ACE Tool Proficiency & Analysis Techniques 2 — Questions and Answers
Question 1: In FTK, what does the 'Explicit Images' filter rely on to categorize photos without manual review?
- Hash value matching against NSFW databases
- PhotoDNA perceptual hashing
- Skin-tone pixel percentage analysis via integrated AI scoring (Correct answer)
- EXIF metadata tags embedded by the camera
Correct answer: Skin-tone pixel percentage analysis via integrated AI scoring
FTK's explicit image detection uses skin-tone pixel analysis combined with AI scoring to flag potentially explicit images for examiner review.
Question 2: When using FTK Imager to create a logical image of a live Windows system, which artifact is MOST likely to be captured that a physical image of the powered-off drive would miss?
- MFT entry timestamps
- Pagefile.sys contents
- Currently running process memory (Correct answer)
- Deleted file slack space
Correct answer: Currently running process memory
A logical image of a live system can capture currently running process memory, which only exists while the system is powered on.
Question 3: An ACE examiner uses Registry Viewer to analyze the NTUSER.DAT hive. Which key reveals the most recently typed URLs in Internet Explorer?
- HKCU\Software\Microsoft\Internet Explorer\TypedURLs (Correct answer)
- HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
- HKCU\Software\Microsoft\Internet Explorer\Main\Default_Page_URL
- HKLM\SOFTWARE\Microsoft\Internet Explorer\Main
Correct answer: HKCU\Software\Microsoft\Internet Explorer\TypedURLs
The TypedURLs key under HKCU\Software\Microsoft\Internet Explorer stores URLs manually typed into the IE address bar.
Question 4: Which FTK feature allows an examiner to compare hash values of evidence files against a known set of system files to quickly exclude irrelevant data?
- KFF (Known File Filter) (Correct answer)
- Fuzzy hashing library
- File signature analysis
- Entropy scoring
Correct answer: KFF (Known File Filter)
The Known File Filter (KFF) compares evidence file hashes against known good and known bad hash sets to flag or exclude files.
Question 5: When examining a RAID-5 array in FTK, which information is CRITICAL for the examiner to obtain before reconstruction?
- The RAID controller firmware version
- Strip size, disk order, and parity rotation scheme (Correct answer)
- The file system type used on the array
- The operating system installed on the RAID volume
Correct answer: Strip size, disk order, and parity rotation scheme
Accurate RAID-5 reconstruction requires knowing the strip size, the correct disk order, and how parity is rotated across the array.
Question 6: In AccessData's Password Recovery Toolkit (PRTK), what is a 'dictionary attack with rules' primarily designed to do?
- Test every possible character combination up to a set length
- Apply transformations like capitalization and number substitution to dictionary words (Correct answer)
- Use previously cracked passwords from other cases as the wordlist
- Replay authentication tokens captured from network traffic
Correct answer: Apply transformations like capitalization and number substitution to dictionary words
Dictionary attacks with rules apply mutation rules (capitalization, leet-speak, appended numbers) to base dictionary words to crack common password patterns.
Question 7: An examiner identifies a file with a .jpg extension but FTK flags it as a 'bad extension' mismatch. What does this most likely indicate?
- The file is corrupted and unreadable
- The file's true type based on its header does not match the .jpg extension (Correct answer)
- The file was encrypted with a non-standard algorithm
- The file's hash does not match known NSFW hashes
Correct answer: The file's true type based on its header does not match the .jpg extension
FTK's file signature analysis compares file headers (magic bytes) to the extension, and a mismatch suggests the extension was changed to disguise the true file type.
ACE Tool Proficiency & Analysis Techniques 2
In FTK, what does the 'Explicit Images' filter rely on to categorize photos without manual review?