ACE Technology & Tools 3 — Questions and Answers
Question 1: What is the primary function of AccessData's Password Recovery Toolkit (PRTK)?
- Creates forensic images of password-protected drives
- Recovers or attacks passwords protecting files and encrypted volumes (Correct answer)
- Monitors network traffic for credential exchanges
- Generates strong passwords for evidence encryption
Correct answer: Recovers or attacks passwords protecting files and encrypted volumes
PRTK uses dictionary, rule-based, and brute-force attacks to recover passwords from protected files including documents, archives, and encrypted containers.
Question 2: Which file format does FTK Imager use to create a proprietary AccessData forensic image?
- E01 (EnCase Evidence File)
- DD (Raw Image)
- AD1 (AccessData Image) (Correct answer)
- AFF (Advanced Forensic Format)
Correct answer: AD1 (AccessData Image)
AD1 is AccessData's native logical image format, while E01 is EnCase's format; FTK Imager also supports E01 and DD, but AD1 is the AccessData proprietary format.
Question 3: When performing a forensic acquisition, why is it important to document the hash value both before and after imaging?
- To satisfy software licensing requirements
- To prove the forensic copy is an exact, unaltered duplicate of the original (Correct answer)
- To compress the image file for storage
- To enable FTK's Known File Filter
Correct answer: To prove the forensic copy is an exact, unaltered duplicate of the original
Matching hash values before and after imaging mathematically demonstrates the copy is bit-for-bit identical, establishing forensic integrity.
Question 4: In FTK, the 'Compound File' processing option is used to:
- Merge multiple evidence images into a single archive
- Extract contents of containers like ZIP files, PST files, and compound documents for individual review (Correct answer)
- Encrypt multiple case files under one passphrase
- Combine hash sets from different KFF libraries
Correct answer: Extract contents of containers like ZIP files, PST files, and compound documents for individual review
Processing compound files causes FTK to open container formats (archives, email stores, Office documents with embedded objects) and index their internal contents.
Question 5: Which AccessData utility is designed to triage and acquire evidence from mobile devices in the field?
- FTK Imager
- MPE+ (Mobile Phone Examiner Plus) (Correct answer)
- PRTK
- Enterprise
Correct answer: MPE+ (Mobile Phone Examiner Plus)
MPE+ is AccessData's dedicated mobile forensics tool for acquiring and analyzing data from smartphones and tablets.
Question 6: A forensic examiner discovers a volume encrypted with BitLocker. Which AccessData approach is most applicable to access the data?
- Use FTK Imager's built-in BitLocker decryption module
- Supply the recovery key or user password through PRTK or FTK's decryption support (Correct answer)
- Carve the encrypted sectors using data carving techniques
- Reimage the drive with write protection disabled to bypass BitLocker
Correct answer: Supply the recovery key or user password through PRTK or FTK's decryption support
FTK and PRTK can decrypt BitLocker volumes when the recovery key or password is provided, enabling analysis of the decrypted contents.
Question 7: What is 'slack space' in the context of digital forensics?
- Unused RAM between running processes
- The area between the end of a file's logical size and the end of its last allocated cluster (Correct answer)
- Unformatted sectors at the end of a physical disk
- Free space on a network share that has never been written
Correct answer: The area between the end of a file's logical size and the end of its last allocated cluster
Slack space is the remnant space in the last cluster allocated to a file, which may contain fragments of previously deleted data.
ACE Technology & Tools 3
What is the primary function of AccessData's Password Recovery Toolkit (PRTK)?