ACE Tool Proficiency & Analysis Techniques 2

Question 1

In FTK, what does the 'Explicit Images' filter rely on to categorize photos without manual review?

Accepted Answer

Skin-tone pixel percentage analysis via integrated AI scoring

Answer

FTK's explicit image detection uses skin-tone pixel analysis combined with AI scoring to flag potentially explicit images for examiner review.

Question 2

When using FTK Imager to create a logical image of a live Windows system, which artifact is MOST likely to be captured that a physical image of the powered-off drive would miss?

Accepted Answer

Currently running process memory

Answer

A logical image of a live system can capture currently running process memory, which only exists while the system is powered on.

Question 3

An ACE examiner uses Registry Viewer to analyze the NTUSER.DAT hive. Which key reveals the most recently typed URLs in Internet Explorer?

Accepted Answer

HKCU\Software\Microsoft\Internet Explorer\TypedURLs

Answer

The TypedURLs key under HKCU\Software\Microsoft\Internet Explorer stores URLs manually typed into the IE address bar.

Question 4

Which FTK feature allows an examiner to compare hash values of evidence files against a known set of system files to quickly exclude irrelevant data?

Accepted Answer

KFF (Known File Filter)

Answer

The Known File Filter (KFF) compares evidence file hashes against known good and known bad hash sets to flag or exclude files.

Question 5

When examining a RAID-5 array in FTK, which information is CRITICAL for the examiner to obtain before reconstruction?

Accepted Answer

Strip size, disk order, and parity rotation scheme

Answer

Accurate RAID-5 reconstruction requires knowing the strip size, the correct disk order, and how parity is rotated across the array.

(ACE) AccessData Certified Examiner Practice Test

(ACE) AccessData Certified Examiner Practice Test

ACE Tool Proficiency & Analysis Techniques 2