ACE Technology & Tools 2 — Questions and Answers
Question 1: Which FTK feature allows examiners to view only files matching specific criteria such as file type, date range, or hash value without altering the case data?
- Live Preview
- Filter Manager (Correct answer)
- Evidence Processor
- Bookmarking
Correct answer: Filter Manager
Filter Manager in FTK lets examiners apply criteria-based filters to narrow the file view without modifying underlying evidence.
Question 2: In AccessData FTK, what is the purpose of the 'Known File Filter' (KFF) database?
- Encrypts sensitive case files automatically
- Identifies and excludes known system files or flags known contraband hashes (Correct answer)
- Compresses evidence images to save storage
- Decrypts password-protected archives
Correct answer: Identifies and excludes known system files or flags known contraband hashes
KFF compares file hashes against known libraries to either ignore benign OS files or flag files matching known contraband hash sets.
Question 3: When imaging a suspect SSD with TRIM support enabled, which concern is most critical for a forensic examiner?
- TRIM may compress data blocks making imaging slower
- TRIM can cause the OS to zero-out deleted blocks, permanently destroying recoverable data (Correct answer)
- TRIM encrypts deleted sectors before wiping
- TRIM renames deleted files to system files
Correct answer: TRIM can cause the OS to zero-out deleted blocks, permanently destroying recoverable data
TRIM instructs the SSD controller to erase blocks associated with deleted files, which can make carved data unrecoverable if the drive is powered on.
Question 4: Which AccessData tool is specifically designed for live memory acquisition and analysis of a running system?
- FTK Imager
- PRTK
- MPE+
- FTK (Memory Analysis module) (Correct answer)
Correct answer: FTK (Memory Analysis module)
FTK's memory analysis module, combined with FTK Imager's memory capture capability, supports live RAM acquisition and subsequent analysis within FTK.
Question 5: A forensic examiner uses FTK Imager to create an image but the destination drive runs out of space mid-acquisition. What is the best immediate action?
- Continue imaging to another drive by splitting the image (Correct answer)
- Delete case files to free space and resume
- Power off the suspect drive immediately
- Restart the imaging process from scratch on a larger drive
Correct answer: Continue imaging to another drive by splitting the image
FTK Imager supports segmented/split image output, so the examiner should configure segment sizes to span multiple destinations or target a larger drive.
Question 6: What does 'write blocking' accomplish when used during forensic imaging?
- Prevents the examiner from modifying the forensic report
- Stops any write operations from reaching the evidence drive, preserving its integrity (Correct answer)
- Blocks the suspect from remotely wiping the device
- Encrypts the evidence drive during acquisition
Correct answer: Stops any write operations from reaching the evidence drive, preserving its integrity
A write blocker intercepts write commands sent to the evidence drive, ensuring the original media remains forensically unaltered.
Question 7: In FTK's evidence processing options, what does enabling 'Data Carving' accomplish?
- Extracts metadata from document headers only
- Recovers files based on file signatures from unallocated or slack space (Correct answer)
- Decrypts AES-256 encrypted volumes automatically
- Indexes all email attachments for keyword search
Correct answer: Recovers files based on file signatures from unallocated or slack space
Data carving scans raw storage for known file headers and footers to reconstruct files even when the file system no longer references them.
ACE Technology & Tools 2
Which FTK feature allows examiners to view only files matching specific criteria such as file type, date range, or hash value without altering the case data?