

Question 6

During a forensic examination, an examiner discovers high-entropy data scattered in unallocated space with no file header. This most likely indicates:

Accepted Answer

Remnants of encrypted or compressed file data from deleted files

Answer

A fragmented but intact plaintext document

Answer

Operating system swap file contents

Answer

Evidence of secure file wiping using overwrite patterns

Question 7

What is the primary purpose of documenting the password recovery methodology in the forensic report?

Accepted Answer

To establish the scientific validity and repeatability of the technique used, supporting admissibility of the decrypted evidence

Answer

To comply with AccessData licensing requirements for PRTK usage

Answer

To inform the suspect of the methods used so they can challenge the results

Answer

To ensure the opposing expert can replicate the exact wordlist used