ACE Technology & Tools 3

Question 1

What is the primary function of AccessData's Password Recovery Toolkit (PRTK)?

Accepted Answer

Recovers or attacks passwords protecting files and encrypted volumes

Answer

PRTK uses dictionary, rule-based, and brute-force attacks to recover passwords from protected files including documents, archives, and encrypted containers.

Question 2

Which file format does FTK Imager use to create a proprietary AccessData forensic image?

Accepted Answer

AD1 (AccessData Image)

Answer

AD1 is AccessData's native logical image format, while E01 is EnCase's format; FTK Imager also supports E01 and DD, but AD1 is the AccessData proprietary format.

Question 3

When performing a forensic acquisition, why is it important to document the hash value both before and after imaging?

Accepted Answer

To prove the forensic copy is an exact, unaltered duplicate of the original

Answer

Matching hash values before and after imaging mathematically demonstrates the copy is bit-for-bit identical, establishing forensic integrity.

Question 4

In FTK, the 'Compound File' processing option is used to:

Accepted Answer

Extract contents of containers like ZIP files, PST files, and compound documents for individual review

Answer

Processing compound files causes FTK to open container formats (archives, email stores, Office documents with embedded objects) and index their internal contents.

Question 5

Which AccessData utility is designed to triage and acquire evidence from mobile devices in the field?

Accepted Answer

MPE+ (Mobile Phone Examiner Plus)

Answer

MPE+ is AccessData's dedicated mobile forensics tool for acquiring and analyzing data from smartphones and tablets.

(ACE) AccessData Certified Examiner Practice Test

(ACE) AccessData Certified Examiner Practice Test

ACE Technology & Tools 3