ACE Password Recovery & Decryption 3

Question 1

Which AccessData product is used to manage and coordinate distributed password recovery jobs across multiple machines?

Accepted Answer

PRTK with the DNA (Distributed Network Attack) module

Answer

PRTK's DNA module enables examiners to distribute password cracking jobs across many networked machines, pooling computing resources for faster recovery.

Question 2

An examiner finds a VeraCrypt-encrypted container on a suspect's drive. What is the most practical forensic approach when no password is known?

Accepted Answer

Search the system for passwords in plaintext artifacts (browser saved passwords, text files, registry) before attempting cracking

Answer

Before resource-intensive cracking, examiners should search the broader system for password hints or reuse in artifacts like browser stores, documents, or registry keys, which often succeeds faster.

Question 3

What is key escrow, and how is it relevant to digital forensic investigations?

Accepted Answer

A system where encryption keys are held by a trusted third party, potentially allowing lawful access without breaking encryption

Answer

Key escrow allows authorized parties (such as law enforcement with proper legal process) to obtain encryption keys from the holding third party, enabling decryption without cryptanalysis.

Question 4

When recovering passwords for Microsoft Office documents (.docx, .xlsx) protected with AES-256 encryption (Office 2016+), what approach is most realistic for an examiner?

Accepted Answer

Dictionary or rule-based attacks combined with GPU acceleration, since AES-256 itself is not feasibly broken

Answer

Modern Office encryption using AES-256 is cryptographically strong; examiners rely on password-guessing attacks (dictionary, rules, GPU-assisted) rather than breaking the encryption algorithm itself.

Question 5

What is the forensic significance of a password found in the Windows Credential Manager or DPAPI-protected storage?

Accepted Answer

It may provide the actual password used for encrypted files, websites, or network shares without requiring cracking

Answer

Windows Credential Manager and DPAPI often store passwords in a form recoverable with the user's account credentials, providing plaintext passwords that can directly unlock encrypted resources.

(ACE) AccessData Certified Examiner Practice Test

(ACE) AccessData Certified Examiner Practice Test

ACE Password Recovery & Decryption 3