ACE Technology & Tools 2

Question 1

Which FTK feature allows examiners to view only files matching specific criteria such as file type, date range, or hash value without altering the case data?

Accepted Answer

Filter Manager

Answer

Filter Manager in FTK lets examiners apply criteria-based filters to narrow the file view without modifying underlying evidence.

Question 2

In AccessData FTK, what is the purpose of the 'Known File Filter' (KFF) database?

Accepted Answer

Identifies and excludes known system files or flags known contraband hashes

Answer

KFF compares file hashes against known libraries to either ignore benign OS files or flag files matching known contraband hash sets.

Question 3

When imaging a suspect SSD with TRIM support enabled, which concern is most critical for a forensic examiner?

Accepted Answer

TRIM can cause the OS to zero-out deleted blocks, permanently destroying recoverable data

Answer

TRIM instructs the SSD controller to erase blocks associated with deleted files, which can make carved data unrecoverable if the drive is powered on.

Question 4

Which AccessData tool is specifically designed for live memory acquisition and analysis of a running system?

Accepted Answer

FTK (Memory Analysis module)

Answer

FTK's memory analysis module, combined with FTK Imager's memory capture capability, supports live RAM acquisition and subsequent analysis within FTK.

Question 5

A forensic examiner uses FTK Imager to create an image but the destination drive runs out of space mid-acquisition. What is the best immediate action?

Accepted Answer

Continue imaging to another drive by splitting the image

Answer

FTK Imager supports segmented/split image output, so the examiner should configure segment sizes to span multiple destinations or target a larger drive.

(ACE) AccessData Certified Examiner Practice Test

(ACE) AccessData Certified Examiner Practice Test

ACE Technology & Tools 2